Exploiting Dissent: Towards Fuzzing-based Differential Black Box Testing of TLS Implementations

  • The Transport Layer Security (TLS) protocol is one of the most widely used security protocols on the internet. Yet do implementations of TLS keep on suffering from bugs and security vulnerabilities. In large part is this due to the protocol's complexity which makes implementing and testing TLS notoriously difficult. In this paper, we present our work on using differential testing as effectiveThe Transport Layer Security (TLS) protocol is one of the most widely used security protocols on the internet. Yet do implementations of TLS keep on suffering from bugs and security vulnerabilities. In large part is this due to the protocol's complexity which makes implementing and testing TLS notoriously difficult. In this paper, we present our work on using differential testing as effective means to detect issues in black-box implementations of the TLS handshake protocol. We introduce a novel fuzzing algorithm for generating large and diverse corpuses of mostly-valid TLS handshake messages. Stimulating TLS servers when expecting a ClientHello message, we find messages generated with our algorithm to induce more response discrepancies and to achieve a higher code coverage than those generated with American Fuzzy Lop, TLS-Attacker, or NEZHA. In particular, we apply our approach to OpenssL, BoringSSL, WolfSSL, mbedTLS, and MatrixSSL, and find several real implementation bugs; among them a serious vulnerability in MatrixSSL 3.8.4. Besides do our findings point to imprecision in the TLS specification. We see our approach as present in this paper as the first step towards fully interactive differential testing of black-box TLS protocol implementations. Our software tools are publicly available as open source projects.show moreshow less

Export metadata

Additional Services

Share in Twitter Search Google Scholar
Metadaten
Author:Andreas Walz, Axel SikoraGND
Creating Corporation:IEEE
Year of Publication:2017
Language:English
GND Keyword:Dissens; Flugdatenregistriergerät; Terrestrisches Laserscanning
Parent Title (English):IEEE Transactions on Dependable and Secure Computing
ISSN:1545-5971
First Page:1
Last Page:14
Document Type:Article (reviewed)
Institutes:Hochschule Offenburg / Bibliografie
Acces Right:Frei zugänglich
Release Date:2019/11/07
Licence (German):License LogoEs gilt das UrhG
DOI:https://doi.org/10.1109/TDSC.2017.2763947