Protocol State Fuzzing of TLS Implementations

By Joeri de Ruiter, Erik Poll. USENIX Security Symposium, 2015

307 citations recorded by the source corpus.

View Paper: https://www.semanticscholar.org/paper/82cd1e7619f076c29dbee77634ebc57e6d0ceefe

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

Citations in the corpus

Key Reinstallation Attacks: Forcing Nonce Reuse in WPA2 (2017, background): “As a result, recent attacks on TLS also affect these mechanisms, examples being [10, 14, 15, 27, 62].”
Fuzzing: A Survey for Roadmap (2022, background): “Due to the complexity of protocols, fuzzers usually infer the state machine by gradually adding new states into the state machine [55, 61, 64, 69, 154].”
The Art, Science, and Engineering of Fuzzing: A Survey (2018, unknown): “[187] ✓ TLS-Attacker [203] ✓ zuff [107] ✓ FLAX [189] +# ✓ ✓ ✓ IoTFuzzer [57] +# ✓ ✓ SymFuzz [55] +# ✓ ✓ ✓ AFL [241] H# ✓ ✓ ✓ ✓ ✓ ✓”
HVLearn: Automated Black-Box Analysis of Hostname Verification in SSL/TLS Implementations (2017, methodology): “Automata learning algorithms have been applied to infer models for various protocols such as EMV bank cards [29], electronic passports [30], TLS protocols [41] and TCP/IP implementations [47], [48].”
SFADiff: Automated Evasion Attacks and Fingerprinting Using Black-box Differential Automata Learning (2016, methodology): “The L∗ algorithm and variations has being used extensively for inferring models of protocols such as the TLS protocol [26], security protocols of EMV bank cards [2] and electronic passport protocols [3].”
AFLNET: A Greybox Fuzzer for Network Protocols (2020, background): “In terms of state machine inferencing, we can distinguish passive learning approaches [23], [24] that learn the protocol state machine from a corpus of message sequences and active learning approaches [25]– [27] that leverage Angluin’s L∗ algorithm to actively query the protocol implementations with”