Extending language and library support in CBOMkit

About the Organization

<h3>Description</h3><p>This mentorship project combines both hands-on development and exploratory research.</p><p>CBOMkit currently supports cryptographic detection and analysis for Java, Python, and Go ecosystems. However, a significant portion of production systems relies on other programming languages like C/C++ (used especially in systems programming, embedded environments, and high-performance applications) and widely rely on crypto libraries like OpenSSL.</p><p><br></p><p>On the development side, the mentee will extend CBOMkit to support C/C++, with a primary focus on detecting usage of OpenSSL APIs, and cryptographic primitives. This includes adding C/C++ language support, designing detection logic in sonar-cryptography, integrating it into CBOMkit’s architecture, developing test cases and validating against real-world C/C++ projects, ensuring practical applicability and robustness.</p><p><br></p><p>Additionally, mentee will also test some other policies through existing Open Policy Agent (OPA) integration feature of CBOMkit.</p><p><br></p><p>On the research side, the mentee will analyze additional cryptographic libraries in the C/C++ ecosystem such as wolfSSL, libsodium, BoringSSL, and Botan, along with exploring language support for Rust and its associated cryptographic libraries. The goal is to evaluate their feasibility for future integration into CBOMkit.</p><h3><br></h3><h3>Learning Objectives</h3><ul><li>Understand analysis techniques for detecting cryptographic usage</li><li>Gain hands-on experience with cryptographic libraries such as OpenSSL in C/C++</li><li>Learn how to extend and contribute to a production-grade open-source security tool</li><li>Develop skills in designing test cases and validating tools on real-world codebases</li><li>Learn how policy-based security analysis works using Open Policy Agent (OPA)</li><li>Conduct technical research and evaluate cryptographic libraries and programming language for integration</li></ul><h3><br></h3><h3>Expected Outcome and Deliverables</h3><ul><li>C/C++ language support integrated into sonar-cryptography</li><li>OpenSSL detection module with meaningful coverage</li><li>integration with CBOMkit</li><li>Test suite for validating detection accuracy</li><li>Validation report using real-world C/C++ projects</li><li>Research document comparing additional libraries (wolfSSL, libsodium, BoringSSL, Botan) and language(Rust with its library) for integration feasibility</li><li>Blog post(s) or technical documentation describing implementation and findings</li><li>Evaluation with other policy through OPA</li></ul><h3><br></h3><h3>Recommended Skills</h3><ul><li>Proficiency in java with good understanding of C/C++</li><li>Experience with OpenSSL and general cryptographic APIs</li><li>Good understanding of cryptographic concepts (encryption, hashing, key exchange)</li><li>Experience with static analysis or code parsing (preferred but not mandatory)</li><li>Familiarity with Open Policy Agent</li><li>Familiarity with Git and open-source contribution workflows</li></ul><h3><br></h3><h3>Additional Information</h3><ul><li><a href="https://github.com/cbomkit/sonar-cryptography/blob/main/docs/LANGUAGE_SUPPORT.md" rel="noopener noreferrer" target="_blank" style="color: rgb(9, 105, 218);">https://github.com/cbomkit/sonar-cryptography/blob/main/docs/LANGUAGE_SUPPORT.md</a></li><li><a href="https://github.com/cbomkit/sonar-cryptography/blob/main/docs/DETECTION_RULE_STRUCTURE.md" rel="noopener noreferrer" target="_blank" style="color: rgb(9, 105, 218);">https://github.com/cbomkit/sonar-cryptography/blob/main/docs/DETECTION_RULE_STRUCTURE.md</a></li></ul>