From Struggle to Simplicity with a Usable and Secure API for Encryption in Java

TL;DR

This paper introduces SafEncrypt, a user-friendly and secure Java API that simplifies encryption tasks, reduces cryptography misuse, and is effective across different developer experience levels.

Contribution

The paper presents SafEncrypt, a novel Java API that enhances usability and security in cryptography by abstracting complexities and preventing common misuses.

Findings

SafEncrypt reduces cryptography misuse among developers.

It is effective for users with varying experience levels.

Experiments confirm its suitability and ease of use.

Abstract

Cryptography misuses are prevalent in the wild. Crypto APIs are hard to use for developers, and static analysis tools do not detect every misuse. We developed SafEncrypt, an API that streamlines encryption tasks for Java developers. It is built on top of the native Java Cryptography Architecture, and it shields developers from crypto complexities and erroneous low-level details. Experiments showed that SafEncrypt is suitable for developers with varying levels of experience.