Re:What science can tell us about C and C++'s security (2020)
by NotSwift on Monday August 02, 2021 @02:01PM
(#28040309)
From An Empirical Study of Vulnerabilities in Cryptographic Libraries[0]:
> Among our most interesting findings is that only 27.2% of
> vulnerabilities in cryptographic libraries are cryptographic
> issues while 37.2% of vulnerabilities are memory safety is-
> sues, indicating that systems-level bugs are a greater secu-
> rity concern than the actual cryptographic procedures.
These libraries were developed by security experts and even they made some serious errors.
> Among our most interesting findings is that only 27.2% of > vulnerabilities in cryptographic libraries are cryptographic > issues while 37.2% of vulnerabilities are memory safety is- > sues, indicating that systems-level bugs are a greater secu- > rity concern than the actual cryptographic procedures.
These libraries were developed by security experts and even they made some serious errors.
[0]https://arxiv.org/abs/2107.04940