"Jumping Through Hoops": Why do Java Developers Struggle with Cryptography APIs?

To protect sensitive data processed by current applications, developers, whether security experts or not, have to rely on cryptography. While cryptography algorithms have become increasingly advanced, many data breaches occur because developers do not correctly use the corresponding APIs. To guide f...

Celý popis

Uloženo v:
Podrobná bibliografie
Vydáno v:Proceedings / International Conference on Software Engineering s. 935 - 946
Hlavní autoři: Nadi, Sarah, Kruger, Stefan, Mezini, Mira, Bodden, Eric
Médium: Konferenční příspěvek
Jazyk:angličtina
Vydáno: ACM 01.05.2016
Témata:
API misuse
Complexity theory
Cryptography
empirical software engineering
Encryption
Face
Java
Libraries
Public key
ISSN:1558-1225
On-line přístup:Získat plný text
Tagy: Přidat tag
Žádné tagy, Buďte první, kdo vytvoří štítek k tomuto záznamu!
Abstract To protect sensitive data processed by current applications, developers, whether security experts or not, have to rely on cryptography. While cryptography algorithms have become increasingly advanced, many data breaches occur because developers do not correctly use the corresponding APIs. To guide future research into practical solutions to this problem, we perform an empirical investigation into the obstacles developers face while using the Java cryptography APIs, the tasks they use the APIs for, and the kind of (tool) support they desire. We triangulate data from four separate studies that include the analysis of 100 StackOverflow posts, 100 GitHub repositories, and survey input from 48 developers. We find that while developers find it difficult to use certain cryptographic algorithms correctly, they feel surprisingly confident in selecting the right cryptography concepts (e.g., encryption vs. signatures). We also find that the APIs are generally perceived to be too low-level and that developers prefer more task-based solutions.
AbstractList To protect sensitive data processed by current applications, developers, whether security experts or not, have to rely on cryptography. While cryptography algorithms have become increasingly advanced, many data breaches occur because developers do not correctly use the corresponding APIs. To guide future research into practical solutions to this problem, we perform an empirical investigation into the obstacles developers face while using the Java cryptography APIs, the tasks they use the APIs for, and the kind of (tool) support they desire. We triangulate data from four separate studies that include the analysis of 100 StackOverflow posts, 100 GitHub repositories, and survey input from 48 developers. We find that while developers find it difficult to use certain cryptographic algorithms correctly, they feel surprisingly confident in selecting the right cryptography concepts (e.g., encryption vs. signatures). We also find that the APIs are generally perceived to be too low-level and that developers prefer more task-based solutions.
Author Kruger, Stefan
Nadi, Sarah
Mezini, Mira
Bodden, Eric
Author_xml – sequence: 1
  givenname: Sarah
  surname: Nadi
  fullname: Nadi, Sarah
  email: nadi@cs.tu-darmstadt.de
– sequence: 2
  givenname: Stefan
  surname: Kruger
  fullname: Kruger, Stefan
  email: stefan.krueger@cased.de
– sequence: 3
  givenname: Mira
  surname: Mezini
  fullname: Mezini, Mira
  email: mezini@cs.tu-darmstadt.de
– sequence: 4
  givenname: Eric
  surname: Bodden
  fullname: Bodden, Eric
  email: eric.bodden@uni-paderborn.de
BookMark eNotjE1LwzAAhqMouM2dPXgJu3cmaT69yOjUbQwcOPE4kjb9kG4pSTvpv7eo8MDDAy_vGFyd3MkCcIfRHGPKHoiUVEg8_7VCF2CqhqQMxbFCCF-CEWZMRpgQdgPGIXwhhDhVagR2s013bKpTAfeld11RwpVzTZg9ws-yh5mDG33WcGnPtnaN9QG-t74ritrC76otYeL7pnWF182wXuzW4ekWXOe6Dnb67wn4eHneJ6to-_a6ThbbSBMq2khipplVJmYmzzOOc8RSy4k0yuhYG21yygfSNGOYGUxpmmfCIEE0IUgYGU_A_d9vZa09NL46at8fhJRccRX_ACP_UEs
CODEN IEEPAD
ContentType Conference Proceeding
DBID 6IE
6IH
CBEJK
RIE
RIO
DOI 10.1145/2884781.2884790
DatabaseName IEEE Electronic Library (IEL) Conference Proceedings
IEEE Proceedings Order Plan (POP) 1998-present by volume
IEEE Xplore All Conference Proceedings
IEEE Electronic Library (IEL)
IEEE Proceedings Order Plans (POP) 1998-present
DatabaseTitleList
Database_xml – sequence: 1
  dbid: RIE
  name: IEEE Electronic Library (IEL)
  url: https://ieeexplore.ieee.org/
  sourceTypes: Publisher
DeliveryMethod fulltext_linktorsrc
Discipline Computer Science
EISBN 9781450339001
145033900X
EISSN 1558-1225
EndPage 946
ExternalDocumentID 7886969
Genre orig-research
GroupedDBID -~X
.4S
.DC
123
23M
29O
5VS
6IE
6IF
6IH
6IK
6IL
6IM
6IN
8US
AAJGR
AAWTH
ABLEC
ADZIZ
AFFNX
ALMA_UNASSIGNED_HOLDINGS
APO
ARCSS
AVWKF
BEFXN
BFFAM
BGNUA
BKEBE
BPEOZ
CBEJK
CHZPO
EDO
FEDTE
I-F
I07
IEGSK
IJVOP
IPLJI
M43
OCL
RIE
RIL
RIO
RNS
XOL
ID FETCH-LOGICAL-a247t-815a5e9b35bffd61f05ce628b9ba3ababf46f46ccd515b144cfd7b072a2207b83
IEDL.DBID RIE
ISICitedReferencesCount 146
ISICitedReferencesURI http://www.webofscience.com/api/gateway?GWVersion=2&SrcApp=Summon&SrcAuth=ProQuest&DestLinkType=CitingArticles&DestApp=WOS_CPL&KeyUT=000406138600080&url=https%3A%2F%2Fcvtisr.summon.serialssolutions.com%2F%23%21%2Fsearch%3Fho%3Df%26include.ft.matches%3Dt%26l%3Dnull%26q%3D
IngestDate Wed Aug 27 02:07:20 EDT 2025
IsPeerReviewed false
IsScholarly true
Language English
LinkModel DirectLink
MergedId FETCHMERGED-LOGICAL-a247t-815a5e9b35bffd61f05ce628b9ba3ababf46f46ccd515b144cfd7b072a2207b83
PageCount 12
ParticipantIDs ieee_primary_7886969
PublicationCentury 2000
PublicationDate 2016-May
PublicationDateYYYYMMDD 2016-05-01
PublicationDate_xml – month: 05
  year: 2016
  text: 2016-May
PublicationDecade 2010
PublicationTitle Proceedings / International Conference on Software Engineering
PublicationTitleAbbrev ICSE
PublicationYear 2016
Publisher ACM
Publisher_xml – name: ACM
SSID ssj0006499
Score 2.4620318
Snippet To protect sensitive data processed by current applications, developers, whether security experts or not, have to rely on cryptography. While cryptography...
SourceID ieee
SourceType Publisher
StartPage 935
SubjectTerms API misuse
Complexity theory
Cryptography
empirical software engineering
Encryption
Face
Java
Libraries
Public key
Title "Jumping Through Hoops": Why do Java Developers Struggle with Cryptography APIs?
URI https://ieeexplore.ieee.org/document/7886969
WOSCitedRecordID wos000406138600080&url=https%3A%2F%2Fcvtisr.summon.serialssolutions.com%2F%23%21%2Fsearch%3Fho%3Df%26include.ft.matches%3Dt%26l%3Dnull%26q%3D
hasFullText 1
inHoldings 1
isFullTextHit
isPrint
link http://cvtisr.summon.serialssolutions.com/2.0.0/link/0/eLvHCXMwlV3Pa8IwFH6o7LCT23TsN0F2XLVNm6TdZQyZOBnSg2PeJL-6DYYVdYL__V7TTi-7DAIJJRDyhSTfS997H8CtKEwun1lP-Zp6UWCUl-iEemHGg4z7OjLaZdd_EeNxPJ0maQ3udrEw1lrnfGa7RdP9yze5_i6eynporvGEJ3WoC8HLWK3dqcuRulepe4KI9WgcF0GUXVe7A3evneKujkHzf4MeQXsfg0fS3e1yDDU7P4HmrwgDqfZkC9LOCFcEu5BJKblDhnm-WHXuydvHlpicjORGkso3CLkecdrF71-WFE-wpL_cLtZV2mrymD6vHtrwOnia9IdeJZPgSRqJtRcHTDKbqJCpLDMIsc-05TRWiZKhVFJlEceitUHuotCA0pkRyhdUUuoLFYen0Jjnc3sGBPvFTCO4aGIjfFSpQGjfCo08TAtmzqFVADRblJkwZhU2F39_voRDpBe8dA-8ggZOz17Dgd6sP1fLG7d8P4qjnLo
linkProvider IEEE
linkToHtml http://cvtisr.summon.serialssolutions.com/2.0.0/link/0/eLvHCXMwlV3NS8MwFH_MKehp6iZ-G4ZHu7Vpk7ReRIZjm3P0MHG3ka-qIO3Y5mD_vWlat4sXIZAQAiHvkeT3kvfeD-CW5SaXS7QjXImdwFPCiWSEHT-hXkJdGShps-sP2WgUTiZRXIG7TSyM1to6n-lW3rR_-SqT3_lTWduYazSi0Q7s5sxZXhGttTl3qQHvZfIeLyBtHIZ5GGXL1vbI3bKn2MujW_vftIfQ2EbhoXhzvxxBRafHUPulYUDlrqxD3BwYnZghaFyQ7qBels0WzXv09rFGKkMDvuKo9A4yaA9Z9uL3L43yR1jUma9nyzJxNXqM-4uHBrx2n8adnlMSJTgcB2zphB7hREfCJyJJlBGyS6SmOBSR4D4XXCQBNUVKZdCLMCaUTBQTLsMcY5eJ0D-Bapql-hSQGRcSyRg1RrYRHxbCY9LVTBokJhlRZ1DPBTSdFbkwpqVszv_uvoH93vhlOB32R88XcGDABi2cBS-hapaqr2BPrpafi_m1VeUP4CWgAQ
openUrl ctx_ver=Z39.88-2004&ctx_enc=info%3Aofi%2Fenc%3AUTF-8&rfr_id=info%3Asid%2Fsummon.serialssolutions.com&rft_val_fmt=info%3Aofi%2Ffmt%3Akev%3Amtx%3Abook&rft.genre=proceeding&rft.title=Proceedings+%2F+International+Conference+on+Software+Engineering&rft.atitle=%22Jumping+Through+Hoops%22%3A+Why+do+Java+Developers+Struggle+with+Cryptography+APIs%3F&rft.au=Nadi%2C+Sarah&rft.au=Kruger%2C+Stefan&rft.au=Mezini%2C+Mira&rft.au=Bodden%2C+Eric&rft.date=2016-05-01&rft.pub=ACM&rft.eissn=1558-1225&rft.spage=935&rft.epage=946&rft_id=info:doi/10.1145%2F2884781.2884790&rft.externalDocID=7886969