ICMC17: Crypto++: Past Validations and Future Directions

Jeffrey Walton, Security Consultant.

This is an older toolkit, Jeff fell in love with it when he was in college in the 90s. He's been working in computer security ever since.

Crypto++ is a C++ class library, written by Wei Dai in June 1995. It's a general purpose crypto library, handed over to the community in 2015. https://www.cyrptopp.com/

When the library was hit with CVE in 2015, he handed it over to the community to develop. Since Jeffrey has been using it since 1990s, he was chosen to become one of the maintainers. Wei Dei still advises.

C++03 through C++17 have heavy use of templates and static polymorphism (yay C++). Makes things faster, but makes it hard to adopt, especially as there is not excellent documentation. He tries to use questions on stackoverflow to demonstrate where to spend time on the documentation.

Right now, crypto++ is on the historical validation list, which makes it pretty much useless... (them and everyone else ended up on the list last year, due to DRBG changes).

Crypto++ validations are on Windows only. Includes NIST approved algorithms; RNG, AES, SHA, MAC, RSA, DH. There are non-FIPS routines in other DLLs.

Going forward, he'd like to add C bindings. Would like to add an engine-like interface.  Will they do another validation? Probably not - too expensive. But, could wrap around other validated crypto to take advantage.

Crypto++ now uses OpenSSL's FIPS Object Module, to effectively provide a FIPS validated module - so you can stay on your C++ bindings and not make changes to your application.

Going forward, he