Compiling symbolic attacks to protocol implementation tests - Inria - Institut national de recherche en sciences et technologies du numérique Accéder directement au contenu
Communication Dans Un Congrès Année : 2013

Compiling symbolic attacks to protocol implementation tests

Résumé

Recently efficient model-checking tools have been developed to find flaws in security protocols specifications. These flaws can be interpreted as potential attacks scenarios but the feasability of these scenarios need to be confirmed at the implementation level. However, bridging the gap between an abstract attack scenario derived from a specification and a penetration test on real implementations of a protocol is still an open issue. This work investigates an architecture for automatically generating abstract attacks and converting them to concrete tests on protocol implementations. In particular we aim to improve previously proposed blackbox testing methods in order to discover automatically new attacks and vulnerabilities. As a proof of concept we have experimented our proposed architecture to detect a renegotiation vulnerability on some implementations of SSL/TLS, a protocol widely used for securing electronic transactions.
Nous proposons une méthode permettant de transformer des attaques abstraites obtenues par des outils de vérification en scénarios de test exécutables sur des implantations de protocoles.

Dates et versions

hal-00915320 , version 1 (07-12-2013)

Identifiants

Citer

Hatem Ghabri, Ghazi Maatoug, Michael Rusinowitch. Compiling symbolic attacks to protocol implementation tests. Fourth International Symposium on Symbolic Computation in Software Science, Adel Bouhoula and Tetsuo Ida and Fairouz Kamareddine, Dec 2012, Tunis, Tunisia. ⟨10.4204/EPTCS.122.4⟩. ⟨hal-00915320⟩
98 Consultations
0 Téléchargements

Altmetric

Partager

Gmail Facebook X LinkedIn More