Later archive addition

HVLearn: Automated Black-box Analysis of Hostname Verification in SSL/TLS Implementations

Suphannee Sivakorn, George Argyros, Kexin Pei, Angelos D. Keromytis and Suman Jana

HVLearn learns a finite automaton of exactly which hostnames each SSL/TLS library accepts for a given certificate common name, then compares those models across implementations and against RFC-derived rules. The disagreements expose eight specification violations in OpenSSL, GnuTLS, MatrixSSL, JSSE and others, several letting a man-in-the-middle present a certificate the client wrongly accepts.

Record

Researcher

Suphannee Sivakorn, George Argyros, Kexin Pei, Angelos D. Keromytis and Suman Jana

Format

Whitepaper

In the archive

• Added to the 2016–17 archive after the original list was published

Tags

• parser-differential
• tls
• https
• auth-bypass
• formal-analysis
• dynamic-analysis
• tooling
• owasp-a01-2021
• owasp-a02-2021

This page is the archive's own catalogue record. The research is the work of Suphannee Sivakorn, George Argyros, Kexin Pei, Angelos D. Keromytis and Suman Jana, first published at the original source. Preserved copies are kept so the citation survives its host.