CSCIB-23: A Benchmark Dataset for Client-Side Cryptographic Implementations in JavaScript Web Applications
Description
CSCIB-23 (Client-Side Cryptographic Implementation Benchmark Dataset) is a benchmark dataset designed to support the analysis and evaluation of client-side cryptographic implementations in JavaScript web applications. The dataset contains 22 controlled demonstration websites representing different cryptographic implementation scenarios, including WebCrypto API, CryptoJS, symmetric and asymmetric encryption, hashing, password-based key derivation, JWT, Base64 encoding, plaintext handling, and transport-only security scenarios. Each benchmark case contains the corresponding demonstration website/source code together with cryptographic analysis reports, structured JSON results, text reports, screenshots, and PDF reports where applicable. The dataset was developed to support research on dynamic analysis and automated detection of client-side cryptographic implementations. It is associated with the CryptoScope dynamic JavaScript instrumentation framework, which monitors cryptographic operations at runtime and extracts relevant cryptographic parameters and security-related observations. The dataset can be used for: * Benchmarking client-side cryptographic analysis tools * Evaluating dynamic JavaScript instrumentation techniques * Studying cryptographic API and library usage in web applications * Analyzing cryptographic parameters and implementation patterns * Investigating potential client-side cryptographic security risks * Reproducing experiments related to automated cryptographic analysis The dataset is intended for academic research, controlled experimentation, and authorized security analysis.
Files
Steps to reproduce
1. Download or clone the CSCIB-23 dataset repository and obtain the complete `sites/` directory containing the 22 benchmark cases. 2. Select one of the benchmark websites from `sites/1/` through `sites/22/`. 3. Open the corresponding HTML file in a Chromium-based web browser or serve it through a local web server if required by the implementation. 4. Open the browser's Developer Tools and navigate to the **Console**. 5. Load the CryptoScope instrumentation script from the `source code/` directory into the browser environment. 6. Execute the instrumentation code before interacting with the target benchmark website. 7. Interact with the selected demonstration website to trigger its client-side cryptographic operations. 8. CryptoScope dynamically monitors supported cryptographic operations performed through WebCrypto APIs and/or supported JavaScript cryptographic libraries. 9. Observe the intercepted cryptographic operations and extracted parameters, including algorithm information, modes, key origin, IV, salt, iterations, payload information, and other available runtime observations. 10. Generate or inspect the corresponding analysis outputs, including JSON, TXT, screenshot, and PDF reports where available. 11. Compare the generated results with the reference files provided in the corresponding `sites/XX/` directory. 12. Repeat the procedure for the remaining benchmark websites to reproduce the complete benchmark evaluation. ### Expected Outcome The reproduced analysis should identify the cryptographic operations implemented by each controlled demonstration website and generate results consistent with the corresponding reference reports included in the dataset. For authorized research and controlled experiments, the dataset provides the necessary benchmark cases and reference outputs to facilitate reproducibility and comparative evaluation of client-side cryptographic analysis approaches.
Institutions
- University of Frontier Technology, BangladeshDhaka Division, Gazipur