Google Project Wycheproof will test encryption software for vulnerabilities

The blogpost further explain, “In cryptography, subtle mistakes can have catastrophic consequences, and mistakes in open source cryptographic software libraries repeat too often and remain undiscovered for too long.”

The idea with Project Wycheproof is to create a collection of unit tests for known, expected issues that tend to occur in some cryptographic algorithm. Google says its “cryptographers have surveyed the literature and implemented most known attacks,” in order to come up with these tests. Project Wycheproof’s test will work with some of the popular crypto-algorithms, which includes AES-EAX, AES-GCM, DH, DHIES, DSA, ECDH, ECDSA, ECIES and RSA, according to the Github page for the project.

Google’s first set of test for this project are in Java, which according to the company allows them to “test multiple providers with a single test suite.” Google also highlights that the Project is still far from complete, and passing a test doesn’t mean the software is secure. It only means the encryption software is safe from known attacks used in the test; there could still be other unknown weaknesses.

Google is also encouraging developers to contribute to the project.  It also says that if someone discovers a security issue with a known program, they should “first report directly to the maintainers of the libraries.”