Can I read 2020 IEEE International Conference on Software Maintenance and Evolution (ICSME) - Guided, Deep Testing of X.509 Certificate Validation via Coverage Transfer Graphs on EtoBox?

2020 IEEE International Conference on Software Maintenance and Evolution (ICSME) - Guided, Deep Testing of X.509 Certificate Validation via Coverage Transfer Graphs by Zhu, Jiayu; Wan, Chengcheng; Nie, Pengbo; Chen, Yuting; Su, Zhendong is a scholarly article available to read on EtoBox.

What is 2020 IEEE International Conference on Software Maintenance and Evolution (ICSME) - Guided, Deep Testing of X.509 Certificate Validation via Coverage Transfer Graphs about?

SSL and TLS are two secure protocols for creating secure connections over the Internet. X.509 certificate validation is important for security and needs to be performed before an SSL/TLS connection is established. However, state-of-the-art testing techniques, such as frankencert and mucert, have revealed, through randomly mutating Internet accessible certificates, that there exist unexpected, sometimes critical, validation differences among different SSL/TLS implementations. Despite these strong efforts, certificate validation is still not thoroughly tested and more effective techniques are needed as this work shows. To this end, this paper introduces transcert, a novel approach for effectively guiding fuzzing to perform deep testing of X.509 certificate validation. The goal of transcert is to generate certificates that trigger diverse executions; it achieves this goal by introducing the concept of a coverage transfer graph to efficiently, precisely abstract program executions. In particular, it records the execution of how a given certificate is validated by a reference SSL/TLS implementation. It then constructs a coverage transfer graph to model the coverage transfer from a test

Author

Zhu, Jiayu; Wan, Chengcheng; Nie, Pengbo; Chen, Yuting; Su, Zhendong

Publisher

IEEE

Published

2020

Language

EN