RFC-directed differential testing method of certificate validation in SSL/TLS implementations

A computer software analysis system comprising a hardware server and applying an Request For Comments (RFC)-directed differential testing method of a certificate validation in Secure Sockets Layer/Transport Layer Security (SSL/TLS) implementations, the method comprises the steps of:

• classifying rules;
• expressing the rules as variables;
• generating a first Certificate Authority certificate first-level test cases;
• generating a symbolic program, wherein generating the first Certificate Authority certificate first-level test cases by applying a dynamic symbolic execution technique to the symbolic program and assembling a second Certificate Authority certificate second-level test cases according to the first Certificate Authority certificate first-level test cases to obtain an assembled digital certificates, wherein the second Certificate Authority certificate second-level test cases are digital certificates;
• processing the symbolic program by using a DSE technology;
• saving the first Certificate Authority certificate first-level test cases produced by the Dynamic Symbolic Execution (DSE) as a text file by a redirection technology;
• reserving rule variables with non-zero values, replacing 2147483647 and −2147483648 with 1 and −1, respectively, for each text file, and deleting empty text files;
• setting a valid value for a basic component of the digital certificates;
• setting valid values for the components of basicConstraints and keyUsage if a certificate of a certification authority is being assembled;
• setting a value of a component in a condition part of the first Certificate Authority certificate first-level test cases according to a corresponding value requirement of the condition part;
• leaving a response part of the first Certificate Authority certificate first-level test cases for observation without any processing and setting a value required in violating a result part for a component in the result part of the first Certificate Authority certificate first-level test cases;
• signing tbsCertificate a signature by using a signature algorithm of signature in tbsCertificate if signatureAlgorithm has not been set yet;
• and encoding the certificate and saving it as a digital certificate file;
• assembling the second Certificate Authority certificate second-level cases according to the first Certificate Authority certificate first-level test cases to obtain the assembled digital certificates;
• and
• employing the assembled digital certificates to a differential testing of the certificate validation in SSL/TLS implementations;
• extracting the rules of a digital certificate from RFCs 5280 and 6818 according to a keyword set specified in RFC 2119 and updating rules of RFC 5280 according to RFC 6818 to obtain updated rules;
• classifying the updated rules into three categories:
• producer rules, consumer rules, and shared rules, further classifying the consumer rules and the shared rules into breakable rules and unbreakable rules, expressing the updated rules as variables, and generating the symbolic program;
• employing the assembled digital certificates to the differential testing of the certificate validation in SSL/TLS implementations and calculating a discrepancy number, a distinct discrepancy number, a bug number, and an RFC conformance ratio in test results based on information of the digital certificate;
• if RFCresult shows that an acceptance or rejection of the digital certificate are all in accordance with the RFC rules, then the discrepancy is invalid;
• if ResultIi (1≤i≤m) does not match with RFCresult, then a bug in SSL/TLS implementations is found, and RFCreason provides a reason for an occurrence of the bug;
• an RFC conformance ratio of the ith SSL/TLS implementation is calculated by the following formula:
• CR
• ⁡
• (
• i
• )
• =
• 
• RFCresult
• ⁢
• ⁢
• matches
• ⁢
• ⁢
• Result
• ⁢
• ⁢
• I
• i
• 
• 
• certs
• 
• ×
• 100
• ⁢
• %
• ,
• wherein |RFCresult matches ResultIi| is a number of results complying with the RFC in the test results, |certs| is a number of a vector {right arrow over (RFCcert)} in the testing, RFCcert is a number of vector in the testing for validation with an assigned value by the Certificate Authority.