用AI发现加密误用漏洞，自动挖掘库级问题并扩散到应用层。
Chai: Agentic Discovery of Cryptographic Misuse Vulnerabilities
- 利用AI分析自然信号，精准定位加密库中的安全缺陷。
- 在多个库中发现超100个漏洞，包括影响数十亿设备的致命漏洞。
- 适合安全研究人员和开源项目维护者快速识别潜在风险。
AI辅助漏洞发现已在内存安全等类别中证明有效，但加密误用等危险漏洞缺乏类似检测手段。本文提出Chai，一个基于AI的系统，通过自然信号发现并验证加密误用漏洞。Chai重构传统差分测试方法，利用AI提升对库级真实安全问题的检测精度，并将常被忽视的差异作为下游应用漏洞的线索。该系统颠覆了以往单代码库多漏洞的审计模式，转而以库级漏洞为起点，在加密依赖图谱中传播，实现效率倍增。我们在X.509、JWT和SAML库上评估Chai，发现了一个影响数十亿设备的SSL库关键漏洞，以及一个主流浏览器和多个Linux发行版所用库的安全缺陷。总计揭示超过100个漏洞。
原文摘要 · Abstract (English)
AI-assisted vulnerability discovery has proven effective for bug classes like memory safety, where instrumentation confirms memory violations and efficiently filters false positives. Many dangerous vulnerability classes, such as cryptographic misuse, however, lack any comparable instrumentation. In this work, we present Chai, an AI-based system that discovers and validates cryptographic misuse vulnerabilities through naturally occurring signals. To achieve this, Chai rethinks the classical technique of differential testing by leveraging AI to 1) improve precision for detecting real security issues in libraries, and 2) repurpose commonly overlooked discrepancies as leads for tangible vulnerabilities in downstream applications. In doing so, Chai inverts the prevailing paradigm of AI vulnerability discovery: instead of auditing one codebase for many flaws, it catalogs flaws at the library level and propagates them across a cryptographic dependency graph, delivering compounding efficiency gains. We evaluate Chai across X.509, JWT, and SAML libraries. Chai discovered a previously unknown critical vulnerability in an SSL library that powers billions of devices, along with security bugs in one library behind a major web browser and another in major Linux distributions. In total, these techniques surfaced over 100 vulnerabilities.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。