Name: Crypto Is Fine. The Code Is Not: OWASP A04 Cryptographic Failures Through Real-World CVEs
Start: 2026-11-05T11:30:00-0800
End: 2026-11-05T12:15:00-0800

Crypto Is Fine. The Code Is Not: OWASP A04 Cryptographic Failures Through Real-World CVEs

Thursday November 5, 2026 11:30am - 12:15pm PST

Room: Grand Ballroom B (Street Level)

Cryptography has a reputation for being intimidating, mathematical, and difficult to reason about. In reality, many cryptographic failures in production systems have very little to do with cryptography itself. They happen because of small implementation mistakes such as skipping a validation check, trusting unvalidated input, or selecting the wrong algorithm.

In this talk, we take a practical and data-driven look at the OWASP Cryptographic Failures category using GitHub Security Advisories collected as of January 2026. We begin with a brief overview of how these vulnerabilities are distributed across CWEs, then focus on two of the most common failure patterns. Using real vulnerable open source libraries, we examine signature verification bypasses and algorithm confusion bugs.

Rather than only showing exploits, this talk actively involves the audience. For each case study, we pause at key moments and work through the vulnerability together, asking questions like what inputs could be sent or what assumptions might be broken. Live demos and CTF-style challenges are used throughout, making the session interactive and approachable even without a cryptography background.

Speakers

Diptendu Kar

Security Researcher, Semgrep

Diptendu Kar is a security researcher focused on supply chain and dependency risk. He works on triaging open-source vulnerabilities, writing detection rules, and exploring how AI can automate tedious parts of security research. He also teaches Software Security Practices at Northeastern... Read More →

Thursday November 5, 2026 11:30am - 12:15pm PST
Room: Grand Ballroom B (Street Level)

Implementation

Audience Intermediate

OWASP Global AppSec USA 2026

Diptendu Kar

Get help with the event

OWASP Global AppSec USA 2026

Diptendu Kar

Sign up or log in to save this to your schedule, view media, leave feedback and see who's attending!

Get help with the event