Search

The correct adoption of cryptography APIs is challenging for mainstream developers, often resulting in widespread API misuse. Meanwhile, cryptography misuse detectors have demonstrated inconsistent performance and remain largely inaccessible to most developers. We investigated the extent to which ChatGPT can detect cryptography misuses and compared its performance with that of the state-of-the-art static analysis tools. Our investigation, mainly based on the CryptoAPI-Bench benchmark, demonstrated that ChatGPT is effective in identifying cryptography API misuses, and with the use of prompt engineering, it can even outperform leading static cryptography misuse detectors., Comment: ESEM 2024

Cryptography misuses are prevalent in the wild. Crypto APIs are hard to use for developers, and static analysis tools do not detect every misuse. We developed SafEncrypt, an API that streamlines encryption tasks for Java developers. It is built on top of the native Java Cryptography Architecture, and it shields developers from crypto complexities and erroneous low-level details. Experiments showed that SafEncrypt is suitable for developers with varying levels of experience., Comment: ESEM 2024

For many materials, Raman spectra are intricately structured and provide valuable information about compositional stoichiometry and crystal quality. Here we use density-functional theory calculations, mass approximation, and the Raman intensity weighted $\Gamma$-point density of state approach to analyze Raman scattering and vibrational modes in zincblende, wurtzite, and hexagonal BX (X = N, P, and As) structures. The influence of crystal structure and boron isotope disorder on Raman line shapes is examined. Our results demonstrate that long-range Coulomb interactions significantly influence the evolution of Raman spectra in cubic and wurtzite BN compounds. With the evolution of the compositional rate from $^{11}$B to $^{10}$B, a shift toward higher frequencies, as well as the maximum broadening and asymmetry of the Raman peaks, is expected around the 1:1 ratio. The calculated results are in excellent agreement with the available experimental data. This study serves as a guide for understanding how crystal symmetry and isotope disorder affect phonons in BX compounds, which are relevant to quantum single-photon emitters, heat management, and crystal quality assessments.

We prove local well-posedness of the Cahn-Hilliard equation with additive noise. Our method relies on paracontrolled calculus and the Da Prato-Debussche trick.

Cryptography is known as a challenging topic for developers. We studied StackOverflow posts to identify the problems that developers encounter when using Java Cryptography Architecture (JCA) for symmetric encryption. We investigated security risks that are disseminated in these posts, and we examined whether ChatGPT helps avoid cryptography issues. We found that developers frequently struggle with key and IV generations, as well as padding. Security is a top concern among developers, but security issues are pervasive in code snippets. ChatGPT can effectively aid developers when they engage with it properly. Nevertheless, it does not substitute human expertise, and developers should remain alert., Comment: Accepted in "Journal of Systems and Software", June 10, 2024

Cryptography has a pivotal role in securing our digital world. Nonetheless, it is a challenging topic to learn. In this paper, we show that despite its complex nature, dyslexia$-$a learning disorder that influences reading and writing skills$-$does not hinder one's ability to comprehend cryptography. In particular, we conducted a gameful workshop with 14 high-school dyslexic students and taught them fundamental encryption methods. The students engaged well, learned the techniques, and enjoyed the training. We conclude that with a proper approach, dyslexia cannot hinder learning a complex subject such as cryptography., Comment: 36th IEEE Conference on Software Engineering Education and Training (CSEE&T 2024)

REST APIs have a pivotal role in accessing protected resources. Despite the availability of security testing tools, mass assignment vulnerabilities are common in REST APIs, leading to unauthorized manipulation of sensitive data. We propose a lightweight approach to mine the REST API specifications and identify operations and attributes that are prone to mass assignment. We conducted a preliminary study on 100 APIs and found 25 prone to this vulnerability. We confirmed nine real vulnerable operations in six APIs., Comment: EASE 2024

Many developers rely on Large Language Models (LLMs) to facilitate software development. Nevertheless, these models have exhibited limited capabilities in the security domain. We introduce LLMSecGuard, a framework to offer enhanced code security through the synergy between static code analyzers and LLMs. LLMSecGuard is open source and aims to equip developers with code solutions that are more secure than the code initially generated by LLMs. This framework also has a benchmarking feature, aimed at providing insights into the evolving security attributes of these models., Comment: SECUTE, EASE 2024

Quantum states encoded in the time-bin degree of freedom of photons represent a fundamental resource for quantum information protocols. Traditional methods for generating and measuring time-bin encoded quantum states face severe challenges due to optical instabilities, complex setups, and timing resolution requirements. Here, we leverage a robust approach based on Hong-Ou-Mandel interference that allows us to circumvent these issues. First, we perform high-fidelity quantum state tomographies of time-bin qubits with a short temporal separation. Then, we certify intrasystem polarization-time entanglement of single photons through a nonclassicality test. Finally, we propose a robust and scalable protocol to generate and measure high-dimensional time-bin quantum states in a single spatial mode. The protocol promises to enable access to high-dimensional states and tasks that are practically inaccessible with standard schemes, thereby advancing fundamental quantum information science and opening applications in quantum communication.

We study the classic correlation clustering in the dynamic setting. Given $n$ objects and a complete labeling of the object-pairs as either similar or dissimilar, the goal is to partition the objects into arbitrarily many clusters while minimizing disagreements with the labels. In the dynamic setting, an update consists of a flip of a label of an edge. In a breakthrough result, [BDHSS, FOCS'19] showed how to maintain a 3-approximation with polylogarithmic update time by providing a dynamic implementation of the Pivot algorithm of [ACN, STOC'05]. Since then, it has been a major open problem to determine whether the 3-approximation barrier can be broken in the fully dynamic setting. In this paper, we resolve this problem. Our algorithm, Modified Pivot, locally improves the output of Pivot by moving some vertices to other existing clusters or new singleton clusters. We present an analysis showing that this modification does indeed improve the approximation to below 3. We also show that its output can be maintained in polylogarithmic time per update.

We study the fully dynamic maximum matching problem. In this problem, the goal is to efficiently maintain an approximate maximum matching of a graph that is subject to edge insertions and deletions. Our focus is on algorithms that maintain the edges of a $(1-\epsilon)$-approximate maximum matching for an arbitrarily small constant $\epsilon > 0$. Until recently, the fastest known algorithm for this problem required $\Theta(n)$ time per update where $n$ is the number of vertices. This bound was slightly improved to $n/(\log^* n)^{\Omega(1)}$ by Assadi, Behnezhad, Khanna, and Li [STOC'23] and very recently to $n/2^{\Omega(\sqrt{\log n})}$ by Liu [FOCS'24]. Whether this can be improved to $n^{1-\Omega(1)}$ remains a major open problem. In this paper, we introduce {\em Ordered Ruzsa-Szemer\'edi (ORS)} graphs (a generalization of Ruzsa-Szemer\'edi graphs) and show that the complexity of dynamic matching is closely tied to them. For $\delta > 0$, define $ORS(\delta n)$ to be the maximum number of matchings $M_1, \ldots, M_t$, each of size $\delta n$, that one can pack in an $n$-vertex graph such that each matching $M_i$ is an {\em induced matching} in subgraph $M_1 \cup \ldots \cup M_{i}$. We show that there is a randomized algorithm that maintains a $(1-\epsilon)$-approximate maximum matching of a fully dynamic graph in $$ \widetilde{O}\left( \sqrt{n^{1+\epsilon} \cdot ORS(\Theta_\epsilon(n))} \right) $$ amortized update-time. While the value of $ORS(\Theta(n))$ remains unknown and is only upper bounded by $n^{1-o(1)}$, the densest construction known from more than two decades ago only achieves $ORS(\Theta(n)) \geq n^{1/\Theta(\log \log n)} = n^{o(1)}$ [Fischer et al. STOC'02]. If this is close to the right bound, then our algorithm achieves an update-time of $\sqrt{n^{1+O(\epsilon)}}$, resolving the aforementioned longstanding open problem in dynamic algorithms in a strong sense.

Bell nonlocality refers to correlations between two distant, entangled particles that challenge classical notions of local causality. Beyond its foundational significance, nonlocality is crucial for device-independent technologies like quantum key distribution and randomness generation. Nonlocality quickly deteriorates in the presence of noise, and restoring nonlocal correlations requires additional resources. These often come in the form of many instances of the input state and joint measurements, incurring a significant resource overhead. Here, we experimentally demonstrate that single copies of Bell-local states, incapable of violating any standard Bell inequality, can give rise to nonlocality after being embedded into a quantum network of multiple parties. We subject the initial entangled state to a quantum channel that broadcasts part of the state to two independent receivers and certify the nonlocality in the resulting network by violating a tailored Bell-like inequality. We obtain these results without making any assumptions about the prepared states, the quantum channel, or the validity of quantum theory. Our findings have fundamental implications for nonlocality and enable the practical use of nonlocal correlations in real-world applications, even in scenarios dominated by noise., Comment: 14 pages, 6 figures. Final version published in Nature Communications

We inspected 45 actively deployed Operational Technology (OT) product families from ten major vendors and found that every system suffers from at least one trivial vulnerability. We reported a total of 53 weaknesses, stemming from insecure by design practices or basic security design failures. They enable attackers to take a device offline, manipulate its operational parameters, and execute arbitrary code without any constraint. We discuss why vulnerable products are often security certified and appear to be more secure than they actually are, and we explain complicating factors of OT risk management., Comment: IEEE/ACM Workshop on the Internet of Safe Things 2023

WebAssembly has attracted great attention as a portable compilation target for programming languages. To facilitate in-depth studies about this technology, we have deployed Wasmizer, a tool that regularly mines GitHub projects and makes an up-to-date dataset of WebAssembly sources and their binaries publicly available. Presently, we have collected 2 540 C and C++ projects that are highly-related to WebAssembly, and built a dataset of 8 915 binaries that are linked to their source projects. To demonstrate an application of this dataset, we have investigated the presence of eight WebAssembly compilation smells in the wild., Comment: 11 pages + 1 page of references Preprint of MSR'23 publication

Point defects in diamond may act as quantum bits. Recently, oxygen-vacancy related defects have been proposed to the origin of the so-called ST1 color center in diamond that can realize a long-living solid-state quantum memory. Motivated by this proposal we systematically investigate oxygen-vacancy complexes in diamond by means of first principles density functional theory calculations. We find that all the considered oxygen-vacancy defects have a high-spin ground state in their neutral charge state, which disregards them as an origin for the ST1 color center. We identify a high-spin metastable oxygen-vacancy complex and characterize their magnetooptical properties for identification in future experiments., Comment: 9 pages, 6 figures, 2 tables

Static program analysis development is a non-trivial and time-consuming task. We present a framework through which developers can define static program analyses in natural language. We show the application of this framework to identify cryptography misuses in Java programs, and we discuss how it facilitates static program analysis development for developers., Comment: The 30th IEEE International Conference on Software Analysis, Evolution and Reengineering, March 21st-24th, 2023