Crypto misuse study for CCA

Resources:

CPA analysis paper: https://sites.cs.ucsb.edu/~chris/research/doc/ccs13_cryptolint.pdf

http://lersse-dl.ece.ubc.ca/record/324/files/binsight-asiaccs-2018.pdf

Examples of misuse of CCA implementation:

https://www.usenix.org/system/files/conference/usenixsecurity18/sec18-poddebniak.pdf

https://www.usenix.org/system/files/conference/usenixsecurity16/sec16_paper_garman.pdf

https://dl.acm.org/doi/abs/10.1145/3319535.3354214

Importance of the CCA model

https://www.semanticscholar.org/paper/Why-Chosen-Ciphertext-Security-Matters-Shoup/0e58401bcb78a6d9b8fafcdab88be73dde0e21b8?fbclid=IwAR04IlcrcF2e6H5Fs29IDxT27JfkoBH_C7DcSYP6cwBHpr0yOT0cq4TlrXc

Our Approach

For public-key encryption, check whether a proper padding scheme (e.g., OAEP) is applied.

For private-key encryption, check whether authentication encryption (e.g., GCM mode or CBC mode with MAC) is properly implemented.