Computing That Serves

A Large-Scale Analysis of How OpenSSL is Used in Open Source Software

Scott Heidbrink
MS Thesis Defense
Monday, March 12th at 3:00 pm                                
In 3350 TMCB
Advisor: Daniel Zappala

As vulnerabilities become more common the security of applications are coming under increased scrutiny. In regards to Internet security, recent work discovers that many vulnerabilities are caused by TLS library misuse. This misuse is attributed to large and confusing APIs and developer misunderstanding of security generally. Due to these problems there is a desire for simplified TLS libraries and security handling. However, as of yet there is no analysis of how the existing APIs are used, beyond how incorrect usage motivates the need to replace them. We provide an analysis of contemporary usage of OpenSSL across 410 popular secure applications. These insights will inform the security community as it addresses TLS library redesign.