Pith. sign in

REVIEW 3 major objections 6 minor 68 references

Automatic Generation of a Cryptography Misuse Taxonomy Using Large Language Models

T0 review · 3 major / 6 minor · reviewed 2026-08-15 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read The paper claims that CryMisTa, an LLM-agnostic prompt pipeline, can automatically detect cryptographic API misuse in C/C++, Java, Python, and Go code and organize it into a hierarchical taxonomy, yielding 279 base misuse categories of…

desk verdict The pipeline is solid and worth a read, but the '36 novel categories' claim rests on thin evidence and needs real revision before I'd trust it. read the letter →

arxiv 2509.10814 v1 pith:VU6JOQOX submitted 2025-09-13 cs.CR

Yang Zhang , Wenyi Ouyang , Yi Zhang , Liang Cheng , Chen Wu , Wenxin Hu This is my paper · ORCID
classification cs.CR
keywords cryptographicAPImisuseCAMtaxonomylargelanguagemodelspromptengineeringcodeanalysisCryMisTaLLMevaluationdetectionrules
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper claims that a structured, LLM-agnostic prompt pipeline, implemented as CryMisTa, can take real-world code in C/C++, Java, Python, and Go and automatically detect cryptographic API misuse, summarize it into instances, and organize those instances into a hierarchical taxonomy. Run over 3,492 programs with five mainstream LLMs, the pipeline produced a taxonomy of 279 base misuse categories, 36 of which the authors say are absent from existing taxonomies. The authors further claim that encoding 11 of those new categories as detection rules or logic lets existing CAM detection tools identify misuse types they previously missed. A sympathetic reader would care because, if true, it replaces slow human curation of misuse taxonomies with a continuously expandable process grounded in real code, and gives detection tools a path to keep up with evolving cryptographic practice.

What carries the argument

The load-bearing machinery is CryMisTa's three-phase prompt pipeline, built around a normalized CAM instance triplet of abstract, detail, and code, and a category tuple of title and explanation. In the Identification phase, a direct zero-shot prompt scans code in batches and a chain-of-thought loop re-examines segments the direct pass could not decide; both loops output JSON instances that are stored between batches to work around token limits. In the Classification phase, a summarization loop merges same-meaning instances and a merging loop deduplicates categories across batches. The Taxonomy Construction phase uses construction and expansion prompts that classify base categories under abstract categories guided by root-cause keywords and can generate new keywords as needed. This staged, batched, semi-structured prompting is what lets a general LLM translate raw code into a stable hierarchical taxonomy, and it is also what makes the pipeline model-agnostic.

What would settle it

Have an independent team, using a pre-registered definition of cryptographic API misuse, re-label the same 716-program subset; if their label set differs substantially from the authors' 975 instances, or if re-running CryMisTa against the independent labels moves detection F1 or the set of novel categories, then the reported numbers are artifacts of the original labeling rather than stable properties of the pipeline.

Watch

Extended reading notes

Core claim

CryMisTa's central claim is that the entire CAM-taxonomy construction cycle—detection, summarization, deduplication, and hierarchical organization—can be delegated to an LLM through deliberately structured prompts, without retraining or fine-tuning. The pipeline reports each finding as a triplet of abstract, detail, and code, merges similar findings into categories of title and explanation, then arranges categories under abstract super-categories using root-cause keywords. On a corpus of 3,492 programs, the best of five evaluated models produced a three-level taxonomy with 8 top-level categories, 23 second-level categories, and 279 base categories; the same count appeared across five different input orders, which the authors read as evidence of reproducibility. Compared with prior taxonomies, every category in three smaller published taxonomies was covered, and the authors identify 36 base categories not addressed by existing taxonomies, later confirmed by independent cryptography experts. The claim's practical payload is demonstrated by encoding 11 of these categories as formal rules for two existing static analyzers, as updates to one dynamic analyzer, and as standalone detection logic, all of which reportedly detect CAM types those tools could not detect before.

Load-bearing premise

The whole evaluation rests on the two authors' manual labels of 975 CAM instances in 716 programs being correct and complete; there is no reported inter-annotator agreement, and any bias or omissions in that ground truth would change the accuracy numbers, the completeness rate, and the count of 36 novel categories.

Editorial extensions

If this is right

  • A continuously updated taxonomy becomes feasible: feeding new or newly patched programs through the pipeline extends the category set rather than requiring a fresh manual curation effort.
  • Detection-tool coverage can be widened quickly: 11 newly identified categories were turned into rules and logic that let existing detectors find misuse types they previously missed, including insufficient PBKDF2 iterations, nonce reuse, and GCM tag-length violations.
  • Model choice matters: among the five LLMs tested, one model had the best detection F1 and the most conservative category induction, while another produced far more fine-grained categories; the paper recommends the former style for stable taxonomies.
  • The taxonomy subsumes most prior work: all categories from three earlier taxonomies are covered, and the twelve missing categories in the largest prior taxonomy were largely categories for which no code samples were available, suggesting the pipeline's output tracks the input corpus.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • Editorial inference: the same pipeline would likely transfer to other vulnerability families whose taxonomies are also hand-maintained, such as injection flaws or deserialization bugs, because the prompts never encode cryptography-specific logic—only the request to detect, summarize, and categorize misuses.
  • Editorial inference: the 36-novelty count is sensitive to the comparator set; if future taxonomies or versions of standards retire or add categories, the count will shift even though the underlying detected instances remain the same.
  • Editorial inference: a testable consequence of the pipeline's logic is that detection completeness should improve with corpus size, since the paper argues missed CAM types will be caught once more programs are analyzed; one could verify this by running CryMisTa on disjoint program sets and checking whether new base categories stop appearing after a saturation point.
  • Editorial inference: because temperature was set to zero and the taxonomy was stable across input orders, the remaining variance across LLMs in category granularity suggests the classification prompt, not the detection step, is the main knob controlling taxonomy shape.
Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

3 major / 6 minor

Summary. The paper proposes CryMisTa, an LLM-agnostic prompt pipeline that detects cryptographic API misuse (CAM) in C/C++, Java, Python, and Go code, summarizes the instances, and organizes them into a hierarchical taxonomy. The authors evaluate the pipeline with five LLMs on a manually labeled subset of 716 programs, report detection accuracy, precision, recall, and a GPT-4 completeness analysis (FNR 11.0%, FDR 1.6%), and construct a taxonomy of 279 base categories from 3,492 programs, claiming 36 categories are not covered by existing taxonomies. They further encode 11 of these categories into detection rules for CryScanner, CogniCryptSAST, and LICMA and report that these rules detect all instances of those categories in the corpus.

Significance. If the claims hold, the work is a valuable step toward automating the construction and continuous expansion of CAM taxonomies, with clear practical implications for CAM detection tools. The paper's strengths include a multi-language, multi-LLM evaluation on a substantial corpus, honest reporting of GPT-4's false negatives and false discovery rates, quantitative comparison of five LLMs, and public release of artifacts for reproducibility. The central novelty, however, depends on the credibility of the 36 'new' categories and on a non-circular demonstration that the taxonomy improves detection tools; both of these points currently need additional evidence.

major comments (3)
  1. [§5.3 (Table 3), §5.3.5, §5.3.7] The headline claim of 36 previously unaddressed CAM categories is not currently supported. The only evidence is a single sentence in §5.3 stating that external cryptography experts confirmed the categories, with no protocol, no inclusion criteria, no per-category results, and no agreement measure. Moreover, the paper's own examples undermine the count: §5.3.5 classifies 'Insecure or deprecated cryptographic library usage' as a novel CAM while admitting 'no conclusive evidence has been found regarding the insecurity of pyaes,' and §5.3.7 lists 'Short Certificate Validity Period' as a CAM even though short-lived certificates are generally regarded as a security best practice and the cited NIST SP 1800-16 concerns certificate management rather than API misuse. If even a few of the 36 categories are not genuine CAM or are already covered by existing taxonomies at a different granularity, the novelty count, the RQ2 conclusion, and the selection of the 11 rules in RQ3 all overstate the result. The expert review must be reported in detail, and each disputed category should be re-examined.
  2. [§5.4, Table 4] The RQ3 usefulness evaluation is circular. The 11 detection rules were derived from categories induced from the corpus D, and the experiments then verify that these rules detect 'all instances in D' that fall into the selected categories. Because the rules were built from the same corpus, this result is expected and does not demonstrate that the taxonomy can expand existing tools' detection capabilities in general. A held-out set of programs not used in taxonomy construction, or an independent benchmark such as MASC, is needed to support the claimed utility. As written, the expansion result reduces to a consistency check.
  3. [§5.1, §5.2.1 (Table 2)] The ground-truth and completeness metrics rest on assumptions that are not fully reported. No inter-annotator agreement statistic is given for the two authors' independent labeling of 975 CAM instances in Dsub; the completeness analysis is performed only for GPT-4; and in the manual mapping, LLM warnings are counted as correct detections whenever their 'information and recommendations' are accurate, which is a subjective criterion. These choices do not necessarily invalidate the detection results, but they make the reported FNR/FDR and the cross-LLM comparison less robust than the text suggests. The authors should report agreement measures, provide the mapping protocol for completeness, and either apply the same completeness analysis to the other LLMs or clearly scope the claim.
minor comments (6)
  1. [Figure 8 caption] The caption contains a typo: 'Inesure OpenSSL Initialization and Memory Handling' should read 'Insecure OpenSSL Initialization and Memory Handling.'
  2. [§3.1, Appendix A] The text says 'promots' in 'The CoT prompts 8 first instruct...' and in the appendix title; this should be 'prompts.'
  3. [Table 4] The table uses 'CongiCryptsast' instead of 'CogniCryptSAST', and its PBKDF2 explanation says 'Standards recommend a minimum of 10,000 iterations,' which conflicts with the 600,000-iteration OWASP guidance cited in §5.3.1; reconcile the threshold and its source.
  4. [§5.3.6, references [50], [51]] The sentence 'NIST SP800-63 [50] recommends appropriate token lengths' cites reference [50], which is NIST SP 800-38B on CMAC modes, not SP 800-63; the correct citation for token-length guidance appears to be SP 800-63B (reference [51]).
  5. [§5.3.1] The text describes adler32 as a 'random number generation algorithm,' but adler32 is a checksum algorithm; this mischaracterization suggests the corresponding category may be spurious and should be corrected or removed.
  6. [§5.2.2, Figure 6] The claim that the taxonomy is reproducible across five input orders reports only that the number of base categories (279) and top-level categories (8) are consistent; it does not show structural consistency (edges, category names, or hierarchy), so the reproducibility statement should be scoped to these counts.

Circularity Check

1 steps flagged · score 6.0 of 10

RQ3's detection-rule validation is in-sample: rules derived from D are tested on D, making the 'expanded detection' result a self-consistency check.

  1. fitted input called prediction [Section 5.4 (RQ3: Usefulness), especially the OpenSSL initialisation example and the final sentence of the paragraph]
    "We selected 11 out of the 36 newly identified CAM categories and encoded them either as detection rules to enhance existing tools (e.g., CryScanner [16] and CogniCryptSAST [3]) or as straightforward detection logic (as Python scripts) to identify these types of CAM. Our experiments demonstrated that all instances in D that fall into these 11 categories were successfully detected by either the enhanced CryScanner and CogniCryptSAST or by the encoded detection logic."

    The 11 rules are derived from the taxonomy categories that CryMisTa produced from D, and the OpenSSL example explicitly says the rule was written 'after reviewing its explanation and code example' from D. The success criterion is detection of 'all instances in D' in the same corpus. Thus the rule is fitted to the very instances it is then claimed to detect; the experiment is a self-consistency check, not an independent test of expanded detection capability. No held-out code or external benchmark is used, so the 'expands detection capabilities' conclusion is forced by construction once the rule is written to match its training example.

full rationale

Taxonomy construction (code to instances to categories to hierarchy) is not circular: the LLM is given external standards/CVE guidance, code snippets, and classification keywords from prior work, and the output categories are grounded in the corpus rather than in the target claim. The 279-category/36-novel result is an empirical comparison plus a one-sentence unreported expert review, which raises correctness concerns (e.g., pyaes admission, short certificate validity) but not circularity. No self-citation chain is load-bearing; the pipeline is genuinely LLM-agnostic in the sense tested. The one clear circular step is RQ3: the 11 detection rules are written from the taxonomy categories and code examples taken from D, then validated on D, so the 'expands detection capabilities' result reduces to a self-consistency check. That in-sample validation does not make the taxonomy derivation circular, but it does inflate the claimed practical-value result.

Assumptions & free parameters 3 free parameters · 4 assumptions · 0 invented entities

The central method introduces no new physical or conceptual entities; the levers are hand-chosen prompt keywords, the subjective selection of 11 categories, and standards-based thresholds used in rule encoding. The main epistemic cost is in the axioms: trusting LLM pretraining, trusting the authors' manual labels, and trusting the chosen comparison baseline.

free parameters (3)
  • Classification keyword set = 7 root-cause terms from Ami et al. [12]
    Used to guide taxonomy construction; the authors state future work will explore alternative keyword sets, so this is a hand-chosen input affecting taxonomy structure.
  • Selection of 11 CAM categories for tool integration = 11 of 36 new categories
    Subjective selection with no stated representativeness criteria; this choice directly bounds the RQ3 usefulness validation.
  • PBKDF2 iteration threshold = Inconsistent: 10,000 in Table 4 vs. 600,000 in Section 5.3.1
    Used to update LICMA detection logic; the threshold is chosen by hand and the paper gives two different recommended values.
assumptions (4)
  • domain assumption LLMs are pretrained on sufficient cryptography and code data to detect CAM reliably.
    Section 3 states that preliminary experiments demonstrated LLMs have been pre-trained with vast publicly available cryptography-related information; the entire detection phase depends on this.
  • domain assumption Manual labels of Dsub are authoritative ground truth.
    Section 5.1 describes two authors independently reviewing 716 programs; no inter-annotator agreement is reported, yet all accuracy and completeness numbers are computed against this labeling.
  • domain assumption The set of compared taxonomies (CryptoRex, CryptoGo, CryptoAPI-Bench, MASC, LICMA) is the complete relevant baseline for novelty.
    Section 5.3 and Table 3 define 'not addressed by existing taxonomies' against only these sources, omitting other published CAM rule sets such as CryLogger and CrySL rules.
  • ad hoc to paper LLM warnings with accurate content count as correct detections in completeness evaluation.
    Section 5.2.1 states 'warnings were deemed correct, if the information and recommendations they conveyed were accurate', which relaxes the correctness criterion for the GPT-4 completeness analysis.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Automatic Generation of a Cryptography Misuse Taxonomy Using Large Language Models." pith.science (2026). https://pith.science/paper/VU6JOQOX

@misc{pith2026250910814,
  author       = {Pith},
  title        = {Pith review of: Automatic Generation of a Cryptography Misuse Taxonomy Using Large Language Models},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/VU6JOQOX}},
  note         = {Machine review of arXiv:2509.10814}
}
read the original abstract

The prevalence of cryptographic API misuse (CAM) is compromising the effectiveness of cryptography and in turn the security of modern systems and applications. Despite extensive efforts to develop CAM detection tools, these tools typically rely on a limited set of predefined rules from human-curated knowledge. This rigid, rule-based approach hinders adaptation to evolving CAM patterns in real practices. We propose leveraging large language models (LLMs), trained on publicly available cryptography-related data, to automatically detect and classify CAMs in real-world code to address this limitation. Our method enables the development and continuous expansion of a CAM taxonomy, supporting developers and detection tools in tracking and understanding emerging CAM patterns. Specifically, we develop an LLM-agnostic prompt engineering method to guide LLMs in detecting CAM instances from C/C++, Java, Python, and Go code, and then classifying them into a hierarchical taxonomy. Using a data set of 3,492 real-world software programs, we demonstrate the effectiveness of our approach with mainstream LLMs, including GPT, Llama, Gemini, and Claude. It also allows us to quantitatively measure and compare the performance of these LLMs in analyzing CAM in realistic code. Our evaluation produced a taxonomy with 279 base CAM categories, 36 of which are not addressed by existing taxonomies. To validate its practical value, we encode 11 newly identified CAM types into detection rules and integrate them into existing tools. Experiments show that such integration expands the tools' detection capabilities.

Figures

Figures reproduced from arXiv: 2509.10814 by the authors.

Figure 1
Figure 1. The Workflow of CryMisTa 3.1 The Identification Phase Our approach instructs LLMs to report a CAM Instance as a triplet ⟨abstract, detail, code⟩, where abstract is a succinct description of the instance, detail is a more elaborated version of abstract, and code is the identifier of the program in which the CAM is detected. This structure helps to reduce the randomness of LLMs in reporting CAM instances and normalize… view at source ↗
Figure 2
Figure 2. An Example Inquiry-Response for Direct CAM Identification [PITH_FULL_IMAGE:figures/full_fig_p006_2.png] view at source ↗
Figure 3
Figure 3. An Example of Misuse Summarization 3.2.2 The Merging Loop As the Summarization Loop categorizes CAM instances in batches, redundant CAM categories may be created for the same type of CAM instances, if they occur in different batches. The Merging Loop is designed to consolidate identical or similar CAM categories: it repeatedly prompts the LLM to compare CAM categories generated in different batches to determine whet… view at source ↗
Figures from the paper (6 more)
Figure 4
Figure 4. Figure 4: An Example of the Construction Prompt [PITH_FULL_IMAGE:figures/full_fig_p009_4.png]
Figure 5
Figure 5. Figure 5: An Example of the Expansion Prompt 9 [PITH_FULL_IMAGE:figures/full_fig_p009_5.png]
Figure 6
Figure 6. Figure 6: Classifying CAM Instances by LLMs LLMs: (1) LLMs generally reported CAM instances at a more granular level than human reviewers, leading to a higher count of reported instances, and (2) they exhibited conservative tendencies, often issuing ‘warnings’ rather than defini…
Figure 7
Figure 7. Figure 7: Top Levels of the CAM Taxonomy Generated by GPT-4 under the Guidance of CryMisTa [PITH_FULL_IMAGE:figures/full_fig_p012_7.png]
Figure 8
Figure 8. Figure 8: Detection Rule for Inesure OpenSSL Initialization and Memory Handling in the CrySL Syntax [PITH_FULL_IMAGE:figures/full_fig_p016_8.png]
Figure 9
Figure 9. Figure 9: An example of CoT Identification 21 [PITH_FULL_IMAGE:figures/full_fig_p021_9.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

68 extracted references · 65 canonical work pages

  1. [1]

    Intelligent detection of cryptographic misuse in android applications based on program slicing and transformer-based classifier.Electronics, 12(11), 2023

    Lizhen Wang, Jizhi Wang, Tongtong Sui, Lingrui Kong, and Yue Zhao. Intelligent detection of cryptographic misuse in android applications based on program slicing and transformer-based classifier.Electronics, 12(11), 2023

    work page 2023

  2. [2]

    Cryptoguard: High precision detection of cryptographic vulnerabilities in massive-sized java projects

    Sazzadur Rahaman, Ya Xiao, Sharmin Afrose, Fahad Shaon, Ke Tian, Miles Frantz, Murat Kantarcioglu, and Danfeng Yao. Cryptoguard: High precision detection of cryptographic vulnerabilities in massive-sized java projects. InProceedings of the 2019 ACM SIGSAC Conference on Computer and Communications Security, CCS ’19, page 2455–2472, 2019

    work page 2019

  3. [3]

    Cognicrypt: Supporting developers in using cryptography

    Stefan Krüger, Sarah Nadi, Michael Reif, Karim Ali, Mira Mezini, Eric Bodden, Florian Göpfert, Felix Günther, Christian Weinert, Daniel Demmler, and Ram Kamath. Cognicrypt: Supporting developers in using cryptography. In2017 32nd IEEE/ACM International Conference on Automated Software Engineering (ASE), pages 931–936, 2017

    work page 2017

  4. [4]

    Carloni, and Simha Sethumadhavan

    Luca Piccolboni, Giuseppe Di Guglielmo, Luca P. Carloni, and Simha Sethumadhavan. Crylogger: Detecting crypto misuses dynamically. InProceedings of the 2021 IEEE Symposium on Security and Privacy (SP), pages 1972–1989, 2020

    work page 2021

  5. [5]

    An empirical study of crypto- graphic misuse in android applications

    Manuel Egele, David Brumley, Yanick Fratantonio, and Christopher Kruegel. An empirical study of crypto- graphic misuse in android applications. InProceedings of the 2013 ACM SIGSAC conference on Computer & communications security, pages 73–84, 2013

    work page 2013

  6. [6]

    Source attribution of cryptographic api misuse in android applications

    Ildar Muslukhov, Yazan Boshmaf, and Konstantin Beznosov. Source attribution of cryptographic api misuse in android applications. In2018 Asia Conference on Computer and Communications Security, pages 133–146, 2018

    work page 2018

  7. [7]

    CryptoREX: large-scale analysis of cryptographic misuse in IoT devices

    Li Zhang, Jiongyi Chen, Wenrui Diao, Shanqing Guo, Jian Weng, and Kehuan Zhang. CryptoREX: large-scale analysis of cryptographic misuse in IoT devices. In22nd International Symposium on Research in Attacks, Intrusions and Defenses (RAID 2019), pages 151–164, 2019

    work page 2019

  8. [8]

    Python crypto misuses in the wild

    Anna-Katharina Wickert, Lars Baumgärtner, Florian Breitfelder, and Mira Mezini. Python crypto misuses in the wild. InProceedings of the 15th ACM/IEEE International Symposium on Empirical Software Engineering and Measurement (ESEM), pages 1–6, 2021

    work page 2021

Show all 68 references
  1. [9]

    Automated binary analysis on ios: A case study on cryptographic misuse in ios applications

    Johannes Feichtner, David Missmann, and Raphael Spreitzer. Automated binary analysis on ios: A case study on cryptographic misuse in ios applications. Inthe 11th ACM Conference on Security & Privacy in Wireless and Mobile Networks, pages 236–247, 2018

    2018

  2. [10]

    icryptotracer: Dynamic analysis on misuse of cryptography functions in ios applications

    Yong Li, Yuanyuan Zhang, Juanru Li, and Dawu Gu. icryptotracer: Dynamic analysis on misuse of cryptography functions in ios applications. Inthe 8th International Conference on Network and System Security (NSS), pages 349–362. Springer, 2014

    2014

  3. [11]

    Nativespeaker: Identifying crypto misuses in android native code libraries

    Qing Wang, Juanru Li, Yuanyuan Zhang, Hui Wang, Yikun Hu, Bodong Li, and Dawu Gu. Nativespeaker: Identifying crypto misuses in android native code libraries. In2017 International Conference on Information Security and Cryptology, pages 301–320. Springer, 2017

    2017

  4. [12]

    Why crypto-detectors fail: A systematic evaluation of cryptographic misuse detection techniques

    Amit Seal Ami, Nathan Cooper, Kaushal Kafle, Kevin Moran, Denys Poshyvanyk, and Adwait Nadkarni. Why crypto-detectors fail: A systematic evaluation of cryptographic misuse detection techniques. In2022 IEEE Symposium on Security and Privacy (SP), pages 614–631. IEEE, 2022

    2022

  5. [13]

    Evaluation of static vulnerability detection tools with java cryptographic api benchmarks.IEEE Transactions on Software Engineering, 49(2):485– 497, 2022

    Sharmin Afrose, Ya Xiao, Sazzadur Rahaman, Barton P Miller, and Danfeng Yao. Evaluation of static vulnerability detection tools with java cryptographic api benchmarks.IEEE Transactions on Software Engineering, 49(2):485– 497, 2022

    2022

  6. [14]

    Recommendation for block cipher modes of operation: Methods and techniques

    Morris Dworkin. Recommendation for block cipher modes of operation: Methods and techniques. SP 800-38A, National Institute of Standards and Technology (NIST), 2001

    2001

  7. [15]

    Text and image encryption decryption using advanced encryption standard.International Journal of Emerging Trends & Technology in Computer Science (IJETTCS), 3(3):118–126, 2014

    Kundankumar R Saraf, Vishal P Jagtap, and Amit K Mishra. Text and image encryption decryption using advanced encryption standard.International Journal of Emerging Trends & Technology in Computer Science (IJETTCS), 3(3):118–126, 2014

    2014

  8. [16]

    Cryscanner: Finding cryptographic libraries misuse

    Amit Choudhari, Sylvain Guilley, and Khaled Karray. Cryscanner: Finding cryptographic libraries misuse. In 2021 8th NAFOSTED Conference on Information and Computer Science (NICS), pages 230–235, 2021

    2021

  9. [17]

    Firebugs: Finding and repairing cryptography api misuses in mobile applications

    Larry Singleton, Rui Zhao, Harvey Siy, and Myoungkyu Song. Firebugs: Finding and repairing cryptography api misuses in mobile applications. In2021 IEEE 45th Annual Computers, Software, and Applications Conference (COMPSAC), pages 1194–1201. IEEE, 2021. 17 APREPRINT- SEPTEMBER16, 2025

    2021

  10. [18]

    K-hunt: Pinpointing insecure cryptographic keys from execution traces

    Juanru Li, Zhiqiang Lin, Juan Caballero, Yuanyuan Zhang, and Dawu Gu. K-hunt: Pinpointing insecure cryptographic keys from execution traces. InProceedings of the 2018 ACM SIGSAC Conference on Computer and Communications Security, pages 412–425, 2018

    2018

  11. [19]

    Crysl: An extensible approach to validating the correct usage of cryptographic apis

    Stefan Krüger, Johannes Späth, Karim Ali, Eric Bodden, and Mira Mezini. Crysl: An extensible approach to validating the correct usage of cryptographic apis. In32nd European Conference on Object-Oriented Programming (ECOOP 2018), volume 109, pages 10:1–10:27, Amsterdam, Netherl...

    2018

  12. [20]

    Runtime verification of crypto apis: An empirical study.IEEE Transactions on Software Engineering, 49(10):4510–4525, October 2023

    Adriano Torres, Pedro Costa, Luis Amaral, Jonata Pastro, Rodrigo Bonifácio, Marcelo d’Amorim, Owolabi Legunsen, Eric Bodden, and Edna Dias Canedo. Runtime verification of crypto apis: An empirical study.IEEE Transactions on Software Engineering, 49(10):4510–4525, October 2023

    2023

  13. [21]

    and Paul Black

    Frederick Boland Jr. and Paul Black. The juliet 1.1 c/c++ and java test suite.Computer, 45(10):88–90, 2012

    2012

  14. [22]

    Javamop: Efficient parametric runtime monitoring framework

    Dongyun Jin, Patrick O’Neil Meredith, Choonghwan Lee, and Grigore Ro¸ su. Javamop: Efficient parametric runtime monitoring framework. In2012 34th International Conference on Software Engineering (ICSE), pages 1427–1430, June 2012

    2012

  15. [23]

    From theory to code: Identifying logical flaws in cryptographic implementations in c/c++.IEEE Transactions on Dependable and Secure Computing, 19(6):3790–3803, November 2022

    Sazzadur Rahaman, Haipeng Cai, Omar Chowdhury, and Danfeng Yao. From theory to code: Identifying logical flaws in cryptographic implementations in c/c++.IEEE Transactions on Dependable and Secure Computing, 19(6):3790–3803, November 2022

    2022

  16. [24]

    Cryptogo: Automatic detection of go cryptographic api misuses

    Wenqing Li, Shijie Jia, Limin Liu, Fangyu Zheng, Yuan Ma, and Jingqiang Lin. Cryptogo: Automatic detection of go cryptographic api misuses. InProceedings of the 38th Annual Computer Security Applications Conference, pages 318–331, 2022

    2022

  17. [25]

    Towards precise reporting of cryptographic misuses

    Yikang Chen, Yibo Liu, Ka Lok Wu, Duc Le, and Sze Yiu Chau. Towards precise reporting of cryptographic misuses. InProceedings of the 31th Annual Network and Distributed Systems Security, pages 1–19, February 2024

    2024

  18. [26]

    CodeT5+: Open code large language models for code understanding and generation

    Yue Wang, Hung Le, Akhilesh Gotmare, Nghi Bui, Junnan Li, and Steven Hoi. CodeT5+: Open code large language models for code understanding and generation. InProceedings of the 2023 Conference on Empirical Methods in Natural Language Processing, pages 1069–1088. Association for ...

    2023

  19. [27]

    On the use of chatgpt for classifying domain terms according to upper ontologies

    Fabrício H Rodrigues, Alcides G Lopes, Nicolau O dos Santos, Luan F Garcia, Joel L Carbonera, and Mara Abel. On the use of chatgpt for classifying domain terms according to upper ontologies. InAdvances in Conceptual Modeling (ER 2023), pages 249–258, 2023

    2023

  20. [28]

    Benchmarking large language models for news summarization.Transactions of the Association for Computational Linguistics, 12:39–57, 2024

    Tianyi Zhang, Faisal Ladhak, Esin Durmus, Percy Liang, Kathleen McKeown, and Tatsunori B Hashimoto. Benchmarking large language models for news summarization.Transactions of the Association for Computational Linguistics, 12:39–57, 2024

    2024

  21. [29]

    Prompting or fine-tuning? a comparative study of large language models for taxonomy construction

    Boqi Chen, Fandi Yi, and Dániel Varró. Prompting or fine-tuning? a comparative study of large language models for taxonomy construction. In2023 ACM/IEEE International Conference on Model Driven Engineering Languages and Systems Companion (MODELS-C), pages 588–596, 2023

    2023

  22. [30]

    Tacoprompt: A collaborative multi-task prompt learning method for self-supervised taxonomy completion

    Hongyuan Xu, Ciyi Liu, Yuhang Niu, Yunong Chen, Xiangrui Cai, Yanlong Wen, and Xiaojie Yuan. Tacoprompt: A collaborative multi-task prompt learning method for self-supervised taxonomy completion. InProceedings of the 2023 Conference on Empirical Methods in Natural Language Pro...

    2023

  23. [31]

    Using zero-shot prompting in the automatic creation and expansion of topic taxonomies for tagging retail banking transactions.arXiv preprint arXiv:2401.06790, 2024

    Daniel de S Moraes, Pedro TC Santos, Polyana B da Costa, Matheus AS Pinto, Ivan de JP Pinto, Álvaro MG da Veiga, Sergio Colcher, Antonio JG Busson, Rafael H Rocha, Rennan Gaio, et al. Using zero-shot prompting in the automatic creation and expansion of topic taxonomies for tag...

    2024 arXiv

  24. [32]

    Chain-of-layer: Iteratively prompting large language models for taxonomy induction from limited examples

    Qingkai Zeng, Yuyang Bai, Zhaoxuan Tan, Shangbin Feng, Zhenwen Liang, Zhihan Zhang, and Meng Jiang. Chain-of-layer: Iteratively prompting large language models for taxonomy induction from limited examples. arXiv preprint arXiv:2402.07386, 2024

    2024 arXiv

  25. [33]

    Creating a fine grained entity type taxonomy using llms

    Michael Gunn, Dohyun Park, and Nidhish Kamath. Creating a fine grained entity type taxonomy using llms. arXiv preprint arXiv:2402.12557, 2024

    2024 arXiv

  26. [34]

    Ultra-fine entity typing.arXiv preprint arXiv:1807.04905, 2018

    Eunsol Choi, Omer Levy, Yejin Choi, and Luke Zettlemoyer. Ultra-fine entity typing.arXiv preprint arXiv:1807.04905, 2018

    2018 arXiv

  27. [35]

    Mitigating factual inconsistency and hallucination in large language models

    Muneeswaran I, Advaith Shankar, Varun V , Saisubramaniam Gopalakrishnan, and Vishal Vaddina. Mitigating factual inconsistency and hallucination in large language models. InProceedings of the 17th ACM International Conference on Web Search and Data Mining (WSDM ’24), page 1169–...

    2024

  28. [36]

    M Towhidul Islam Tonmoy, S M Mehedi Zaman, Vinija Jain, Anku Rani, Vipula Rawte, Aman Chadha, and Amitava Das

    S. M Towhidul Islam Tonmoy, S M Mehedi Zaman, Vinija Jain, Anku Rani, Vipula Rawte, Aman Chadha, and Amitava Das. A comprehensive survey of hallucination mitigation techniques in large language models, 2024

    2024

  29. [37]

    Effects of random seeds on the accuracy of convolutional neural networks

    Christofer Fellicious, Thomas Weissgerber, and Michael Granitzer. Effects of random seeds on the accuracy of convolutional neural networks. InMachine Learning, Optimization, and Data Science, pages 93–102, 2020

    2020

  30. [38]

    Hot or cold? adaptive temperature sampling for code generation with large language models.Proceedings of the AAAI Conference on Artificial Intelligence, 38(1):437–445, Mar

    Yuqi Zhu, Jia Li, Ge Li, YunFei Zhao, Jia Li, Zhi Jin, and Hong Mei. Hot or cold? adaptive temperature sampling for code generation with large language models.Proceedings of the AAAI Conference on Artificial Intelligence, 38(1):437–445, Mar. 2024

    2024

  31. [39]

    Arithmetic sampling: parallel diverse decoding for large language models

    Luke Vilnis, Yury Zemlyanskiy, Patrick Murray, Alexandre Passos, and Sumit Sanghai. Arithmetic sampling: parallel diverse decoding for large language models. InProceedings of the 40th International Conference on Machine Learning (ICML’23), pages 35120–35136, 2023

    2023

  32. [40]

    Text generation models

    OpenAI. Text generation models. https://platform.openai.com/docs/guides/text-generation/faq. [Online]. Accessed June 15, 2024

    2024

  33. [41]

    MASC: A tool for mutation-based evaluation of static crypto-api misuse detectors

    Amit Seal Ami, Syed Yusuf Ahmed, Radowan Mahmud Redoy, and et al. MASC: A tool for mutation-based evaluation of static crypto-api misuse detectors. InProceedings of the 31st ACM Joint European Software Engineering Conference and Symposium on the Foundations of Software Enginee...

    2023

  34. [42]

    SHA-3 standard: Permutation-based hash and extendable-output functions

    Morris Dworkin. SHA-3 standard: Permutation-based hash and extendable-output functions. FIPS 202, National Institute of Standards and Technology (NIST), 2015

    2015

  35. [43]

    Password storage cheat sheet.https://cheatsheetseries.owasp.org/cheatsheets/Password_ Storage_Cheat_Sheet.html#pbkdf2, 2025

    OW ASP. Password storage cheat sheet.https://cheatsheetseries.owasp.org/cheatsheets/Password_ Storage_Cheat_Sheet.html#pbkdf2, 2025. [Online, accessed 05-January-2025]

    2025

  36. [44]

    Recommendation for Block Cipher Modes of Operation: Galois/Counter Mode (GCM) and GMAC

    Morris Dworkin. Recommendation for Block Cipher Modes of Operation: Galois/Counter Mode (GCM) and GMAC. SP 800-38D, National Institute of Standards and Technology (NIST), 2007

    2007

  37. [45]

    Recommendation for Block Cipher Modes of Operation: the XTS-AES Mode for Confidentiality on Storage Devices

    Morris Dworkin. Recommendation for Block Cipher Modes of Operation: the XTS-AES Mode for Confidentiality on Storage Devices. SP 800-38E, National Institute of Standards and Technology (NIST), 2010

    2010

  38. [46]

    Crests: Chronology-based reconstruction for side-channel trace segmentation for xts-aes on complex targets

    Paul Krüger, Stefan Wildermann, and Jürgen Teich. Crests: Chronology-based reconstruction for side-channel trace segmentation for xts-aes on complex targets. InProceedings of the 17th European Workshop on Systems Security (EuroSec ’24), page 37–43, 2024

    2024

  39. [47]

    Recommendation for Block Cipher Modes of Operation: the CCM Mode for Authentication and Confidentiality

    Morris Dworkin. Recommendation for Block Cipher Modes of Operation: the CCM Mode for Authentication and Confidentiality. SP 800-38C, National Institute of Standards and Technology (NIST), 2007

    2007

  40. [48]

    OpenSSL. threads. https://www.openssl.org/docs/man1.0.2/man3/CRYPTO_THREADID_set_ callback.html, 2023. [Online]. Accessed June 17, 2024

    2023

  41. [49]

    Jones and Dick Hardt

    Michael B. Jones and Dick Hardt. The OAuth 2.0 Authorization Framework: Bearer Token Usage. RFC 6750, Internet Engineering Task Force, 2012

    2012

  42. [50]

    Recommendation for Block Cipher Modes of Operation: the CMAC Mode for Authentication

    Morris Dworkin. Recommendation for Block Cipher Modes of Operation: the CMAC Mode for Authentication. SP 800-38B, National Institute of Standards and Technology (NIST), 2016

    2016

  43. [51]

    Grassi, Elaine M

    Paul A. Grassi, Elaine M. Newton, Ray A. Perlner, and et al. Digital Identity Guidelines: Authentication and Lifecycle Management. SP 800-63B, National Institute of Standards and Technology (NIST), 2017

    2017

  44. [52]

    Chrome Security FAQ

    Chromium Docs. Chrome Security FAQ. https://chromium.googlesource.com/chromium/src/+/HEAD/ docs/security/faq.md., 2023. [Online]. Accessed June 17, 2024

    2023

  45. [53]

    SWI-PSA-2023-006 V4: Product Security Advisory: ALEOS Security Ad- visory

    Semtech. SWI-PSA-2023-006 V4: Product Security Advisory: ALEOS Security Ad- visory. https://source.sierrawireless.com/resources/security-bulletins/ sierra-wireless-technical-bulletin---swi-psa-2023-006-v4/ , 2023. [Online]. Accessed June 15, 2024

    2023

  46. [54]

    Guidelines for the Selection, Configuration, and Use of Transport Layer Security (TLS) Implementations

    Kerry McKay and David Cooper. Guidelines for the Selection, Configuration, and Use of Transport Layer Security (TLS) Implementations. SP 800-52 Rev. 2, National Institute of Standards and Technology (NIST), 2019

    2019

  47. [55]

    Securing Web Transactions: TLS Server Certificate Management

    M Akram, W Barker, R Clatterbuck, and et al. Securing Web Transactions: TLS Server Certificate Management. SP 1800-16, National Institute of Standards and Technology (NIST), 2020

    2020

  48. [56]

    Recommendation for Key Management: Part 1 – General

    Elaine Barker. Recommendation for Key Management: Part 1 – General. SP 800-57 Part 1 Rev. 5, National Institute of Standards and Technology (NIST), 2020

    2020

  49. [57]

    International Organization for Standardization (ISO). ISO/IEC 8825-1:2021 Information technology - ASN.1 encoding rules Part 1: Specification of Basic Encoding Rules (BER), Canonical Encoding Rules (CER) and Distinguished Encoding Rules (DER), 2021. 19 APREPRINT- SEPTEMBER16, 2025

    2021

  50. [58]

    Internet X.509 Public Key Infrastructure Certificate and Certificate Revocation List (CRL) Profile

    Sharon Boeyen, Stefan Santesson, Tim Polk, Russ Housley, Stephen Farrell, and David Cooper. Internet X.509 Public Key Infrastructure Certificate and Certificate Revocation List (CRL) Profile. RFC 5280, Internet Engineering Task Force, 2008

    2008

  51. [59]

    engine - ENGINE cryptographic module support

    OpenSSL. engine - ENGINE cryptographic module support. https://www.openssl.org/docs/man1.0.2/ man3/engine.html. [Online]. Accessed June 15, 2024

    2024

  52. [60]

    Secure Management of Keys in Cryptographic Applications: Guidance for Organizations

    S Radack. Secure Management of Keys in Cryptographic Applications: Guidance for Organizations. ITL Bulletin 905108, National Institute of Standards and Technology (NIST), 2010

    2010

  53. [61]

    A05:2021 – Security Misconfiguration

    OWASP. A05:2021 – Security Misconfiguration. https://owasp.org/Top10/A05_2021-Security_ Misconfiguration/, 2021. [Online]. Accessed June 15, 2024

    2021

  54. [62]

    Public-Key Cryptography Standards (PKCS) #1: RSA Cryptography Specifica- tions Version 2.1

    Jakob Jonsson and Burt Kaliski. Public-Key Cryptography Standards (PKCS) #1: RSA Cryptography Specifica- tions Version 2.1. RFC 3447, Internet Engineering Task Force, 2003

    2003

  55. [63]

    Crypto.Signature package

    PyCryptodome. Crypto.Signature package. https://www.pycryptodome.org/src/signature/signature,

  56. [64]

    OPENSSL_init_crypto

    OpenSSL. OPENSSL_init_crypto. https://www.openssl.org/docs/man1.1.1/man3/OPENSSL_init_ crypto.html, 2023. [Online]. Accessed June 15, 2024

    2023

  57. [65]

    The Transport Layer Security (TLS) Protocol Version 1.3

    Eric Rescorla. The Transport Layer Security (TLS) Protocol Version 1.3. RFC 8446, Internet Engineering Task Force, 2018

    2018

  58. [66]

    A verifiable secret sharing scheme without using multi-party computations

    Takumi Makino, Yoko Kamidoi, and Shin’ichi Wakabayashi. A verifiable secret sharing scheme without using multi-party computations. In2020 IEEE 44th Annual Computers, Software, and Applications Conference (COMPSAC), pages 845–850, 2020

    2020

  59. [67]

    Lack of enforcement for secure communication protocols

    OWASP. Deserialization Cheat Sheet. https://cheatsheetseries.owasp.org/cheatsheets/ Deserialization_Cheat_Sheet.html, 2024. [Online]. Accessed June 15, 2024. A The Chain-of-Thought Prompts for The Detection of CAM Instances Figure 9 demonstrates the Chain-of-Thought (CoT) prom...

    2024

  60. [2022]

    Accessed June 15, 2024

    [Online]. Accessed June 15, 2024

    2024

Pith tools

Reviewed August 15, 2026 · model on record in the stance chip above.