Compiling symbolic attacks to protocol implementation tests

Hatem Ghabri
(Sup Com, Tunis)
Ghazi Maatoug
(Sup Com, Tunis)
Michael Rusinowitch
(INRIA Nancy Grand Est)

Recently efficient model-checking tools have been developed to find flaws in security protocols specifications. These flaws can be interpreted as potential attacks scenarios but the feasability of these scenarios need to be confirmed at the implementation level. However, bridging the gap between an abstract attack scenario derived from a specification and a penetration test on real implementations of a protocol is still an open issue. This work investigates an architecture for automatically generating abstract attacks and converting them to concrete tests on protocol implementations. In particular we aim to improve previously proposed blackbox testing methods in order to discover automatically new attacks and vulnerabilities. As a proof of concept we have experimented our proposed architecture to detect a renegotiation vulnerability on some implementations of SSL/TLS, a protocol widely used for securing electronic transactions.

In Adel Bouhoula, Tetsuo Ida and Fairouz Kamareddine: Proceedings Fourth International Symposium on Symbolic Computation in Software Science (SCSS 2012), Gammarth, Tunisia, 15-17 December 2012, Electronic Proceedings in Theoretical Computer Science 122, pp. 39–49.
Published: 30th July 2013.

ArXived at: http://dx.doi.org/10.4204/EPTCS.122.4 bibtex PDF
References in reconstructed bibtex, XML and HTML format (approximated).
Comments and questions to: eptcs@eptcs.org
For website issues: webmaster@eptcs.org