You
Thank you very much
Well, this is for the recording. Yes, again. Thank you for coming. I'm not going to be repeating the whole things right so we have
We had received lots of lots of
Presentations idea. We cannot fit more we even got a full day that was amazing by the way
Please softer
Today or at some point in the next weeks and stuff like that
Right to the first the organizers and say if you like this workshop to continue and stuff like that because that's the way that they decide
which rooms get which
Beverem proposals get accepted and which rooms they get and which days they get or slots and stuff like that
so yeah,
we usually have
30 minutes slots
But in order to fit even more we went to
20 minutes slots in the middle of the day and then you'll see my organizers are here
Here
So you'll get this after with the way
Very basic information about the speakers. There's a camera there. There's a microphone here. You should be talking to the camera. You should be speaking to the mic
Everything is recorded everything is streamed
So yeah, please take care of that you should stay on the
Correct side of this red line here because otherwise you'll get out of the picture and
I think that's the basics
For our staff
I'm not sure we want to go through
Oh, and the times that you see here
As you probably see the end time is the start time of the next one which is not correct, right?
So the end time is not when a speaker should end the talk
The speaker should have ended all the questions would have done the speaker who are left people who have left and then we're starting the new one
So imagine that all the end times are five minutes
Way into the future so yeah, and that's why instead of nine ten
It's already nine seven and I'm out of my time. All right, so any questions?
Good, perfect. Let's have a great day
You
Hello, I don't know if it's works. It works. Okay perfect. Hello everyone
Thank you Alexios and the organizers first of all for giving me the opportunity to be here today
And yeah, let's get started
Today I would like to start with the quick and simple analogy
Imagine that you're going to a restaurant and you're going to book for dinner or lunch whatever
And you suddenly start to see that each restaurant has their own unique system for ratings
So for example, you can see we have maybe some of them use stars maybe some use numbers
Maybe some of them uses emojis words and so on
The question is how do you even compare I mean this is the actual the same challenge that we are facing
When dealing with crypto algorithm detection
And yeah, basically this blocks good security and compliance and that's why
Our work with desploms and cryptos and the recession is so important
I'm at the as I'm a software engineer. It's kind of a says where we provide open source software intelligence
By giving access to our knowledge base to be corporations
And today I would like to talk you about two big updates that we were talking about working in the last couple years
On the first side, the release of the crypto algorithms opened data set
And on the other side, the decision of SPDX to adopt it as an actual standard
And by the end of this talk, I hope you learned how to actually leverage this data set to make your work easier and also
To potentially stop building the same tools over and over again
To begin with, I would like to talk about the impact and why
Sunderized crypto identification matters at all
On the first side, we have a couple key stakeholders which might be
Trade compliance teams, security teams, companies which are increasingly concerned about post quantum crypto
And maybe because all the team requirements tend to grow year over year
But here's something that is crucial
Standardization saves money
And when we started this journey, we were spending significant resources on maintaining and updating our crypto detection methods
So this doesn't only save us at Sunderized money, but also helps the community to be more efficient
This is our proposal for the community
So we have a crypto algorithm, the definition list, which has a simple data structure
Which is written in a machine readable format, so it's an extensive old
And we even have some reference code, so you can check that out and use it as a starting point
But the important thing here is that this is not only something that's theoretical
It's also been better tested by us in production, it's kind of billions of files and also helping big organizations
So these are the key milestones that we're rich so far in the last couple years
And let's go deeper into each one of them
In 2021, customers started to ask us if we could have them
Identifying the crypto algorithms that were present in their open source projects
And at first, it sounds simple, right?
I mean, yeah, but it's not
Because think about scale, when you're scanning billions of files and you have thousands of projects
You have a big problem because you have to be as efficient as possible
But we recognize that this wasn't just an internal need, this was just actually coming from real customers and real use cases
We started with keyword matching, for each crypto algorithm we created that definition file
Which contains some attributes such as the algorithm ID, I don't know if you can actually see anything in the screen or if it's too small
But I'll just read it out
So for each algorithm, we created this kind of definition file which contains the algorithm ID, the name, the security strength, if any
And what's most important, the keywords list, which we'll do you see afterwards to actually do the matching
So as simple as it may sound, we realized that this was quite effective for large-scale scanning
And it also allowed us to be quite precise on the detection
Because we could differentiate between AES-128, AES-256 and so on
So something interesting happened
Customers started asking, what about our known open source projects
And also, a lot of crypto libraries and frameworks started to pop up
So we were not able to keep the data set updated as fast as we needed to
So we needed that that we have something valuable and why keep this private
The community was being already involved, our customers were already helping us
In the data set update their rules and so we just needed to open the door
And so with it
In 2020-24, we made two big moves
On the first side, we released the data set under the CCC relations
Which is as close as to public domain
There is in terms of copyright law
And the second one is that we were being recognized as the default standard for credit
We started to talk with SPDX to collaborate and being adopted as the actual standard
So as you know, SPDX has a license list so basically this will be going to be the same
But in terms of crypto detection
So I have a small demo, I was going to do live but you know something things happened
So I prefer to just
You have there a link to the repo
If you want you can also use the QR code
And I will show you some screenshots of what it looks like
So basically inside the repo of the same in the same repo that the data set is present
We have an example script for the actual detection that leverages the data set
And it also created a demo folder with some useful examples that will outline some challenges that I will talk later
And basically it's very simple you have to just execute the script
And you pass the folder that you want to scan and you'll get basically Jason Files a result
Which will contain the files where the crypto algorithms were found
As well as the definition file for each and which keyword was the actual match
So very very simple it's not the any fancy integration or anything like that
So being very simple it presents some challenges
So as you can see here in this example that you can check out in the repo
We have for example keywords that are being matched but are in a completely different context
Because for example as you can see we have a match with for tuna which is a crypto algorithm
But in the code is not being actually used in a crypto context
So sometimes a keyword just a coincidence
And the other challenge is that sometimes you have comments in your code
That actually doesn't do in this case well it doesn't do anything because it's actually all commented out
But sometimes you have comments that are misleading or actually they call that something that it's actually the opposite of what the comment does
So
Looking ahead tuna 25 seems to be very exciting
We are going to move the data set to the software transparency foundation
We are going to see new implementations and new in different languages
And we are going to see the community taking ownership
So
Usually in open source projects tends to get better as more people help
So even if we have different skills and experiences we want you to be involved
So we have a couple ways that you can help us to improve the data set
You can even create new implementations or share real world use cases or even explore if AI has any role to play here
To regarding the context awareness and basically there are more ways of course
And yeah
At the beginning of the dog I mentioned personal writings and in open source we try to work together to collaborate
But to do this effectively we need to speak the same language
So this is what that is what this is about
We have this work in solution and we know it helps and we want you to get involved
The repo is open
The tools are there and we are really looking forward to what you are going to build it
And basically that's it
Thank you very much and if you have any questions please ask me
Question
And so thank you very much and actually I still do not really understand the use case
So the very long aspect is do not recommend your hash algorithm or crypto to use a library
A group library that has a set of issues that can find those
And probably you don't find the communication that we are flying in show use of any library
So why would someone be an interest in it
I don't know if I understand correctly the question
The question was why would we actually use this
Yeah, what's the use case
What yeah, I was in
For example your your my control department you will
To know all the crypto algorithms that you have in your composition before you can actually
Sheep the product to start in countries because you don't
But it doesn't make sense
Yes, that's one example the other one security compliance there are certain security compliance
And then where that requires what some people are starting to call a sebum
Another important one is that in order to understand the end of life
What your product you need to understand the end of life of the crypto side of product
There is a lot of people