"That's my perspective from 30 years of doing this": An Interview Study on Practices, Experiences, and Challenges of Updating Cryptographic Code

Keeping cryptographic code up to date and free of vulnerabilities is critical for overall software security. Updating algorithms (e.g., SHA-1 to SHA-512), key sizes (e.g., 2048 to 4096 bits), protocols (e.g., TLS 1.2 to 1.3), or transitioning to post-quantum cryptography (PQC) are common objectives of cryptographic updates. However, previous work and recent incidents illustrate developers' struggle with cryptographic updates. The research illustrates that many software products include outdated and insecure cryptographic code and libraries. However, the security community lacks a solid understanding of cryptographic updates. We conducted an interview study with 21 experienced software developers to address this research gap. We wanted to learn about their experiences, approaches, challenges, and needs. Our participants updated for security and non-security reasons and generally perceived cryptographic updates as challenging and tedious. They lacked structured processes and faced significant challenges, such as insufficient cryptographic knowledge, legacy support hindering cryptographic transition, and a lack of helpful guidance. Participants desired the assistance of cryptographic experts and understandable resources for successful updates. We conclude with recommendations for developers, academia, standards organizations, and the upcoming transition to PCQ.