Yongming Fan
Cryptographic software forms a critical foundation of modern computing systems, but the security guarantees of cryptographic protocols do not automatically extend to their implementations. Errors in arithmetic operations, validation logic, data conversion, constraint generation, or component integration can cause deployed software to deviate from the intended protocol while still producing plausible outputs. Such risks are difficult to detect in compiled binaries and become even more challenging in modern cryptographic systems such as zero-knowledge proofs, where implementations combine finite-field arithmetic, constraint systems, witness generation, proving procedures, verification logic, and serialization formats.Securing cryptographic implementations requires analysis techniques that can reason about both low-level program behavior and high-level cryptographic intent. To address this need, cryptographic function identification in binaries is first examined. It categorizes existing detection techniques, develops a unified benchmarking framework, and evaluates current tools through reproduction and replication studies across different compilers, optimization levels, obfuscation strategies, and algorithm variants. The second part introduces an automated security analysis framework for zkSNARK implementations that combines constraint checking with fuzzing-based testing to detect and locate cryptographic logic errors. This approach helps determine whether an implemented zkSNARK system correctly enforces the intended computation and security design. The third part develops a grey-box differential fuzzing approach for zero-knowledge proof binary applications. It uses structured input generation, coverage monitoring, control-dependency-aware taint tracking, and error localization to guide testing toward security-relevant code and expose inconsistencies in circuit construction, witness conversion, proof generation, and verification logic.Together, these contributions connect binary analysis, automated checking, and protocol-aware fuzzing to improve the practical security of cryptographic software. They provide methods for identifying implementation-level weaknesses that may remain hidden during ordinary testing, especially when programs produce valid-looking outputs despite incorrect cryptographic behavior. By combining systematic evaluation, zkSNARK-specific analysis, and binary-level testing, the resulting methodologies advance the development of more reliable techniques for analyzing, testing, and securing real-world cryptographic systems.