DROIDCCT: Cryptographic Compliance Test via Trillion-Scale Measurement

• URL: http://arxiv.org/abs/2601.11745v1
• Date: Fri, 16 Jan 2026 19:54:49 GMT
• Title: DROIDCCT: Cryptographic Compliance Test via Trillion-Scale Measurement
• Authors: Daniel Moghimi, Alexandru-Cosmin Mihai, Borbala Benko, Catherine Vlasov, Elie Bursztein, Kurt Thomas, Laszlo Siroki, Pedro Barbosa, Remi Audebert,
• Abstract summary: DroidCCT is a distributed test framework to evaluate the scale of a wide range of failures/bugs in cryptography for end users.<n>We collect trillions of samples from cryptographic operations of Android Keystore on half a billion devices.
• Score: 39.26783039269169
• License: http://arxiv.org/licenses/nonexclusive-distrib/1.0/
• Abstract: We develop DroidCCT, a distributed test framework to evaluate the scale of a wide range of failures/bugs in cryptography for end users. DroidCCT relies on passive analysis of artifacts from the execution of cryptographic operations in the Android ecosystem to identify weak implementations. We collect trillions of samples from cryptographic operations of Android Keystore on half a billion devices and apply severalanalysis techniques to evaluate the quality of cryptographic output from these devices and their underlying implementations. Our study reveals several patterns of bugs and weakness in cryptographic implementations from various manufacturers and chipsets. We show that the heterogeneous nature of cryptographic implementations results in non-uniform availability and reliability of various cryptographic functions. More importantly, flaws such as the use of weakly-generated random parameters, and timing side channels may surface across deployments of cryptography. Our results highlight the importance of fault- and side-channel-resistant cryptography and the ability to transparently and openly test these implementations.

Related papers

• Taming Imperfect Process Verifiers: A Sampling Perspective on Backtracking [54.43083499412643]
  Test-time algorithms that combine the generative power of language models with process verifiers offer a promising lever for eliciting new reasoning capabilities.<n>We introduce a new process-guided test-time sampling algorithm, VGB, which uses theoretically grounded backtracking to achieve provably better robustness to verifier errors.
  arXiv  Detail & Related papers  (2025-10-03T16:21:14Z)
• Characterizing the Sensitivity to Individual Bit Flips in Client-Side Operations of the CKKS Scheme [0.4054550707324753]
  Homomorphic Encryption (HE) enables computation on encrypted data without decryption, making it a cornerstone of privacy-preserving computation in untrusted environments.<n>HE sees growing adoption in sensitive applications such as secure machine learning and confidential data analysis ensuring its robustness against errors becomes critical.
  arXiv  Detail & Related papers  (2025-07-28T14:42:09Z)
• Post-Quantum Cryptography: An Analysis of Code-Based and Lattice-Based Cryptosystems [55.49917140500002]
  Quantum computers will be able to break modern cryptographic systems using Shor's Algorithm.<n>We first examine the McEliece cryptosystem, a code-based scheme believed to be secure against quantum attacks.<n>We then explore NTRU, a lattice-based system grounded in the difficulty of solving the Shortest Vector Problem.
  arXiv  Detail & Related papers  (2025-05-06T03:42:38Z)
• Anomaly Detection with LWE Encrypted Control [5.263161322684099]
  We present a novel mechanism for anomaly detection over Learning with Errors encrypted signals.<n>The detector exploits the homomorphic property of LWE encryption to perform hypothesis tests on transformations of the encrypted samples.
  arXiv  Detail & Related papers  (2025-02-14T16:38:51Z)
• Cryptanalysis via Machine Learning Based Information Theoretic Metrics [58.96805474751668]
  We propose two novel applications of machine learning (ML) algorithms to perform cryptanalysis on any cryptosystem.<n>These algorithms can be readily applied in an audit setting to evaluate the robustness of a cryptosystem.<n>We show that our classification model correctly identifies the encryption schemes that are not IND-CPA secure, such as DES, RSA, and AES ECB, with high accuracy.
  arXiv  Detail & Related papers  (2025-01-25T04:53:36Z)
• ChatGPT's Potential in Cryptography Misuse Detection: A Comparative Analysis with Static Analysis Tools [0.08192907805418582]
  cryptography misuse detectors have demonstrated inconsistent performance and remain largely inaccessible to most developers. We investigated the extent to which ChatGPT can detect cryptography misuses and compared its performance with that of the state-of-the-art static analysis tools. Our investigation, mainly based on the CryptoAPI-Bench benchmark, demonstrated that ChatGPT is effective in identifying cryptography API misuses, and with the use of prompt engineering, it can even outperform leading static cryptography misuse detectors.
  arXiv  Detail & Related papers  (2024-09-10T14:50:12Z)
• FoC: Figure out the Cryptographic Functions in Stripped Binaries with LLMs [51.898805184427545]
  We propose a novel framework called FoC to Figure out the Cryptographic functions in stripped binaries.<n>We first build a binary large language model (FoC-BinLLM) to summarize the semantics of cryptographic functions in natural language.<n>We then build a binary code similarity model (FoC-Sim) upon the FoC-BinLLM to create change-sensitive representations and use it to retrieve similar implementations of unknown cryptographic functions in a database.
  arXiv  Detail & Related papers  (2024-03-27T09:45:33Z)
• Privacy Preserving Anomaly Detection on Homomorphic Encrypted Data from IoT Sensors [0.9831489366502302]
  Homomorphic encryption schemes are promising solutions as they enable the processing and execution of operations on IoT data while still encrypted. We propose a novel privacy-preserving anomaly detection solution designed for homomorphically encrypted data generated by IoT devices.
  arXiv  Detail & Related papers  (2024-03-14T12:11:25Z)
• Revocable Cryptography from Learning with Errors [61.470151825577034]
  We build on the no-cloning principle of quantum mechanics and design cryptographic schemes with key-revocation capabilities. We consider schemes where secret keys are represented as quantum states with the guarantee that, once the secret key is successfully revoked from a user, they no longer have the ability to perform the same functionality as before.
  arXiv  Detail & Related papers  (2023-02-28T18:58:11Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.