Abstract:

To solve the problems such as low efficiency of existing tools which are used to check certificate validation modules in the implementation of Secure Sockets Layer or Transport Layer Security protocol, a novel tool named RFCcertDT for differential testing of certificate validation modules is designed and developed. First, rules of certificates are automatically extracted, updated, classified and expressed based on the Request for Comments specified by the Internet Engineering Task Force, and certificates which act as test cases are generated based on the dynamic symbolic execution technique. Second, the generated certificates and the token-ring testing are used to conduct differential testing of a single or multiple certificate validation modules and generate bug reports. Experimental results show that the RFCcertDT is more efficient than existing tools. In summary, the RFCcertDT tests certificate validation modules with high efficiency and is helpful to reinforcing the software security of the Secure Sockets Layer or Transport Layer Security protocol.

Key words: secure sockets layer, transport layer security, request for comments, certificate validation, differential testing, dynamic symbolic execution