RFCcertDT:SSL/TLS中证书验证的测试工具

RFCcertDT:a testing tool for certificate validation in SSL/TLS

为解决现有工具对安全套接层或传输层安全协议实现中证书验证模块的检测效率低等问题,研发了对证书验证模块进行差异测试的新工具RFCcertDT。首先,RFCcertDT基于因特网工程任务组制定的请求评议进行证书规则的自动提取、更新、分类和表示,基于动态符号执行技术生成证书作为测试用例;然后,使用生成的证书和令牌环式测试实现对单个或多个证书验证模块的差异测试并生成软件错误报告。实验结果表明,RFCcertDT的检测效率优于现有工具。RFCcertDT对证书验证模块实现了高效的检测,有助于加强安全套接层或传输层安全协议的软件安全。

To solve the problems such as low efficiency of existing tools which are used to check certificate validation modules in the implementation of Secure Sockets Layer or Transport Layer Security protocol, a novel tool named RFCcertDT for differential testing of certificate validation modules is designed and developed. First, rules of certificates are automatically extracted, updated, classified and expressed based on the Request for Comments specified by the Internet Engineering Task Force, and certificates which act as test cases are generated based on the dynamic symbolic execution technique. Second, the generated certificates and the token-ring testing are used to conduct differential testing of a single or multiple certificate validation modules and generate bug reports. Experimental results show that the RFCcertDT is more efficient than existing tools. In summary, the RFCcertDT tests certificate validation modules with high efficiency and is helpful to reinforcing the software security of the Secure Sockets Layer or Transport Layer Security protocol.