CryptoGo: Automatic Detection of Go Cryptographic API Misuses

Cryptographic algorithms act as essential ingredients of all secure systems. However, the expected security guarantee from cryptographic algorithms often falls short in practice due to various cryptographic application programming interfaces (API) misuses. While many research studies target cryptographic API misuses in the cases of Java, C/C++ and Python, similar issues within the Go domain are still uncovered. In this work, we design and implement CryptoGo, a static analysis detector leveraging taint analysis technique to automatically identify cryptographic misuse of large-scale Go cryptographic projects. We derive 12 cryptographic rules coupled with Go cryptographic APIs and propose the idea of integrating cryptographic algorithm classification into cryptographic misuse detection for the first time, thus achieving precise detection of Go cryptographic API misuse and practical guidance of selecting appropriate cryptographic algorithms. We conduct five kinds of specific taint analyzers to perform backward or forward taint tracking on the APIs and arguments in the intermediate representation of the Go source code. Running on 120 open source Go cryptographic projects from GitHub, CryptoGo discovered that 83.33% of the Go cryptographic projects have at least one cryptographic misuse. It takes only 86.27 milliseconds per thousand lines of code on average for detection. We also disclose the discovered issues to the developers and collect their feedback. Our findings highlight the poor implementation and weak protection in the current Go cryptographic projects.