Abstract
This paper presents the experience of verifying server implementations of the TLS cryptographic protocol version 1.3. TLS is a widely used cryptographic protocol designed to create secure data transmission channels and provides the necessary functionality for this: confidentiality of the transmitted data, data integrity, and authentication of the parties. The new version 1.3 of the TLS protocol was introduced in August 2018 and has a number of significant differences compared to the previous version 1.2. A number of TLS developers have already included support for the latest version in their implementations. These circumstances make it relevant to do research in the field of verification and security of the new TLS protocol implementations. We used a new test suite for verifying implementations of the TLS 1.3 for compliance with Internet specifications, developed on the basis of the RFC8446, using UniTESK technology and mutation testing methods. The current work is part of the TLS 1.3 protocol verification project and covers some of the additional functionality and optional protocol extensions. To test implementations for compliance with formal specifications, UniTESK technology is used, which provides testing automation tools based on the use of finite state machines. The states of the system under test define the states of the state machine, and the test effects are the transitions of this machine. When performing a transition, the specified impact is passed to the implementation under test, after which the implementation's reactions are recorded and a verdict is automatically made on the compliance of the observed behavior with the specification. Mutational testing methods are used to detect non-standard behavior of the system under test by transmitting incorrect data. Some changes are made to the protocol exchange flow created in accordance with the specification: either the values of the message fields formed on the basis of the developed protocol model are changed, or the order of messages in the exchange flow is changed. The protocol model allows one to make changes to the data flow at any stage of the network exchange, which allows the test scenario to pass through all the significant states of the protocol and in each such state to test the implementation in accordance with the specified program. So far, several implementations have been found to deviate from the specification. The presented approach has proven effective in several of our projects when testing network protocols, providing detection of various deviations from the specification and other errors.
Highlights
This paper presents the experience of verifying server implementations of the Transport Layer Security (TLS) cryptographic protocol version 1.3
The new version 1.3 of the TLS protocol was introduced in August 2018 and has a number of significant differences compared to the previous version 1.2
To test implementations for compliance with formal specifications, UniTESK technology is used, which provides testing automation tools based on the use of finite state machines
Summary
Отправляемые после фазы обмена ключами (т. е. после сообщения Server Hello), зашифрованы соответствующими ключами. TLS1.3 позволяет использовать сокращенный режим рукопожатия с использованием заранее распределенных ключей (pre-sharedkey, PSK) [2]. Для этого используются так называемые удостоверения (tickets) и сообщение New Session Ticket, которое отправляется сервером клиенту в любое время после завершения сеанса рукопожатия и может использоваться в следующих соединениях. Сообщений New Session Ticket может быть несколько, каждое содержит одно удостоверение (ticket), которое с одной стороны используется для формирования нового ключа PSK, с другой – является уникальным идентификатором этого ключа. Расширение “post_handshake_auth” добавлено в TLS 1.3 и используется для указания того, что клиент хочет выполнить аутентификацию после рукопожатия [2]. Такая функциональность протокола может также использоваться и для режима рукопожатия PSK, во время которого сертификаты не используются, но зато после завершения рукопожатия можно запросить сертификат клиента (если ранее клиент включил расширение “post_handshake_auth” в сообщение Client Hello)
Talk to us
Join us for a 30 min session where you can share your feedback and ask us any queries you have