Embedded devices are increasingly ubiquitous in our society. Firmware updates are one of
the primary mechanisms to mitigate vulnerabilities in embedded systems. However, the …

The demand for automated security analysis techniques, such as static analysis based
security testing (SAST) tools continues to increase. To develop SASTs that are effectively …

Several studies showed that misuses of cryptographic APIs are common in real-world code
(eg, Apache projects and Android apps). There exist several open-sourced and commercial …

As privacy-sensitive applications based on zero-knowledge proofs (ZKPs) gain increasing
traction, there is a pressing need to detect vulnerabilities in ZKP circuits. This paper studies …

Cryptographic algorithms act as essential ingredients of all secure systems. However, the
expected security guarantee from cryptographic algorithms often falls short in practice due to …

IoT devices are increasingly adopting Secure Socket Layer (SSL) and Transport Layer
Security (TLS) protocols. However, the misuse of SSL/TLS libraries still threatens the …

Cryptographic libraries are a vital security component of software systems, yet their misuse
has caused several incidents. Prior work has established that misuse of cryptographic …

In recent years, query-based static application security testing (Q-SAST) tools such as
CodeQL have gained popularity due to their ability to codify vulnerability knowledge into …

The correct adoption of cryptography APIs is challenging for mainstream developers, often
resulting in widespread API misuse. Meanwhile, cryptography misuse detectors have …

In the last decade, a series of papers were published on using static analysis to detect
cryptographic API misuse. In each paper, apps are checked against a set of rules to see if …