一句话：提出由 RFC 自动提取规则并经动态符号执行生成证书的差分测试方法，用于发现 SSL/TLS 证书验证漏洞。
SSL/TLS 协议中的证书验证对互联网安全至关重要，因此需要检查各实现是否正确实现了证书验证。本文提出一种由标准 RFC 指导的新型差分测试方法 RFCcert。首先从 RFC 中自动提取证书规则，其次通过动态符号执行生成低级测试用例，然后自动组装为高级测试用例，即证书，最后用这些证书测试 SSL/TLS 实现中的证书验证以揭示潜在漏洞或缺陷。RFCcert 的优势包括：证书根据标准而非遗传变异组装，因而具有差异针对性；既能揭示传统差分测试的无效性，也能完成传统差分测试无法进行的测试；支持工具已实现，大量实验表明该方法能有效发现 SSL/TLS 实现中的缺陷。
Certificate validation in Secure Socket Layer or Transport Layer Security protocol (SSL/TLS) is critical to Internet security. Thus, it is significant to check whether certificate validation in SSL/TLS is correctly implemented. With this motivation, we propose a novel differential testing approach which is directed by the standard Request For Comments (RFC). First, rules of certificates are extracted automatically from RFCs. Second, low-level test cases are generated through dynamic symbolic execution. Third, high-level test cases, i.e. certificates, are assembled automatically. Finally, with the assembled certificates being test cases, certificate validations in SSL/TLS implementations are tested to reveal latent vulnerabilities or bugs. Our approach named RFCcert has the following advantages: (1) certificates of RFCcert are discrepancy-targeted since they are assembled according to standards instead of genetics; (2) with the obtained certificates, RFCcert not only reveals the invalidity of traditional differential testing but also is able to conduct testing that traditional differential testing cannot do; and (3) the supporting tool of RFCcert has been implemented and extensive experiments show that the approach is effective in finding bugs of SSL/TLS implementations.
DOI 原文 ·
@inproceedings{paperbot4419,
title = {RFC-directed differential testing of certificate validation in SSL/TLS implementations},
author = {Chu Chen and Cong Tian and Zhenhua Duan and Liang Zhao},
booktitle = {ICSE},
year = {2018},
doi = {10.1145/3180155.3180226}
}