Computer Aided Cryptography Engineering
Development of hardware devices and software products is facilitated by a design flow, and a set of tools (e.g., compilers and debuggers), which automate tasks normally performed by experienced and highly skilled developers. However, in both hardware and software examples the tools are generic since they seldom provide specific support for a particular domain. Within the CACE project a toolbox, that will support the specific domain of cryptographic software engineering, will be designed, developed and deployed.
Motivation:Ordinarily, development of cryptographic software is a huge challenge: security and trust is mission critical and modern applications processing sensitive data typically require the deployment of sophisticated cryptographic techniques. The proposed toolbox will allow non-experts to develop high-level cryptographic applications and business models by means of cryptography-aware high-level programming languages and compilers. The description of such applications in this way will allow automatic analysis and transformation of cryptographic software to detect security critical implementation failures, e.g. software and hardware based side-channel attacks when realising low-level cryptographic primitives and protocols. Ultimately, the end result will be better quality and more robust software at a much lower cost; this provides both a clear economic benefit to the European industry in the short term, and positions it better in dealing with any future roadblocks to ICT development in the longer term.
Objectives:The CACE project aims to target the lack of support currently offered to cryptographic software engineers. The central objective is the development of a toolbox that supports the production of high quality cryptographic software. The aim is that specific components within the toolbox will address specific software development problems and processes; combined use of the constituent tools is enabled by designed integration between their interfaces. A representative example use of the toolbox might be to develop an online voting system by a natural, high-level description of the system properties. The CACE toolbox would take this description and produce an efficient, executable implementation, which has verifiable security properties both at the semantic and physical levels. The main technical objectives of CACE are therefore as follows:
- Development of a toolbox, which automates cryptographic tasks and therefore supports developers in implementing cryptographic schemes.
- Automatic translation from natural specifications.
- Automatic security awareness, analysis and correction.
- Automatic optimisation for diverse platforms.
Project Results and Innovation:
- Current state-of-the-art is that virtually nothing exists that overlaps with the planned activities.
- Resulting, the toolbox will produce faster and less erroneous code compared to the existing software
- Make Zero-Knowledge Proofs of Knowledge available to practitioners.
- Reduce the vulnerability against side channel attacks.
Consortium:The EC FP7 project CACE brings together leading companies and academic institutions in the area of cryptography. Together they represent a vertically integrated consortium, with knowledge stretching from the basic research (academic partners), to the design and marketing of products (industrial partners and SMEs). To foster the cooperation with industry, several experts support the project consortium as Advisory Board members.
As a lot of basic research and basic input on cryptography is needed for the CACE project, seven European universities as well as one Asian university participate in this project. Furthermore, a global industrial player and three SMEs contribute with their expertise and knowledge. The 12 project partners are situated in eight European countries (Austria, Denmark, Finland, Germany, United Kingdom, the Netherlands, Portugal and Switzerland) and one Asian country (Israel).