Researchers Release Security Software To Defend Against Cyberattacks

With every text message sent, every email, every item purchased online, consumers blindly rely on the process of encryption, the scrambling of data that protects it from unwanted eyes.

But encryption is hard to get right.

"Right now, encryption's ability to protect our data is only as strong as the testing its endured," said CyLab's Bryan Parno, an associate professor of Computer Science and Electrical and Computer Engineering. "If the encryption implementation has a bug, then a clever adversary can see credit card information, bank details, emails - whatever you might consider private."

For years, researchers have been working towards a holy grail of cybersecurity: developing code that is verifiably secure and hence requiring no penetration testing. This verifiably secure code would be mathematically proven to be invincible against certain types of cyberattacks.

A team consisting of researchers from Microsoft Research, Inria and CyLab (Parno and his Ph.D. student Aymeric Fromherz) recently released the world's first verifiably secure industrial-strength cryptographic library — a set of code that can be used to protect data and is guaranteed to protect against the most popular classes of cyberattacks.

The library, titled "EverCrypt," is available for download on Github.

"With EverCrypt, we can rule out entire classes of vulnerabilities," Parno said. "We rule out memory safety vulnerabilities, correctness flaws, and we prove the implementations are resistant to some of the most popular types of side channel attacks."

"Side channel" attacks occur when an adversary is able to infer the secret key - a string of numbers that unlocks or decrypts encrypted data - simply by observing how an encrypted server responds to queries. For example, if the key is even, the server may respond faster than if the key is odd.

The encryption process takes time, but Parno said that EverCrypt respects that.

"We've worked really hard on making sure EverCrypt's performance is at least as good as modern unverified cryptographic libraries," Parno said. "If your crypto is slow, anything you want to do securely will also be slow. EverCrypt isn't slow."

Pieces of the EverCrypt code set already are being used by Firefox, Microsoft, the Tezos blockchain and the Linux Virtual Private Network, Wireguard. Parno and the rest of the EverCrypt team said they hope other developers will download the library and start test-driving it on their platforms.

EverCrypt is a part of Project Everest, a research initiative aimed at creating verifiably secure implementations of the HTTPS ecosystem, the foundation of secure Internet communications.

Carnegie Mellon University is committed to educating, empowering and aligning its community around the world to address the Sustainable Development Goals, also known as the Global Goals, which aim to create a more peaceful, prosperous planet with just and inclusive societies. Recognizing the critical contributions that universities are making through education, research and practice, CMU publicly committed to undertaking a Voluntary University Review of the Global Goals. The 17 Global Goals cover wide-ranging issues, including reducing violence, ending extreme poverty, promoting equitable education, fighting inequality and injustice, advancing economic growth and decent work, and preventing the harmful effects of climate change by 2030.

The preceding story demonstrates CMU's work toward attaining Global Goal 12.