Abstract
The improvement of quantum computing poses a significant threat to cryptographic security. It enables the potential utilization of quantum algorithms to compromise classical cryptographic algorithms, such as public-key cryptosystems including RSA (Rivest-Shamir-Adleman), DH (Diffie-Hellman), and ECC (Elliptic Curve Cryptography). Currently, many applications rely on open-source libraries for various functionalities, including quantum-vulnerable public-key cryptographic implementations to achieve data confidentiality, integrity, and authenticity. So how can we determine the exposure of such applications to quantum attacks? In this paper, we study the use of open-source cryptographic algorithms for the Python programming language. We first identify the most widely used Python cryptographic libraries and then establish a simple keyword-based approach to identify the potential use of vulnerable RSA, ECC, and DH algorithms within Python applications. Notably, the extracted set of 11 keywords demonstrates precision and accuracy exceeding 90%.
This is a preview of subscription content, log in via an institution to check access.
Access this chapter
Tax calculation will be finalised at checkout
Purchases are for personal use only
Similar content being viewed by others
References
Alagic, G., et al.: Status report on the third round of the nist post-quantum cryptography standardization process. US Department of Commerce, NIST (2022)
Choi, C.Q.: Ibm’s quantum leap: the company will take quantum tech past the 1,000-qubit mark in 2023. IEEE Spectr. 60(1), 46–47 (2023)
Diffie, W., Hellman, M.: New directions in cryptography. IEEE Trans. Inf. Theor. 22(6) (1976)
Elbaz, C., Rilling, L., Morin, C.: Automated keyword extraction from one-day vulnerabilities at disclosure. In: NOMS 2020-2020 IEEE/IFIP Network Operations and Management Symposium, pp. 1–9. IEEE (2020)
Faruk, M.J.H., Tahora, S., Tasnim, M., Shahriar, H., Sakib, N.: A review of quantum cybersecurity: threats, risks and opportunities. In: 2022 1st International Conference on AI in Cybersecurity (ICAIC), pp. 1–8. IEEE (2022)
Frantz, M., Xiao, Y., Pias, T.S., Yao, D.D.: Poster: precise detection of unprecedented python cryptographic misuses using on-demand analysis. In: The Network and Distributed System Security (NDSS) Symposium (2022)
Gidney, C., Ekerå, M.: How to factor 2048 bit RSA integers in 8 hours using 20 million noisy qubits. Quantum 5, 433 (2021)
Gouzien, É., Sangouard, N.: Factoring 2048-bit RSA integers in 177 days with 13 436 qubits and a multimode memory. Phys. Rev. Lett. 127(14), 140503 (2021)
Grassl, M., Langenberg, B., Roetteler, M., Steinwandt, R.: Applying grover’s algorithm to AES: quantum resource estimates. In: Takagi, T. (ed.) PQCrypto 2016. LNCS, vol. 9606, pp. 29–43. Springer, Cham (2016). https://doi.org/10.1007/978-3-319-29360-8_3
Grover, L.K.: A fast quantum mechanical algorithm for database search. In: Proceedings of the Twenty-Eighth Annual ACM Symposium on Theory of Computing, pp. 212–219 (1996)
Hekkala, J., Muurman, M., Halunen, K., Vallivaara, V.: Implementing post-quantum cryptography for developers. SN Comput. Sci. 4(4), 365 (2023)
Hwang, C.L., Lai, Y.J., Liu, T.Y.: A new approach for multiple objective decision making. Comput. Oper. Res. 20(8), 889–899 (1993)
Krüger, S., Späth, J., Ali, K., Bodden, E., Mezini, M.: Crysl: an extensible approach to validating the correct usage of cryptographic apis. IEEE Trans. Software Eng. 47(11), 2382–2400 (2019)
Li, W., Jia, S., Liu, L., Zheng, F., Ma, Y., Lin, J.: Cryptogo: automatic detection of go cryptographic API misuses. In: Proceedings of the 38th Annual Computer Security Applications Conference, pp. 318–331 (2022)
Merkle, R.C.: Secure communications over insecure channels. Commun. ACM 21(4), 294–299 (1978)
Miller, V.S.: Use of elliptic curves in cryptography. In: Williams, H.C. (ed.) CRYPTO 1985. LNCS, vol. 218, pp. 417–426. Springer, Heidelberg (1986). https://doi.org/10.1007/3-540-39799-X_31
Rahaman, S., et al.: Cryptoguard: high precision detection of cryptographic vulnerabilities in massive-sized java projects. In: Proceedings of the 2019 ACM SIGSAC Conference on Computer and Communications Security, pp. 2455–2472 (2019)
Rivest, R.L., Shamir, A., Adleman, L.: A method for obtaining digital signatures and public-key cryptosystems. Commun. ACM 21(2), 120–126 (1978)
Santoli, T., Schaffner, C.: Using simon’s algorithm to attack symmetric-key cryptographic primitives. arXiv preprint arXiv:1603.07856 (2016)
Shaikh, Z.A.: Keyword detection techniques: a comprehensive study. Eng. Technol. Appl. Sci. Res. 8(1), 2590–2594 (2018)
Shor, P.W.: Algorithms for quantum computation: discrete logarithms and factoring. In: Proceedings 35th Annual Symposium on Foundations of Computer Science, pp. 124–134. IEEE (1994)
Shor, P.W.: Polynomial-time algorithms for prime factorization and discrete logarithms on a quantum computer. SIAM Rev. 41(2), 303–332 (1999)
Simon, D.R.: On the power of quantum computation. SIAM J. Comput. 26(5), 1474–1483 (1997)
Vandersypen, L.M., Steffen, M., Breyta, G., Yannoni, C.S., Sherwood, M.H., Chuang, I.L.: Experimental realization of shor’s quantum factoring algorithm using nuclear magnetic resonance. Nature 414(6866), 883–887 (2001)
Wickert, A.K., Baumgärtner, L., Breitfelder, F., Mezini, M.: Python crypto misuses in the wild. In: Proceedings of the 15th ACM/IEEE International Symposium on Empirical Software Engineering and Measurement (ESEM), pp. 1–6 (2021)
Xie, W., Jiang, Y., Tang, Y., Ding, N., Gao, Y.: Vulnerability detection in IoT firmware: a survey. In: 2017 IEEE 23rd International Conference on Parallel and Distributed Systems (ICPADS), pp. 769–772. IEEE (2017)
Author information
Authors and Affiliations
Corresponding author
Editor information
Editors and Affiliations
Rights and permissions
Copyright information
© 2024 The Author(s), under exclusive license to Springer Nature Switzerland AG
About this paper
Cite this paper
Ye, X., Tan, T.G., Zhou, J. (2024). Towards Discovering Quantum-Threats for Applications Using Open-Source Libraries. In: Andreoni, M. (eds) Applied Cryptography and Network Security Workshops. ACNS 2024. Lecture Notes in Computer Science, vol 14586. Springer, Cham. https://doi.org/10.1007/978-3-031-61486-6_17
Download citation
DOI: https://doi.org/10.1007/978-3-031-61486-6_17
Published:
Publisher Name: Springer, Cham
Print ISBN: 978-3-031-61485-9
Online ISBN: 978-3-031-61486-6
eBook Packages: Computer ScienceComputer Science (R0)