The series of surveys conducted between April and September 2023 presented 925 recently funded, capitalized, rebranded, merged or acquired, and expanding vendor solutions trending on the radar of healthcare technology investment observers, to be scored on 18 start-up specific key performance indicators.

Black Book Survey of Venture Capital and Tech Investors Reveals 2023's Rising Stars in the Healthcare IT Ecosystem of Startups

Anzu Partners, an investment firm delivering capital and strategic support to early-stage breakthrough technology companies, today announced it has raised more than $200 million at the close of ...

Anzu Partners Closes Third Venture Fund Focused on Companies Enabling Next-Gen Solutions in Clean Tech, Industrial, and Life Sciences Technologies

Kaspersky releases a premium version of SubsCrab to help users track their subscriptions and control their payment schedules. SubsCrab to give users transparency across their subscriptions made and tracking new updates. SubsCrab is a multiplatform app ...

Kaspersky Issues New Subscription Tracking App ‘SubsCrab’

MedCrypt, a healthtech cybersecurity startup founded near San Diego, has raised $750,000 in a seed financing round led by Safeguard Scientifics (NYSE: SFE), a private equity fund in suburban ...

Cybersecurity Startup MedCrypt Gets $750K to Defend Health Devices

David Beckham is bringing his fragrances to the U.S. for the first time with The Collection, a line of three long-lasting Eau de Parfums that aim to capture the freshness of the sea, the serenity of the rainforest and the cozy allure of wood and spices ...

David Beckham Launches ‘The Collection’ Trio of Eau de Parfums

Neocutis, the science-based skincare line from Merz Aesthetics, has launched its new Neo Restore Post Treatment Nourishing Sheet Mask. Formulated with powerful ingredients including proprietary peptides that boost production of collagen and elastin ...

Neocutis Introduces Neo Restore Post Treatment Nourishing Mask

N2K Response to White House Cyber Workforce Strategy. In July, the Biden Administration released their National Cyber Workforce and Education Strategy (NCWES) to address the hundreds of thousands of vacant cybersecurity jobs in the U.S. In response, N2K ...

Speed of criminal attack, malware delivery, and the evolution of malicious AI.

The collaboration will empower medical device makers to proactively address potential security risks and ensure the safety and integrity of their medical devices SAN DIEGO, Aug. 22, 2023 /PRNewswire/ -- Medcrypt, Inc., the proactive cybersecurity solution ...

Medcrypt and NetRise Announce Partnership to Revolutionize Medical Device Security with Full Software Bill of Material Creation and Management

Medcrypt will integrate NetRise's SBOM generation capabilities into Helm, extending the support for SBOMs throughout the entire lifecycle of medical devices. NetRise will offer medical device ...

Medcrypt, Inc., the proactive cybersecurity solution provider for medical device manufacturers (MDMs), today announced its partnership with NetRise, the company providing granular visibility into the world's XIoT security problem,

MedCrypt

medcrypt

HackerNoon Reporter: Please tell us briefly about your  background. My name is Mike Kijewski. I have a long history with MDs and their related software.I was previously the founder of Gamma Basics, a software company focused on building web-based technologies for use in radiation oncology. I started Gamma Basics while a graduate student at the University of Pennsylvania, and it was acquired by Varian Medical Systems in 2013. I then served as a Quality Analytics Portfolio Manager for Varian Medical Systems, the world's largest supplier of radiation oncology technology, prior to co-founding MedCrypt in 2016. I hold a bachelors in physics from the West Chester University of Pennsylvania, a Master of Medical Physics from the University of Pennsylvania, and an MBA from the Wharton School. What's your startup called? And in a sentence or two, what does it do? MedCrypt. MedCrypt helps medical device manufacturers build devices that are secure by design. Each MedCrypt product addresses a specific set of security fundamentals, enabling medical device manufacturers to proactively, easily, and reliably protect critical information at rest and in transit, monitor devices for security events, and identify and manage device vulnerabilities. In combination, these solutions enable manufacturers to not only protect critical device information and assure functional integrity, but also to holistically correlate security events with vulnerabilities and vice versa as well as identify affected versions and devices. What is the origin story? In 2014, I saw that hospitals were starting to ask questions about the patient safety impacts of a cybersecurity incident in a connected medical device. At the time, connected devices like CT scanners and drug infusion pumps were built with the assumption that the hospital’s network was secure. As this assumption fell apart, my cofounder Eric and I saw an opportunity to build tools that help companies building medical devices build cybersecurity features directly into their devices. The rest is history. Eric and I determined this was a space where sufficiently abstracting the complexity away from core cybersecurity features, in a way that understood the complicated healthcare ecosystem, would solve a real problem and address patient safety concerns. What do you love about your team, and why are you the ones to solve this problem? We’re a bunch of former medical device people who actually want to change the status quo. Instead of falling into the perspective of how people view the solution space, we think there is a fundamental shift in architecting proactive solutions that needs to occur for meaningful progress to be made against mounting security debt. If you weren’t building your startup, what would you be doing? Running a vegan bakery that I could check in on after surfing every morning. At the moment, how do you measure success? What are your core metrics? Our key measure of success is that the FDA has issued guidance validating our approach, that 5 of the top 10 medical device manufacturers are engaged with us, and that the industry is changing its position on how to ‘solve’ this space. What’s most exciting about your traction to date? When we started this company, we were told that this isn’t a real problem. Every day since then we have been proven correct in viewing the space and why device based security is the way forward. What technologies are you currently most excited about, and most worried about? And why? Most excited for the cutting edge clinical interventions that could be offered if they could operate securely. Changing how radiation treatments are delivered would be an extraordinary clinical success. I’m most worried about the application of ML and AI in this space without sufficient consideration and understanding of biases present. What drew you to get published on HackerNoon? What do you like most about our platform? The community and desire to build content by those who are in the trenches on a daily basis is refreshing. What advice would you give to the 21-year-old version of yourself? Being an AP physics teacher will serve you in the long term even if you aren’t teaching in schools anymore. What is something surprising you've learned this year that your contemporaries would benefit from knowing? Even with the best intentions, every mess up can demonstrate the need to continuously check yourself and be surrounded by people you trust. MedCrypt was in Encinitas in Startups of the year hosted by HackerNoon. nominated as one of the best startups

This CEO was told medical cybersecurity wasn't a real problem and started his company anyway

240 Stories To Learn About Startups Of The Year

114 Stories To Learn About Founder Advice

Meet the Winners of Startups in North and Central America

I regularly hear people getting excited about having been awarded stock options in their companies, but not having any idea what the value of those options actually are. As a startup CEO, I wanted to write a quick guide for our current and future employees on how stock options work, and give some rules of thumb about how to assign a financial value to your options grants. [Disclaimer: I’m not an attorney, and stock option plans can have slight differences that result in huge changes of value. I’ve assumed “vanilla” stock options here, but you should read your options paperwork to understand how your situation may be different. Also, this assumes options in a venture-backed kind of company; options in publicly traded companies are a totally different beast.] Salary + Equity If you’ve ever been offered a job at a startup, you may have heard the hiring manager say something like “We can’t match a big company salary, but we’re going to give you X thousand stock options, so you have huge upside!”. Options in a startup company do a great job of aligning investor, manager, and employee incentives. They can also return life-changing sums of money for employees when things go well. However, people frequently over-value their stock options, leading to disappointment when (and if) their company is acquired, or goes public. What’s An Option? A Stock Option gives you the ability to purchase shares of a company at a pre-defined price (the “strike price”). If your option plan lets you buy shares at $0.10 per share, and the company sells for $1.00 per share, you make a profit of $0.90 per share. Nice! Mistake #1: Not Knowing Your Ownership Percentage An employee might know that they have options to buy 10,000 shares at $0.10. But privately-held companies don’t really have an advertised share price, so knowing how much your shares will be worth is tricky. Many private companies won’t tell you the total number of shares that have been issued. You have no way of assessing the value of the shares without this information. At , we have about 5.3 million shares outstanding. So an employee with options for 10,000 shares could own approximately 0.19% of the company. You need to know both the number of shares you have options to buy, as well as the total number of shares that have been issued for the company. If a company does this, assume your options are worthless. MedCrypt To find your ownership percentage, divide your number of shares by the total shares outstanding. Here is a table showing the relative ownership percentage for an employee with 10,000 options in a few different scenarios. Mistake #2: Using a VC’s Valuation Of Your Company People will hear that a Venture Capitalist (VC) has valued their company at $1B, and simply multiply their ownership percentage by $1B. This can lead to huge disappointment. When VCs invest in companies, they almost always get “preferred shares”, which come with a few extra features. One of these features is a “liquidation preference”. This means that, if the company is acquired, the preferred share holders each get their initial investment back before any other share holders get a dollar. Let’s look at someone who has options for 10,000 shares, at a company that was just acquired for $100M. They may think their options are worth $100k. If that company has raised $50M in VC funding, there is actually only $50M left after the liquidation preference to split between shareholders. Therefore, this employee’s 10,000 options are actually worth $50k. It’s even worse if that company has raised $70M. An Equation For Valuing Your Stock Options Your Money = (Your Shares / Total Shares) * (Exit Value — Money Raised) Here is a table showing the options value for an employee with 0.1% ownership in a company, with various different liquidation preferences and exit values. It’s not a coincidence that the whole bottom left corner of the chart shows $0. If a company doesn’t sell for more money than it has raised from investors, common stock is basically worthless. Other Considerations Vesting Employee options almost always have some “vesting period”. This means that you actually have to work for the company for some period of time in order to earn the options. A common vesting period is 3 years for employees. What if the company sells before your options have vested? Unless your company offers “accelerated vesting”, you’re out of luck. Exercising Your Options In order for your “options” to become “shares”, you need to “exercise” your options. That means you need to write a check. If you have 10,000 options, and the strike price is $0.10, you’ll be writing a check for $1,000 to your company to get those shares. If you decide to leave the company, you normally only have 90 days to exercise your options. That means you’ll be quitting, and writing your boss a big fat check on the way out the door. Lots of employees don’t exercise their options upon leaving the company, which means those options were essentially worth $0 to the employee. (So much for making up for a lower salary!) When Can I Sell My Shares? In a VC-style company, you could only really sell your shares if 1) the company is acquired, or 2) if the company “goes public” (aka IPOs). The probability of either of those things happening is far less than 100%. Again, if the company never sells or IPOs, your options are probably worth $0. Conclusion I’m a huge fan of employees having equity in their companies, and stock options are the most common way to do that. But don’t just assume that 10,000 options should make up for a $10k salary cut. There is a lot of information you need to know in order to value your options. If you’d like to work for a company solving a big problem, that grants equity to employees, and is transparent about how the company is run, MedCrypt is hiring! We’d love to hear from you. info@medcrypt.co

Valuing Stock Options for Startup Employees

An ENS name, for your viewing pleasure. Nothing says “I’m serious about Ethereum_”_ like your name on the blockchain If you’re like me, you might have a handful of addresses that you use quite often. Also, if you are like me, you might be a cartoon giraffe. If so, please reach out — we should hang. Ethereum Anyway, it can be tedious, boring, and error prone to copy and paste the same old style address over and over. Or, heaven forbid, you may need to manually type an address (protip: never type an ethereum address). Wouldn’t it be nice to have a pretty, human (giraffe) readable name for your Ether account? 0xaBc123… Well, that’s entirely possible with the Ethereum Name System (ENS). It works similarly to DNS — where a domain name (e.g. ) maps to an IP address (34.193.187.110). Instead, though, we give an Ethereum address a “domain name” ending in (e.g. edwardgiraffe.eth) hambutton.com .eth . The process for buying an domain is pretty simple — find an unused name, go to a registrar, click buy. Not so with ENS. In order to prevent a rush of from scooping up all the good domains, an auction format was instituted. The basics of an ENS auction goes something like this: internet domain squatters Signal your intent to buy a name buy placing a bid. Wait a few days, and reveal your bid. Finalize your bid if you win. Since this is Ethereum we’re talking about, this whole process takes place on the public . For a more technical explanation, check out this nifty visual timeline… blockchain _Still wondering how the Ethereum Name Service (ENS) bid process works? This visual timeline shows you each step of the…_medium.com A Visual Timeline of an Ethereum Name Service Bid Prerequisites Before getting started, you’ll need a bit of Ether, and an Ether wallet like a Ledger Nano, MetaMask, or MyCrypto (previously known as MyEtherWallet). I’ll be using MetaMask in this article because they have the coolest logo of all the available options. If you need help installing MetaMask, . I started out by creating a new account in MetaMask, and loading 0.08 Ether. The minimum bid for an ENS name is .01, so have at least that much, plus a bit more for gas. There will be several transactions. Strap in. check here MetaMask with a fresh account and no ETH. You will need some ETH. MyCrypto ENS Head over to MyCrypto.com and click the link in the main menu. You should see a search box. Type in a name you are interested in buying to see if it’s available. If so, great! We can continue. If not, you’ll need to go to a secondary market like We’ll assume your name is available, and continue on. ENS https://namebazaar.io/ MyEtherWallet.com ENS page Connect to your ETH wallet by selecting an option from the list — in this case, MetaMask. Click (or the equivalent button for your wallet). Connetct to MetaMask Start The Auction For the , put in the maximum amount of ETH you are willing to pay. If you’re feeling cheeky, put in a higher amount in the which will hide your actual bid. Important note — you need to actually have the amount of ETH in your wallet that you put in the bid mask. Actual Bid Amount Bid Mask, Finally, copy the presented to you, and click secret phrase Start the Auction. An important looking popup window will appear. Do what it says, and take a screenshot (just like the one below!). It also helps to copy the big block of text near the bottom of the window. Click Your wallet of choice will present you with a transaction to submit. Check to figure out an appropriate gas price, and submit the transaction. Yes, I am sure! Make transaction. https://ethgasstation.info/ Once you get the transaction ID, you can go to and look it up on the blockchain. https://etherscan.io For even more fun on etherscan.io, try typing in the ENS name in question. It will pop up some interesting stats on your auction. It will also let you know the date tha tyou need to reveal your bid. If you miss the “reveal” you will lose your ETH!!! Mark these dates on your calendar. Reveal Your Bid (3 Days Later) Three days after starting the auction, it will be time to reveal your bid. You have a 2-day window of time to do this, so make sure you are available to make this happen. Head back to the ENS section of MyCrypto.com and type in your ENS name. Click and it should tell you it’s time to reveal your bid. Check ENS Name Remember that screenshot from a few days ago? And that big blob of text with all the quotation marks and squiggly brackets? You’ll need that. If you have the long string of text, paste it into the first textbox. If all is well, then the rest of the information will fill in automagically. If not, manually enter your bid amount and secret phrase. After clicking , You will get a series of confirmation screens. Reveal your Bid Click and pay for the transaction using MetaMask (or your wallet of choice). The transaction come from the same address used to bid on the ENS name. Once finished, you’ll need to wait ANOTHER two days to finalize the auction. Yes, I am sure! Make transaction. must Finalize the Auction (2 Days Later) Once again, return to the ENS page of MyCrypto.com and type in your ENS name. The blue button should now say, . Finalize yourname.eth Click the buttons to confirm that yes, you do want to finalize, and pay your gas fees. This step must also be done by the same Ethereum account used to make the original bid and do the reveal transaction. really After the finalization transaction is complete, the ENS name is yours! Head over to etherscan.io and look it up. It should tell you that the name is taken, and the owner is YOU! Now all of your friends can send Ether and tokens to your ENS name. In the future, you may be able to do neat things like host a Swarm site at that address, or transfer it to a smart contract address that collects money for three legged giraffes. Sky’s the limit. If you enjoyed this post, please clap a bunch and follow me on ! Twitter

Visual Guide to Buying A Vanity Ethereum Addresses with ENS and MyCrypto

With more than 140 dApps now integrated into the Rootstock ecosystem and the growing number of users engaging with them, choosing the right wallet becomes crucial for managing assets effectively and securely. This article discusses various wallets compatible with Rootstock, providing insights into their features and compatibility. Wallets that support Rootstock, BTC, and RBTC Beexo Beexo supports Rootsock, BTC, and RBTC, offering both desktop/browser and mobile versions., but no Chrome extension. It provides a seamless and user-friendly payment experience, without complications, to send money globally and securely. Beexo wallet is the first wallet to integrate RIF Relay (formerly RIF Enveloping), a secure sponsored transaction system that allows users to pay transaction fees using ERC-20 tokens. This system enables end users to transact entirely using one asset, eliminating the need to manage a separate asset for gas, similar to traditional finance. Bridge MTPelerin Bridge MTPelerin supports Rootstock, BTC, RBTC, with testnet compatibility for BTC. It offers both desktop/browser and mobile versions, providing flexibility and comprehensive support for users. Depending on the amount of funds there may be a fee for the use of the service. Defiant Defiant is a non-custodial mobile-first wallet supporting Rootstock, BTC, and RBTC. Although it does not offer a Chrome extension or desktop/browser version, its mobile app is well-regarded for its user-friendly interface and robust security features. The Defiant wallet allows users to store, swap, and send crypto and stablecoins from the Bitcoin, Rootstock and Ethereum ecosystems Edge Edge supports Rootstock, BTC, and RBTC, along with testnet support for BTC and ETH. It offers desktop/browser and mobile versions, providing flexibility for users. Neither Edge nor any 3rd party can access your money or data. You get the financial privacy and autonomy that blockchain was designed for right at your fingertips. Enkrypt Enkrypt is a multichain, non-custodial, and open-source web3 browser wallet that supports Rootstock, BTC, and RBTC. It is primarily a Chrome extension, and does not offer desktop or mobile versions. Enkrypt allows you to add your Ledger or Trezor hardware wallets with full access to all Enkrypt’s features. The wallet does not charge fees for sending or receiving crypto assets. However, users will have to pay fees for the gas, which is charged by the networks. Exodus Exodus is a multi-asset wallet that supports BTC on Bitcoin & RBTC on Rootstock. It is available as a browser extension, mobile app, and/or desktop app. The wallet is designed to provide a balance of ease of use and security for both beginners and experienced users in the cryptocurrency space. Math Wallet Math Wallet supports Rootstock, BTC, and RBTC, available across Chrome, desktop, and mobile platforms. Its supported networks include Rootstock, ETH, Polkadot, Near, Solana, Binance Smart Chain, and many more. Its broad compatibility and multichain support make it an excellent choice for users managing multiple assets. Portis Portis provides a seamless experience for BTC, Rootstock, and RBTC users. It is available as a Chrome extension and desktop/browser application, ensuring easy access for users. Its multi-asset support makes it a strong contender for those deeply integrated into the Rootstock ecosystem. SafePal SafePal supports Rootstock, BTC, and RBTC, with availability as a Chrome extension and mobile app. Its focus on security and ease of use makes it a reliable choice for users seeking robust protection for their assets. Wallby Wallby supports Rootstock, BTC, and RBTC, available as a mobile app. While it lacks a Chrome extension and desktop/browser versions, its mobile focus ensures ease of use for on-the-go asset management. Wallets that support Rootstock and RBTC, but not BTC BlockWallet Block supports Rootstock and RBTC, available as a Chrome extension. While it lacks desktop/browser and mobile versions, its simplicity and specific focus on Rootstock make it an easy choice for users. Frontier Frontier supports Rootstock and RBTC and is available across Chrome, desktop, and mobile platforms. Its broad compatibility and multi-platform availability make it an appealing choice for users looking for flexibility and ease of access. Taho Taho supports Rootstock and RBTC, and is available as a Chrome extension. While it lacks Bitcoin support and desktop/mobile versions, it serves as a niche option for Rootstock-focused users. This wallet has an integration with Ledger, and allows swaps with no hidden fees. Other wallets in the Rootstock ecosystem Bitget Bitget supports BTC, RBTC, and RIF, and is available as a Chrome extension and mobile app. Its support for Bitcoin and Rootstock makes it a useful tool for users engaged in both ecosystems. MyCrypto MyCrypto, similar to MEW, focuses on RBTC support. It offers a Chrome extension and a desktop/browser version, catering to users who prefer managing their assets on a computer, but no mobile version. The desktop version provides additional methods for accessing a wallet, such as using a mnemonic phrase or a private key. And another fact about MyCrypto wallet is that it supports domain registration on the RIF Naming Service (RNS). Metamask Metamask is one of the most popular multi-chain wallet supporting RBTC, with compatibility for testnets including Ethereum and Rootstock, allowing users to get test RBTC and RIF. It is available as a Chrome extension, desktop application, and mobile app. You can either use the metamask-landing.rifos.org tool to download/install Metamask, and add Rootstock custom network or follow the steps listed in metamask.io. MEW (MyEtherWallet) MEW is well-known in the Ethereum community and also supports RBTC. This wallet is accessible via Chrome and offers an Android app. While it lacks Bitcoin support and desktop/browser versions, it is a reliable choice for RBTC users. What’s next Choosing the right wallet within the Rootstock ecosystem depends on your specific needs and preferences. Whether you prioritize multi-asset support, mobile access, or security features, there is a wallet tailored to your requirements. As the ecosystem continues to grow, staying informed about the latest wallet options will ensure you can manage your assets effectively and securely. Looking for more answers? Join the Rootstock community on Discord to get all your questions answered. With more than 140 dApps now integrated into the Rootstock ecosystem and the growing number of users engaging with them, choosing the right wallet becomes crucial for managing assets effectively and securely. dApps This article discusses various wallets compatible with Rootstock, providing insights into their features and compatibility. Wallets that support Rootstock, BTC, and RBTC Beexo Beexo supports Rootsock, BTC , and RBTC, offering both desktop/browser and mobile versions., but no Chrome extension. It provides a seamless and user-friendly payment experience, without complications, to send money globally and securely. Beexo BTC Beexo wallet is the first wallet to integrate RIF Relay (formerly RIF Enveloping), a secure sponsored transaction system that allows users to pay transaction fees using ERC-20 tokens. This system enables end users to transact entirely using one asset, eliminating the need to manage a separate asset for gas, similar to traditional finance. RIF Relay Bridge MTPelerin Bridge MTPelerin supports Rootstock, BTC , RBTC, with testnet compatibility for BTC. It offers both desktop/browser and mobile versions, providing flexibility and comprehensive support for users. Depending on the amount of funds there may be a fee for the use of the service. Bridge MTPelerin BTC Defiant Defiant is a non-custodial mobile-first wallet supporting Rootstock, BTC, and RBTC. Although it does not offer a Chrome extension or desktop/browser version, its mobile app is well-regarded for its user-friendly interface and robust security features. Defiant The Defiant wallet allows users to store, swap, and send crypto and stablecoins from the Bitcoin, Rootstock and Ethereum ecosystems Edge Edge Edge supports Rootstock, BTC, and RBTC, along with testnet support for BTC and ETH. It offers desktop/browser and mobile versions, providing flexibility for users. Edge BTC, Neither Edge nor any 3rd party can access your money or data. You get the financial privacy and autonomy that blockchain was designed for right at your fingertips. Enkrypt Enkrypt Enkrypt is a multichain, non-custodial, and open-source web3 browser wallet that supports Rootstock, BTC, and RBTC. It is primarily a Chrome extension, and does not offer desktop or mobile versions. Enkrypt Enkrypt allows you to add your Ledger or Trezor hardware wallets with full access to all Enkrypt’s features. The wallet does not charge fees for sending or receiving crypto assets. However, users will have to pay fees for the gas, which is charged by the networks. Exodus Exodus Exodus is a multi-asset wallet that supports BTC on Bitcoin & RBTC on Rootstock. It is available as a browser extension, mobile app, and/or desktop app. The wallet is designed to provide a balance of ease of use and security for both beginners and experienced users in the cryptocurrency space. Exodus Math Wallet Math Wallet Math Wallet supports Rootstock, BTC, and RBTC, available across Chrome, desktop, and mobile platforms. Its supported networks include Rootstock, ETH, Polkadot, Near, Solana, Binance Smart Chain, and many more. Math Wallet Its broad compatibility and multichain support make it an excellent choice for users managing multiple assets. Portis Portis Portis provides a seamless experience for BTC, Rootstock, and RBTC users. It is available as a Chrome extension and desktop/browser application, ensuring easy access for users. Its multi-asset support makes it a strong contender for those deeply integrated into the Rootstock ecosystem. SafePal SafePal SafePal supports Rootstock, BTC, and RBTC, with availability as a Chrome extension and mobile app. Its focus on security and ease of use makes it a reliable choice for users seeking robust protection for their assets. SafePal Wallby Wallby Wallby supports Rootstock, BTC, and RBTC, available as a mobile app. While it lacks a Chrome extension and desktop/browser versions, its mobile focus ensures ease of use for on-the-go asset management. Wallets that support Rootstock and RBTC, but not BTC Wallets that support Rootstock and RBTC, but not BTC BlockWallet BlockWallet Block supports Rootstock and RBTC, available as a Chrome extension. While it lacks desktop/browser and mobile versions, its simplicity and specific focus on Rootstock make it an easy choice for users. Block Frontier Frontier Frontier supports Rootstock and RBTC and is available across Chrome, desktop, and mobile platforms. Its broad compatibility and multi-platform availability make it an appealing choice for users looking for flexibility and ease of access. Frontier Taho Taho Taho supports Rootstock and RBTC, and is available as a Chrome extension. While it lacks Bitcoin support and desktop/mobile versions, it serves as a niche option for Rootstock-focused users. This wallet has an integration with Ledger, and allows swaps with no hidden fees. Taho Other wallets in the Rootstock ecosystem Bitget Bitget Bitget supports BTC, RBTC, and RIF, and is available as a Chrome extension and mobile app. Its support for Bitcoin and Rootstock makes it a useful tool for users engaged in both ecosystems. Bitget MyCrypto MyCrypto MyCrypto , similar to MEW, focuses on RBTC support. It offers a Chrome extension and a desktop/browser version, catering to users who prefer managing their assets on a computer, but no mobile version. MyCrypto The desktop version provides additional methods for accessing a wallet, such as using a mnemonic phrase or a private key. And another fact about MyCrypto wallet is that it supports domain registration on the RIF Naming Service (RNS) . RIF Naming Service (RNS) Metamask Metamask Metamask is one of the most popular multi-chain wallet supporting RBTC, with compatibility for testnets including Ethereum and Rootstock, allowing users to get test RBTC and RIF. Metamask It is available as a Chrome extension, desktop application, and mobile app. You can either use the metamask-landing.rifos.org tool to download/install Metamask, and add Rootstock custom network or follow the steps listed in metamask.io . metamask-landing.rifos.org metamask.io MEW (MyEtherWallet) MEW (MyEtherWallet) MEW is well-known in the Ethereum community and also supports RBTC. This wallet is accessible via Chrome and offers an Android app. While it lacks Bitcoin support and desktop/browser versions, it is a reliable choice for RBTC users. MEW What’s next What’s next Choosing the right wallet within the Rootstock ecosystem depends on your specific needs and preferences. Whether you prioritize multi-asset support, mobile access, or security features, there is a wallet tailored to your requirements. Choosing the right wallet within the Rootstock ecosystem depends on your specific needs and preferences. Whether you prioritize multi-asset support, mobile access, or security features, there is a wallet tailored to your requirements. As the ecosystem continues to grow, staying informed about the latest wallet options will ensure you can manage your assets effectively and securely. Looking for more answers? Join the Rootstock community on Discord to get all your questions answered. Looking for more answers? Join the Rootstock community on Discord to get all your questions answered. Looking for more answers? Join the Rootstock community on Discord to get all your questions answered. Rootstock community on Discord

A Comprehensive Guide to Wallets Within the Rootstock Ecosystem

রুটস্টক ইকোসিস্টেমের মধ্যে ওয়ালেটের জন্য একটি ব্যাপক নির্দেশিকা

Ein umfassender Leitfaden zu Wallets im Rootstock-Ökosystem

Una guía completa de carteras dentro del ecosistema de portainjertos

Un guide complet des portefeuilles au sein de l'écosystème Rootstock

रूटस्टॉक पारिस्थितिकी तंत्र के भीतर वॉलेट्स के लिए एक व्यापक गाइड

Rootstock エコシステム内のウォレットに関する包括的なガイド

Rootstock 생태계 내 지갑에 대한 종합 가이드

Um guia abrangente para carteiras no ecossistema de porta-enxertos

Комплексное руководство по кошелькам в экосистеме Rootstock

Anaç Ekosistemindeki Cüzdanlara İlişkin Kapsamlı Bir Kılavuz

Hướng dẫn toàn diện về ví trong hệ sinh thái Rootstock

Rootstock 生态系统内钱包的综合指南

Dazed and Confused: What’s Wrong with Crypto
Libraries? — Results and Discussion

Authors:
(1) Mohammadreza Hazhirpasand, University of Bern, Bern, Switzerland;
(2) Oscar Nierstrasz, University of Bern, Bern, Switzerland;
(3) Mohammad Ghafari, University of Auckland, Auckland, New Zealand. Table of Links Abstract and I. Introduction
II. Methodology
III. Results and Discussion
IV. Threats to Validity
V. Related Work
VI. Conclusions
VII. Acknowledgments and References II. METHODOLOGY In the following, we explain the objectives of this study as well as the methodology used for data collection and analysis. 1) Objective: In this study, we pose the following research question “what technical difficulties are prevalent among crypto libraries?” to tackle the underlying reasons why developers’ performance varies in using crypto APIs. The objectives of this research are listed in the following: • Finding prevalent themes of technical challenges in using crypto libraries helps library designers to improve the design of APIs. • Underlying factors can assist team leaders to be aware of areas where the developers might encounter difficulties in using cryptography. 2) Selecting crypto libraries: We aim at studying posts associated with popular crypto libraries on Stack Overflow. We assumed that discussions related to crypto libraries contain the name of the library as a tag. Hence, we selected the “cryptography” tag, i.e., base tag, to observe what other tags were used together with the base tag. We used Stack Exchange Data Explorer to run a query in order to fetch tags that appeared together with cryptography.[1] We realized that there are 2 184 tags, i.e., candidate tags. The two authors of this paper separately checked each of the candidate tags. Each of the reviewers selected the ones that are crypto libraries. They used the internet to explore a tag in which they had a lack of certainty. Then, they cross-checked the choices and discussed the tags. They arrived at the conclusion that tags that do not represent a crypto library or only provide a particular, limited service in cryptography (e.g., hashing) should not be considered. As a result, there were 6 tags that were eliminated from the list, namely rsacryptoserviceprovider, aescryptoserviceprovider, rijndaelmanaged, bcrypt, javax.crypto, and hashlib. The aforementioned tags are either a crypto class, namespace, or a dedicated module only for hashing. Ultimately, they agreed on a list of 20 crypto libraries, illustrated in Table I. 3) Crypto libraries: The selected crypto libraries are all widely used in practice and have been examined in research projects. For instance, six of the selected libraries, i.e., OpenSSL, libsodium, Bouncy Castle, SJCL, Crypto-JS, and PyCrypto, were studied for finding usability issues [6]. MCrypt is the successor to the Unix crypt command, which supports modern encryption algorithms. [2] The phpseclib library offers pure-PHP implementations of SSH2, SFTP, RSA, DSA, and many other algorithms. [3] Crypto++ and Botan are both C++ crypto libraries that support a wide range of crypto algorithms and security protocols. [4] [5] The Microsoft CryptoAPI interface enables developers to employ authentication, encoding, and encryption to Windows-based applications. [6] Jasypt and Java Cryptography Architecture (JCA) are both intended for Java developers, and the latter is part of the Java security API. [7] [8] The Web Crypto AP is intended to present basic cryptographic operations for web applications and defines cryptographic primitives in a native JavaScript API. [9] The wolfSSL TLS library is a lightweight, C-language-based library designed for IoT, embedded systems, and smart grids. [10] There are also popular OpenSSL wrappers in languages such as nodecrypto in Node.js and pyOpenSSL in Python. There have been numerous studies to investigate the security point of view of aforementioned crypto libraries and their strengths and weaknesses were examined [7] [8] [9]. However, the security evaluation of these crypto libraries falls outside the scope of this paper. 4) Manual investigation: In total, there are 24 648 posts that contained the selected crypto libraries’ tags. We computed the required sample size for the population with a confidence level of 95% and a margin of error of 4.34%, which results in sampling 500 posts. We then equally selected 25 posts from each tag (i.e., a crypto library). We queried the posts containing a crypto library tag,e.g., OpenSSL, and set the search criteria to “recent activity”, so that Stack Overflow returns the recent active discussions. Since we observed questions that are either unanswered or received negative votes, we decided to choose the posts for which the question received at least one upvote and at least one answer. The list of the selected questions are available online.[11] Thereafter, we employed thematic analysis, a qualitative research method for finding themes in texts [10], to deduce the frequent topics from the chosen posts. Since our study is of an exploratory nature, we did not devise a list of themes prior to studying the posts. Hence, in order to link each post to a suitable theme, two authors of the paper were responsible to separately study the posts and deduce the main issue (i.e., theme) of the post. The reviewers carefully reviewed the title, question body, and answer body of each post. Despite the fact that each post may entail several crypto concepts, the reviewers’ objective was to find the key issue of each post. They employed open coding in which a short explanation label was assigned to each post [11]. Each author reiterated the coding phase three times to improve their deduced list of themes. To evaluate the inter-rater agreement between the two reviewers, we employed Cohen’s kappa to assess the agreement level [12]. Deducing the themes from the posts, the reviewers received 68% Cohen’s Kappa score, which indicates a substantial agreement between the two reviewers. Finally, the two reviewers compared the two lists and discussed any disagreements. The two reviewers used different wording for building the list of themes and the total number of themes was not identical. They re-analyzed the particular posts in multiple sessions where they had different views. In some scenarios, they realized that one of the reviewers broke down one theme into several sub-themes, which they then merged if necessary. Ultimately, they agreed on 10 themes for the analyzed posts. This paper is available on arxiv under CC BY 4.0 DEED license. [1] https://data.stackexchange.com/ [2] http://mcrypt.sourceforge.net [3] https://github.com/phpseclib/phpseclib [4] https://www.cryptopp.com [5] https://botan.randombit.net [6] https://docs.microsoft.com/en-us/windows/win32/seccrypto/cryptography-portal [7] http://www.jasypt.org/ [8] https://www.oracle.com/java/technologies/javase/javase-tech-security.html [9] https://www.w3.org/TR/WebCryptoAPI/ [10] https://www.wolfssl.com/ [11] http://crypto-explorer.com/crypto_libs/ Authors: (1) Mohammadreza Hazhirpasand, University of Bern, Bern, Switzerland; (2) Oscar Nierstrasz, University of Bern, Bern, Switzerland; (3) Mohammad Ghafari, University of Auckland, Auckland, New Zealand. Authors: Authors: (1) Mohammadreza Hazhirpasand, University of Bern, Bern, Switzerland; (2) Oscar Nierstrasz, University of Bern, Bern, Switzerland; (3) Mohammad Ghafari, University of Auckland, Auckland, New Zealand. Table of Links Abstract and I. Introduction II. Methodology III. Results and Discussion IV. Threats to Validity V. Related Work VI. Conclusions VII. Acknowledgments and References Abstract and I. Introduction Abstract and I. Introduction II. Methodology II. Methodology III. Results and Discussion III. Results and Discussion IV. Threats to Validity IV. Threats to Validity V. Related Work V. Related Work VI. Conclusions VI. Conclusions VII. Acknowledgments and References VII. Acknowledgments and References II. METHODOLOGY In the following, we explain the objectives of this study as well as the methodology used for data collection and analysis. 1) Objective : In this study, we pose the following research question “what technical difficulties are prevalent among crypto libraries?” to tackle the underlying reasons why developers’ performance varies in using crypto APIs. 1) Objective The objectives of this research are listed in the following: • Finding prevalent themes of technical challenges in using crypto libraries helps library designers to improve the design of APIs. • Underlying factors can assist team leaders to be aware of areas where the developers might encounter difficulties in using cryptography. 2) Selecting crypto libraries: We aim at studying posts associated with popular crypto libraries on Stack Overflow. We assumed that discussions related to crypto libraries contain 2) Selecting crypto libraries: the name of the library as a tag. Hence, we selected the “cryptography” tag, i.e., base tag, to observe what other tags were used together with the base tag. We used Stack Exchange Data Explorer to run a query in order to fetch tags that appeared together with cryptography.[1] We realized that there are 2 184 tags, i.e., candidate tags. The two authors of this paper separately checked each of the candidate tags. Each of the reviewers selected the ones that are crypto libraries. They used the internet to explore a tag in which they had a lack of certainty. Then, they cross-checked the choices and discussed the tags. They arrived at the conclusion that tags that do not represent a crypto library or only provide a particular, limited service in cryptography (e.g., hashing) should not be considered. As a result, there were 6 tags that were eliminated from the list, namely rsacryptoserviceprovider, aescryptoserviceprovider, rijndaelmanaged, bcrypt, javax.crypto, and hashlib. The aforementioned tags are either a crypto class, namespace, or a dedicated module only for hashing. Ultimately, they agreed on a list of 20 crypto libraries, illustrated in Table I. 3) Crypto libraries: The selected crypto libraries are all widely used in practice and have been examined in research projects. For instance, six of the selected libraries, i.e., OpenSSL, libsodium, Bouncy Castle, SJCL, Crypto-JS, and PyCrypto, were studied for finding usability issues [6]. MCrypt is the successor to the Unix crypt command, which supports modern encryption algorithms. [2] The phpseclib library offers pure-PHP implementations of SSH2, SFTP, RSA, DSA, and many other algorithms. [3] Crypto++ and Botan are both C++ crypto libraries that support a wide range of crypto algorithms and security protocols. [4] [5] The Microsoft CryptoAPI interface enables developers to employ authentication, encoding, and encryption to Windows-based applications. [6] Jasypt and Java Cryptography Architecture (JCA) are both intended for Java developers, and the latter is part of the Java security API. [7] [8] The Web Crypto AP is intended to present basic cryptographic operations for web applications and defines cryptographic primitives in a native JavaScript API. [9] The wolfSSL TLS library is a lightweight, C-language-based library designed for IoT, embedded systems, and smart grids. [10] There are also popular OpenSSL wrappers in languages such as nodecrypto in Node.js and pyOpenSSL in Python. There have been numerous studies to investigate the security point of view of aforementioned crypto libraries and their strengths and weaknesses were examined [7] [8] [9]. However, the security evaluation of these crypto libraries falls outside the scope of this paper. 4) Manual investigation: In total, there are 24 648 posts that contained the selected crypto libraries’ tags. We computed the required sample size for the population with a confidence level of 95% and a margin of error of 4.34%, which results in sampling 500 posts. We then equally selected 25 posts from each tag (i.e., a crypto library). We queried the posts containing a crypto library tag,e.g., OpenSSL, and set the search criteria to “recent activity”, so that Stack Overflow returns the recent active discussions. Since we observed questions that are either unanswered or received negative votes, we decided to choose the posts for which the question received at least one upvote and at least one answer. The list of the selected questions are available online.[11] 4) Manual investigation: Thereafter, we employed thematic analysis, a qualitative research method for finding themes in texts [10], to deduce the frequent topics from the chosen posts. Since our study is of an exploratory nature, we did not devise a list of themes prior to studying the posts. Hence, in order to link each post to a suitable theme, two authors of the paper were responsible to separately study the posts and deduce the main issue (i.e., theme) of the post. The reviewers carefully reviewed the title, question body, and answer body of each post. Despite the fact that each post may entail several crypto concepts, the reviewers’ objective was to find the key issue of each post. They employed open coding in which a short explanation label was assigned to each post [11]. Each author reiterated the coding phase three times to improve their deduced list of themes. To evaluate the inter-rater agreement between the two reviewers, we employed Cohen’s kappa to assess the agreement level [12]. Deducing the themes from the posts, the reviewers received 68% Cohen’s Kappa score, which indicates a substantial agreement between the two reviewers. Finally, the two reviewers compared the two lists and discussed any disagreements. The two reviewers used different wording for building the list of themes and the total number of themes was not identical. They re-analyzed the particular posts in multiple sessions where they had different views. In some scenarios, they realized that one of the reviewers broke down one theme into several sub-themes, which they then merged if necessary. Ultimately, they agreed on 10 themes for the analyzed posts. This paper is available on arxiv under CC BY 4.0 DEED license. This paper is available on arxiv under CC BY 4.0 DEED license. available on arxiv [1] https://data.stackexchange.com/ [2] http://mcrypt.sourceforge.net [3] https://github.com/phpseclib/phpseclib [4] https://www.cryptopp.com [5] https://botan.randombit.net [6] https://docs.microsoft.com/en-us/windows/win32/seccrypto/cryptography-portal [7] http://www.jasypt.org/ [8] https://www.oracle.com/java/technologies/javase/javase-tech-security.html [9] https://www.w3.org/TR/WebCryptoAPI/ [10] https://www.wolfssl.com/ [11] http://crypto-explorer.com/crypto_libs/

Dazed and Confused: What’s Wrong with Crypto
Libraries? — Methodology

Authors:
(1) Anna-Katharina Wickert, Technische Universität Darmstadt, Darmstadt, Germany (wickert@cs.tu-darmstadt.de);
(2) Lars Baumgärtner, Technische Universität Darmstadt, Darmstadt, Germany (baumgaertner@cs.tu-darmstadt.de);
(3) Florian Breitfelder, Technische Universität Darmstadt, Darmstadt, Germany (florian.breitfelder@tu-darmstadt.de);
(4) Mira Mezini, Technische Universität Darmstadt, Darmstadt, Germany (mezini@cs.tu-darmstadt.de). Table of Links Abstract and 1 Introduction 2 Background 3 Design and Implementation of Licma and 3.1 Design 3.2 Implementation 4 Methodology and 4.1 Searching and Downloading Python Apps 4.2 Comparison with Previous Studies 5 Evaluation and 5.1 GitHub Python Projects 5.2 MicroPython 6 Comparison with previous studies 7 Threats to Validity 8 Related Work 9 Conclusion, Acknowledgments, and References 5 EVALUATION In this Section, we present our evaluation of crypto misuses in real-world Python applications from GitHub and MicroPython projects. 5.1 GitHub Python Projects Overall, LICMA identified 1,501 possible misuses in our data set of Python applications attributed to 81 repositories. Thus, 52.26 % of the 155 analyzed Python applications that contain crypto usages have at least one misuse. As discussed in Section 3.1, we distinguish between potential and definite misuses. While a potential misuse requires a manual inspection to decide whether it is harmful, a definite misuse indicates that the analysis was able to resolve the respective crypto parameter. Thus, we know that a rule of LICMA is definitely violated by the respective API call. We identified 85 definite misuses which could be identified within one class file and thus are local. The remaining 1,416 misuses are potential misuses. 5.1.1 Dependencies. From the 1,501 misuses, only 7.00 % are within the application code and not in dependencies. These misuses are within 14.81 % of the applications with at least one misuse. The remaining misuses are found in dependencies and can be reduced to 290 unique misuses. Thus, developers introduce most of their misuses by using dependencies rather than using the respective crypto library directly. In total, only 12 projects are affected by misuses in the application code itself. To understand the influence of dependencies within the applications with the most misuses, we inspected the 10 Python projects with more than 30 misuses. Figure 2 confirms the previous observation that most of the misuses are in dependencies and only a few projects use a crypto library directly. The Scapy repository[6] is an exception as all misuses are in its code. Our investigation reveals that this repository is often used as a dependency by other projects. Thus, these findings can be attributed to dependencies as well. While, the previous results focused on the projects, we also inspected the dependencies causing most of the misuses. In total, 5 of the observed dependencies are responsible for a misuse in more than 10 different projects. For 34 projects we observe a misuse within the repository Scapy which was the only analyzed repository in Figure 2 without any misuse in its dependencies. Thus, confirming our previous observation about this project. 5.1.2 Rules and Python Cryptographic Libraries. In order to get a better understanding of the underlying reasons of the misuses, we evaluated how often a misuse per rule and library occurs (Fig. 3). Our analysis reveals that most of the misuses are related to the use of different block modes, §1 and §2, of the M2Crypto library, and constant encryption keys, §3, for the cryptography library. We assume that the few numbers of misuses of §1 and §2 of cryptography are due to the design of the library. The library suggests to use a high-level symmetric encryption class, called Fernet, instead of the low-level symmetric encryption classes which would enable the respective misuses. Most of the misuses due to insecure PBE configurations, §4 and §5, are by developers using the library PyCrypto. While, none of the 3 previously mentioned libraries make it impossible to produce a misuse of one of our 5 rules, the library PyNaCl completely prevents misuses for §1, §2, and §5. In our study, we found only 2 instances of a misuse due to a constant encryption key for PyNaCl. 5.1.3 Reasons for Definite Misuses. Among the definite misuses, there is at least one misuse for all previously discussed rules. We identified 13 definite misuses in 5 different projects which use the ECB encryption mode (§1). In all cases, the mode is passed explicitly with the parameter and not implicitly as in Java [4]. For 8 misuses we observed that a static IV is used, e.g. zero bytes, and thus resulting in an insecure encryption with the block mode CBC (§2). Furthermore, we identified that the scapy project which is also commonly used as a dependency uses a constant encryption key resulting in 14 misuses (§3). For example, we found a zero byte-array as key. For password-based encryption, we identified 18 misuses within 14 projects which pass a static salt instead of a randomly generated one (§4). In total, we identify 32 misuses which are due to requesting only 1 iteration instead of an value greater than 1,000 as recommended (§5). Thus, the process of generating a password is faster but very insecure, e.g., due to dictionary attacks. This paper is available on arxiv under CC BY 4.0 DEED license. [6] https://github.com/secdev/scapy Authors: (1) Anna-Katharina Wickert, Technische Universität Darmstadt, Darmstadt, Germany (wickert@cs.tu-darmstadt.de); (2) Lars Baumgärtner, Technische Universität Darmstadt, Darmstadt, Germany (baumgaertner@cs.tu-darmstadt.de); (3) Florian Breitfelder, Technische Universität Darmstadt, Darmstadt, Germany (florian.breitfelder@tu-darmstadt.de); (4) Mira Mezini, Technische Universität Darmstadt, Darmstadt, Germany (mezini@cs.tu-darmstadt.de). Authors: Authors: (1) Anna-Katharina Wickert, Technische Universität Darmstadt, Darmstadt, Germany (wickert@cs.tu-darmstadt.de); (2) Lars Baumgärtner, Technische Universität Darmstadt, Darmstadt, Germany (baumgaertner@cs.tu-darmstadt.de); (3) Florian Breitfelder, Technische Universität Darmstadt, Darmstadt, Germany (florian.breitfelder@tu-darmstadt.de); (4) Mira Mezini, Technische Universität Darmstadt, Darmstadt, Germany (mezini@cs.tu-darmstadt.de). Table of Links Abstract and 1 Introduction Abstract and 1 Introduction 2 Background 2 Background 3 Design and Implementation of Licma and 3.1 Design 3 Design and Implementation of Licma and 3.1 Design 3.2 Implementation 3.2 Implementation 4 Methodology and 4.1 Searching and Downloading Python Apps 4 Methodology and 4.1 Searching and Downloading Python Apps 4.2 Comparison with Previous Studies 4.2 Comparison with Previous Studies 5 Evaluation and 5.1 GitHub Python Projects 5 Evaluation and 5.1 GitHub Python Projects 5.2 MicroPython 5.2 MicroPython 6 Comparison with previous studies 6 Comparison with previous studies 7 Threats to Validity 7 Threats to Validity 8 Related Work 8 Related Work 9 Conclusion, Acknowledgments, and References 9 Conclusion, Acknowledgments, and References 5 EVALUATION In this Section, we present our evaluation of crypto misuses in real-world Python applications from GitHub and MicroPython projects. 5.1 GitHub Python Projects Overall, LICMA identified 1,501 possible misuses in our data set of Python applications attributed to 81 repositories. Thus, 52.26 % of the 155 analyzed Python applications that contain crypto usages have at least one misuse. LICMA As discussed in Section 3.1, we distinguish between potential and definite misuses. While a potential misuse requires a manual inspection to decide whether it is harmful, a definite misuse indicates that the analysis was able to resolve the respective crypto parameter. Thus, we know that a rule of LICMA is definitely violated by the respective API call. We identified 85 definite misuses which could be identified within one class file and thus are local. The remaining 1,416 misuses are potential misuses. LICMA 5.1.1 Dependencies. From the 1,501 misuses, only 7.00 % are within the application code and not in dependencies. These misuses are within 14.81 % of the applications with at least one misuse. The remaining misuses are found in dependencies and can be reduced to 290 unique misuses. Thus, developers introduce most of their misuses by using dependencies rather than using the respective crypto library directly. In total, only 12 projects are affected by misuses in the application code itself. 5.1.1 Dependencies. To understand the influence of dependencies within the applications with the most misuses, we inspected the 10 Python projects with more than 30 misuses. Figure 2 confirms the previous observation that most of the misuses are in dependencies and only a few projects use a crypto library directly. The Scapy repository[6] is an exception as all misuses are in its code. Our investigation reveals that this repository is often used as a dependency by other projects. Thus, these findings can be attributed to dependencies as well. Scapy While, the previous results focused on the projects, we also inspected the dependencies causing most of the misuses. In total, 5 of the observed dependencies are responsible for a misuse in more than 10 different projects. For 34 projects we observe a misuse within the repository Scapy which was the only analyzed repository in Figure 2 without any misuse in its dependencies. Thus, confirming our previous observation about this project. 5.1.2 Rules and Python Cryptographic Libraries. In order to get a better understanding of the underlying reasons of the misuses, we evaluated how often a misuse per rule and library occurs (Fig. 3). Our analysis reveals that most of the misuses are related to the use of different block modes, §1 and §2, of the M2Crypto library, and constant encryption keys, §3, for the cryptography library. We assume that the few numbers of misuses of §1 and §2 of cryptography are due to the design of the library. The library suggests to use a high-level symmetric encryption class, called Fernet , instead of the low-level symmetric encryption classes which would enable the respective misuses. Most of the misuses due to insecure PBE configurations, §4 and §5, are by developers using the library PyCrypto. While, none of the 3 previously mentioned libraries make it impossible to produce a misuse of one of our 5 rules, the library PyNaCl completely prevents misuses for §1, §2, and §5. In our study, we found only 2 instances of a misuse due to a constant encryption key for PyNaCl . 5.1.2 Rules and Python Cryptographic Libraries. M2Crypto cryptography Fernet PyNaCl 5.1.3 Reasons for Definite Misuses. Among the definite misuses, there is at least one misuse for all previously discussed rules. We identified 13 definite misuses in 5 different projects which use 5.1.3 Reasons for Definite Misuses. the ECB encryption mode (§1). In all cases, the mode is passed explicitly with the parameter and not implicitly as in Java [4]. For 8 misuses we observed that a static IV is used, e.g. zero bytes, and thus resulting in an insecure encryption with the block mode CBC (§2). Furthermore, we identified that the scapy project which is also commonly used as a dependency uses a constant encryption key resulting in 14 misuses (§3). For example, we found a zero byte-array as key. IV is used, e.g. zero bytes, and thus resulting in an insecure encryption with the block mode CBC (§2). Furthermore, we identified that the scapy For password-based encryption, we identified 18 misuses within 14 projects which pass a static salt instead of a randomly generated one (§4). In total, we identify 32 misuses which are due to requesting only 1 iteration instead of an value greater than 1,000 as recommended (§5). Thus, the process of generating a password is faster but very insecure, e.g., due to dictionary attacks. This paper is available on arxiv under CC BY 4.0 DEED license. This paper is available on arxiv under CC BY 4.0 DEED license. available on arxiv [6] https://github.com/secdev/scapy https://github.com/secdev/scapy

Stories, News & Mentions about MEDCRYPT

Medcrypt’s Stories on HackerNoon

Medcrypt's News & Mentions