{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,7,17]],"date-time":"2026-07-17T15:03:44Z","timestamp":1784300624188,"version":"3.55.0"},"reference-count":83,"publisher":"Association for Computing Machinery (ACM)","issue":"4","license":[{"start":{"date-parts":[[2019,10,9]],"date-time":"2019-10-09T00:00:00Z","timestamp":1570579200000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/www.acm.org\/publications\/policies\/copyright_policy#Background"}],"funder":[{"DOI":"10.13039\/501100001809","name":"NSFC","doi-asserted-by":"crossref","award":["61732013, 61420106004, and 61751207"],"award-info":[{"award-number":["61732013, 61420106004, and 61751207"]}],"id":[{"id":"10.13039\/501100001809","id-type":"DOI","asserted-by":"crossref"}]}],"content-domain":{"domain":["dl.acm.org"],"crossmark-restriction":true},"short-container-title":["ACM Trans. Softw. Eng. Methodol."],"published-print":{"date-parts":[[2019,10,31]]},"abstract":"<jats:p>Certificate validation in Secure Sockets Layer or Transport Layer Security protocol (SSL\/TLS) is critical to Internet security. Thus, it is significant to check whether certificate validation in SSL\/TLS implementations is correctly implemented. With this motivation, we propose a novel differential testing approach that is based on the standard Request for Comments (RFC). First, rules of certificates are extracted automatically from RFCs. Second, low-level test cases are generated through dynamic symbolic execution. Third, high-level test cases, i.e., certificates, are assembled automatically. Finally, with the assembled certificates being test cases, certificate validations in SSL\/TLS implementations are tested to reveal latent vulnerabilities or bugs. Our approach named RFCcert has the following advantages: (1) certificates of RFCcert are discrepancy-targeted, since they are assembled according to standards instead of genetics; (2) with the obtained certificates, RFCcert not only reveals the invalidity of traditional differential testing but also is able to conduct testing that traditional differential testing cannot do; and (3) the supporting tool of RFCcert has been implemented and extensive experiments show that the approach is effective in finding bugs of SSL\/TLS implementations. In addition, by providing seed certificates for mutation approaches with RFCcert, the ability of mutation approaches in finding distinct discrepancies is significantly enhanced.<\/jats:p>","DOI":"10.1145\/3355048","type":"journal-article","created":{"date-parts":[[2019,10,10]],"date-time":"2019-10-10T13:13:05Z","timestamp":1570713185000},"page":"1-37","update-policy":"https:\/\/doi.org\/10.1145\/crossmark-policy","source":"Crossref","is-referenced-by-count":26,"title":["Differential Testing of Certificate Validation in SSL\/TLS Implementations"],"prefix":"10.1145","volume":"28","author":[{"ORCID":"https:\/\/orcid.org\/0000-0002-5429-4580","authenticated-orcid":false,"given":"Cong","family":"Tian","sequence":"first","affiliation":[{"name":"ICTT and ISN Laboratory, Xidian University, Xi\u2019an, P.R. China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Chu","family":"Chen","sequence":"additional","affiliation":[{"name":"ICTT and ISN Laboratory, Xidian University, P.R. China and School of Information Science and Engineering, Qufu Normal University, Rizhao, Shandong, P.R. China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Zhenhua","family":"Duan","sequence":"additional","affiliation":[{"name":"ICTT and ISN Laboratory, Xidian University, Xi\u2019an, P.R. China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Liang","family":"Zhao","sequence":"additional","affiliation":[{"name":"ICTT and ISN Laboratory, Xidian University, Xi\u2019an, P.R. China"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"320","published-online":{"date-parts":[[2019,10,9]]},"reference":[{"key":"e_1_2_1_1_1","doi-asserted-by":"publisher","DOI":"10.1038\/nchem.2383"},{"key":"e_1_2_1_2_1","doi-asserted-by":"crossref","unstructured":"R. Barnes M. Thomson A. Pironti and A. Langley. 2015. Deprecating Secure Sockets Layer Version 3.0. Retrieved from https:\/\/tools.ietf.org\/html\/rfc7568.  R. Barnes M. Thomson A. Pironti and A. Langley. 2015. Deprecating Secure Sockets Layer Version 3.0. Retrieved from https:\/\/tools.ietf.org\/html\/rfc7568.","DOI":"10.17487\/RFC7568"},{"key":"e_1_2_1_3_1","doi-asserted-by":"publisher","DOI":"10.1093\/comjnl\/bxq042"},{"key":"e_1_2_1_4_1","doi-asserted-by":"crossref","unstructured":"K. Bhargavan A. Delignat-Lavaud A. Pironti A. Langley and M. Ray. 2015. Transport Layer Security (TLS) Session Hash and Extended Master Secret Extension. Retrieved from https:\/\/tools.ietf.org\/html\/rfc7627.  K. Bhargavan A. Delignat-Lavaud A. Pironti A. Langley and M. Ray. 2015. Transport Layer Security (TLS) Session Hash and Extended Master Secret Extension. Retrieved from https:\/\/tools.ietf.org\/html\/rfc7627.","DOI":"10.17487\/RFC7627"},{"key":"e_1_2_1_5_1","volume-title":"Proceedings of the ACM SIGSOFT International Symposium on Software Testing and Analysis (ISSTA\u201902)","author":"Boyapati C."},{"key":"e_1_2_1_6_1","doi-asserted-by":"crossref","unstructured":"S. Bradner. 1997. Key Words for Use in RFCs to Indicate Requirement Levels. Retrieved from https:\/\/tools.ietf.org\/html\/rfc2119.  S. Bradner. 1997. Key Words for Use in RFCs to Indicate Requirement Levels. Retrieved from https:\/\/tools.ietf.org\/html\/rfc2119.","DOI":"10.17487\/rfc2119"},{"key":"e_1_2_1_7_1","doi-asserted-by":"crossref","unstructured":"M. Brown and R. Housley. 2010. Transport Layer Security (TLS) Authorization Extensions. Retrieved from https:\/\/tools.ietf.org\/html\/rfc5878.  M. Brown and R. Housley. 2010. Transport Layer Security (TLS) Authorization Extensions. Retrieved from https:\/\/tools.ietf.org\/html\/rfc5878.","DOI":"10.17487\/rfc5878"},{"key":"e_1_2_1_8_1","volume-title":"Proceedings of the IEEE Symposium on Security and Privacy (SP\u201914)","author":"Brubaker C.","year":"2014"},{"key":"e_1_2_1_9_1","volume-title":"Proceedings of the 8th USENIX Conference on Operating Systems Design and Implementation (OSDI\u201908)","author":"Cadar C.","year":"1855"},{"key":"e_1_2_1_10_1","doi-asserted-by":"publisher","DOI":"10.1038\/nrm4014"},{"key":"e_1_2_1_11_1","volume-title":"Proceedings of the IEEE Symposium on Security and Privacy (SP\u201917)","author":"Chau S. Y.","year":"2017"},{"key":"e_1_2_1_12_1","volume-title":"Proceedings of the 10th Joint Meeting on Foundations of Software Engineering (ESEC\/FSE\u201915)","author":"Chen Y."},{"key":"e_1_2_1_13_1","volume-title":"Proceedings of the 16th International Conference on Architectural Support for Programming Languages and Operating Systems (ASPLOS\u201911)","author":"Chipounov V.","year":"1950"},{"key":"e_1_2_1_14_1","doi-asserted-by":"publisher","DOI":"10.1145\/2110356.2110358"},{"key":"e_1_2_1_15_1","doi-asserted-by":"crossref","unstructured":"S. Chokhani and W. Ford. 1999. Internet X.509 Public Key Infrastructure Certificate Policy and Certification Practices Framework. Retrieved from https:\/\/tools.ietf.org\/html\/rfc2527.  S. Chokhani and W. Ford. 1999. Internet X.509 Public Key Infrastructure Certificate Policy and Certification Practices Framework. Retrieved from https:\/\/tools.ietf.org\/html\/rfc2527.","DOI":"10.17487\/rfc2527"},{"key":"e_1_2_1_16_1","doi-asserted-by":"crossref","unstructured":"D. Cooper S. Santesson S. Farrell S. Boeyen R. Housley and W. Polk. 2008. Internet X.509 Public Key Infrastructure Certificate and Certificate Revocation List (CRL) Profile. Retrieved from https:\/\/tools.ietf.org\/html\/rfc5280.  D. Cooper S. Santesson S. Farrell S. Boeyen R. Housley and W. Polk. 2008. Internet X.509 Public Key Infrastructure Certificate and Certificate Revocation List (CRL) Profile. Retrieved from https:\/\/tools.ietf.org\/html\/rfc5280.","DOI":"10.17487\/rfc5280"},{"key":"e_1_2_1_17_1","volume-title":"Proceedings of the Workshop on New Security Paradigms (NSPW\u201908)","author":"Crandall J. R."},{"key":"e_1_2_1_18_1","volume-title":"Proceedings of the 6th Joint Meeting of the European Software Engineering Conference and the ACM SIGSOFT Symposium on The Foundations of Software Engineering (ESEC\/FSE\u201907)","author":"Daniel B."},{"key":"e_1_2_1_19_1","doi-asserted-by":"crossref","unstructured":"T. Dierks and E. Rescorla. 2008. The Transport Layer Security (TLS) Protocol Version 1.2. Retrieved from https:\/\/tools.ietf.org\/html\/rfc5246.  T. Dierks and E. Rescorla. 2008. The Transport Layer Security (TLS) Protocol Version 1.2. Retrieved from https:\/\/tools.ietf.org\/html\/rfc5246.","DOI":"10.17487\/rfc5246"},{"key":"e_1_2_1_20_1","doi-asserted-by":"crossref","unstructured":"R. Fielding J. Gettys J. Mogul H. Frystyk and T. Berners-Lee. 1997. Hypertext Transfer Protocol\u2014HTTP\/1.1. Retrieved from https:\/\/tools.ietf.org\/html\/rfc2068.  R. Fielding J. Gettys J. Mogul H. Frystyk and T. Berners-Lee. 1997. Hypertext Transfer Protocol\u2014HTTP\/1.1. Retrieved from https:\/\/tools.ietf.org\/html\/rfc2068.","DOI":"10.17487\/rfc2068"},{"key":"e_1_2_1_21_1","doi-asserted-by":"crossref","unstructured":"R. Fielding J. Gettys J. Mogul H. Frystyk L. Masinter P. Leach and T. Berners-Lee. 1999. Hypertext Transfer Protocol\u2014HTTP\/1.1. Retrieved from https:\/\/tools.ietf.org\/html\/rfc2616.  R. Fielding J. Gettys J. Mogul H. Frystyk L. Masinter P. Leach and T. Berners-Lee. 1999. Hypertext Transfer Protocol\u2014HTTP\/1.1. Retrieved from https:\/\/tools.ietf.org\/html\/rfc2616.","DOI":"10.17487\/rfc2616"},{"key":"e_1_2_1_22_1","unstructured":"OpenBSD Foundation. 2016. LibreSSL. Retrieved from http:\/\/www.libressl.org.  OpenBSD Foundation. 2016. LibreSSL. Retrieved from http:\/\/www.libressl.org."},{"key":"e_1_2_1_23_1","unstructured":"OpenSSL Software Foundation. 2016. OpenSSL. Retrieved from https:\/\/www.openssl.org.  OpenSSL Software Foundation. 2016. OpenSSL. Retrieved from https:\/\/www.openssl.org."},{"key":"e_1_2_1_24_1","doi-asserted-by":"crossref","unstructured":"A. Freier P. Karton and P. Kocher. 2011. The Secure Sockets Layer (SSL) Protocol Version 3.0. Retrieved from https:\/\/tools.ietf.org\/html\/rfc6101.  A. Freier P. Karton and P. Kocher. 2011. The Secure Sockets Layer (SSL) Protocol Version 3.0. Retrieved from https:\/\/tools.ietf.org\/html\/rfc6101.","DOI":"10.17487\/rfc6101"},{"key":"e_1_2_1_25_1","volume-title":"Proceedings of the ACM Conference on Computer and Communications Security (CCS\u201912)","author":"Georgiev M."},{"key":"e_1_2_1_26_1","doi-asserted-by":"crossref","unstructured":"D. Gillmor. 2016. Negotiated Finite Field Diffie-Hellman Ephemeral Parameters for Transport Layer Security (TLS). Retrieved from https:\/\/tools.ietf.org\/html\/rfc7919.  D. Gillmor. 2016. Negotiated Finite Field Diffie-Hellman Ephemeral Parameters for Transport Layer Security (TLS). Retrieved from https:\/\/tools.ietf.org\/html\/rfc7919.","DOI":"10.17487\/RFC7919"},{"key":"e_1_2_1_27_1","volume-title":"Proceedings of the ACM SIGPLAN Conference on Programming Language Design and Implementation (PLDI\u201905)","author":"Godefroid P."},{"key":"e_1_2_1_28_1","volume-title":"Proceedings of the 16th Annual Network 8 Distributed System Security Symposium. The Internet Society","author":"Godefroid P."},{"key":"e_1_2_1_29_1","doi-asserted-by":"publisher","DOI":"10.1145\/2090147.2094081"},{"key":"e_1_2_1_30_1","unstructured":"Google. 2016. BoringSSL. Retrieved from https:\/\/boringssl.googlesource.com\/boringssl\/.  Google. 2016. BoringSSL. Retrieved from https:\/\/boringssl.googlesource.com\/boringssl\/."},{"key":"e_1_2_1_31_1","unstructured":"Google. 2016. Chrome. Retrieved from https:\/\/www.google.com\/chrome\/.  Google. 2016. Chrome. Retrieved from https:\/\/www.google.com\/chrome\/."},{"key":"e_1_2_1_32_1","volume-title":"Proceedings of the 9th International Symposium on Haskell (Haskell\u201916)","author":"Grieco G."},{"key":"e_1_2_1_33_1","doi-asserted-by":"publisher","DOI":"10.1145\/1459352.1459354"},{"key":"e_1_2_1_34_1","volume-title":"Proceedings of the 25th USENIX Security Symposium (USENIXSecurity\u201916)","author":"Jana S."},{"key":"e_1_2_1_35_1","volume-title":"Proceedings of the 14th International Conference on Financial Cryptography and Data Security (FC\u201910)","author":"Kaminsky D."},{"key":"e_1_2_1_36_1","volume-title":"Proceedings of the 18th IFIP TC6\/WG6.1 International Conference on Testing of Communicating Systems (TestCom\u201906)","author":"L\u00e4mmel R."},{"key":"e_1_2_1_37_1","doi-asserted-by":"crossref","unstructured":"A. Langley. 2015. A Transport Layer Security (TLS) ClientHello Padding Extension. Retrieved from https:\/\/tools.ietf.org\/html\/rfc7685.  A. Langley. 2015. A Transport Layer Security (TLS) ClientHello Padding Extension. Retrieved from https:\/\/tools.ietf.org\/html\/rfc7685.","DOI":"10.17487\/RFC7685"},{"key":"e_1_2_1_38_1","doi-asserted-by":"crossref","unstructured":"A. Langley W. Chang N. Mavrogiannopoulos J. Strombergson and S. Josefsson. 2016. ChaCha20-Poly1305 Cipher Suites for Transport Layer Security (TLS). Retrieved from https:\/\/tools.ietf.org\/html\/rfc7905.  A. Langley W. Chang N. Mavrogiannopoulos J. Strombergson and S. Josefsson. 2016. ChaCha20-Poly1305 Cipher Suites for Transport Layer Security (TLS). Retrieved from https:\/\/tools.ietf.org\/html\/rfc7905.","DOI":"10.17487\/RFC7905"},{"key":"e_1_2_1_39_1","unstructured":"B. Leiba. 2017. Ambiguity of Uppercase vs Lowercase in RFC 2119 Key Words. Retrieved from https:\/\/tools.ietf.org\/html\/rfc8174.  B. Leiba. 2017. Ambiguity of Uppercase vs Lowercase in RFC 2119 Key Words. Retrieved from https:\/\/tools.ietf.org\/html\/rfc8174."},{"key":"e_1_2_1_40_1","unstructured":"ARM Limited. 2016. mbedTLS. Retrieved from https:\/\/tls.mbed.org.  ARM Limited. 2016. mbedTLS. Retrieved from https:\/\/tls.mbed.org."},{"key":"e_1_2_1_41_1","unstructured":"LLVM. 2017. libFuzzer. Retrieved from https:\/\/chromium.googlesource.com\/chromium\/llvm-project\/llvm\/lib\/Fuzzer.  LLVM. 2017. libFuzzer. Retrieved from https:\/\/chromium.googlesource.com\/chromium\/llvm-project\/llvm\/lib\/Fuzzer."},{"key":"e_1_2_1_42_1","volume-title":"Proceedings of the 16th IEEE International Conference on Automated Software Engineering (ASE\u201901)","author":"Marinov D.","year":"2023"},{"key":"e_1_2_1_43_1","unstructured":"M Marlinspike. 2002. IE SSL Vulnerability. Retrieved from https:\/\/www.thoughtcrime.org\/ie-ssl-chain.txt.  M Marlinspike. 2002. IE SSL Vulnerability. Retrieved from https:\/\/www.thoughtcrime.org\/ie-ssl-chain.txt."},{"key":"e_1_2_1_44_1","unstructured":"M. Marlinspike. 2009. More Tricks for Defeating SSL in Practice. Retrieved from https:\/\/www.blackhat.com\/presentations\/bh-dc-09\/Marlinspike\/BlackHat-DC-09-Marlinspike-Defeating-SSL.pdf.  M. Marlinspike. 2009. More Tricks for Defeating SSL in Practice. Retrieved from https:\/\/www.blackhat.com\/presentations\/bh-dc-09\/Marlinspike\/BlackHat-DC-09-Marlinspike-Defeating-SSL.pdf."},{"key":"e_1_2_1_45_1","unstructured":"M. Marlinspike. 2009. New Tricks for Defeating SSL in Practice. Retrieved from https:\/\/www.blackhat.com\/presentations\/bh-usa-09\/Marlinspike\/BHUSA09-Marlinspike-DefeatSSL-SLIDES.pdf.  M. Marlinspike. 2009. New Tricks for Defeating SSL in Practice. Retrieved from https:\/\/www.blackhat.com\/presentations\/bh-usa-09\/Marlinspike\/BHUSA09-Marlinspike-DefeatSSL-SLIDES.pdf."},{"key":"e_1_2_1_46_1","unstructured":"M. Marlinspike. 2009. Null Prefix Attacks against SSL\/TLS Certificates. Retrieved from https:\/\/www.thoughtcrime.org\/papers\/null-prefix-attackes.pdf.  M. Marlinspike. 2009. Null Prefix Attacks against SSL\/TLS Certificates. Retrieved from https:\/\/www.thoughtcrime.org\/papers\/null-prefix-attackes.pdf."},{"key":"e_1_2_1_47_1","doi-asserted-by":"publisher","DOI":"10.1109\/52.56422"},{"key":"e_1_2_1_48_1","unstructured":"N. Mavrogiannopoulos. 2016. GnuTLS. Retrieved from https:\/\/www.gnutls.org.  N. Mavrogiannopoulos. 2016. GnuTLS. Retrieved from https:\/\/www.gnutls.org."},{"key":"e_1_2_1_49_1","unstructured":"Microsoft. 2016. Internet Explorer. Retrieved from https:\/\/www.microsoft.com\/en-us\/download\/internet-explorer.aspx.  Microsoft. 2016. Internet Explorer. Retrieved from https:\/\/www.microsoft.com\/en-us\/download\/internet-explorer.aspx."},{"key":"e_1_2_1_50_1","doi-asserted-by":"crossref","unstructured":"B. Moeller and A. Langley. 2015. TLS Fallback Signaling Cipher Suite Value (SCSV) for Preventing Protocol Downgrade Attacks. Retrieved from https:\/\/tools.ietf.org\/html\/rfc7507.  B. Moeller and A. Langley. 2015. TLS Fallback Signaling Cipher Suite Value (SCSV) for Preventing Protocol Downgrade Attacks. Retrieved from https:\/\/tools.ietf.org\/html\/rfc7507.","DOI":"10.17487\/RFC7507"},{"key":"e_1_2_1_51_1","unstructured":"Mozilla. 2016. Firefox. Retrieved from https:\/\/www.mozilla.org\/en-US\/firefox\/all\/.  Mozilla. 2016. Firefox. Retrieved from https:\/\/www.mozilla.org\/en-US\/firefox\/all\/."},{"key":"e_1_2_1_52_1","unstructured":"Mozilla. 2016. NSS. Retrieved from https:\/\/developer.mozilla.org\/en-US\/docs\/Mozilla\/Projects\/NSS\/NSS_Releases.  Mozilla. 2016. NSS. Retrieved from https:\/\/developer.mozilla.org\/en-US\/docs\/Mozilla\/Projects\/NSS\/NSS_Releases."},{"key":"e_1_2_1_53_1","unstructured":"NIST. 2017. CVE-2016-8495. Retrieved from https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2016-8495.  NIST. 2017. CVE-2016-8495. Retrieved from https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2016-8495."},{"key":"e_1_2_1_54_1","volume-title":"Proceedings of the 22nd ACM SIGPLAN Conference on Object-oriented Programming Systems and Applications (OOPSLA\u201907)","author":"Pacheco C."},{"key":"e_1_2_1_55_1","volume-title":"Proceedings of the International Symposium on Software Testing and Analysis (ISSTA\u201908)","author":"Pacheco C."},{"key":"e_1_2_1_56_1","doi-asserted-by":"publisher","DOI":"10.1109\/ICSE.2007.37"},{"key":"e_1_2_1_57_1","volume-title":"Proceedings of the 34th International Conference on Software Engineering (ICSE\u201912)","author":"Pandita R."},{"key":"e_1_2_1_58_1","volume-title":"Proceedings of the IEEE Symposium on Security and Privacy (SP\u201917)","author":"Petsios T.","year":"2017"},{"key":"e_1_2_1_59_1","unstructured":"T. Petsios A. Tang S. Stolfo A. D. Keromytis and S. Jana. 2017. NEZHA v0.1. Retrieved from https:\/\/github.com\/nezha-dt\/nezha\/tree\/v0.1.  T. Petsios A. Tang S. Stolfo A. D. Keromytis and S. Jana. 2017. NEZHA v0.1. Retrieved from https:\/\/github.com\/nezha-dt\/nezha\/tree\/v0.1."},{"key":"e_1_2_1_60_1","doi-asserted-by":"crossref","unstructured":"A. Popov. 2015. Prohibiting RC4 Cipher Suites. Retrieved from https:\/\/tools.ietf.org\/html\/rfc7465.  A. Popov. 2015. Prohibiting RC4 Cipher Suites. Retrieved from https:\/\/tools.ietf.org\/html\/rfc7465.","DOI":"10.17487\/rfc7465"},{"key":"e_1_2_1_61_1","doi-asserted-by":"crossref","unstructured":"E. Rescorla. 2000. HTTP Over TLS. Retrieved from https:\/\/tools.ietf.org\/html\/rfc2818.  E. Rescorla. 2000. HTTP Over TLS. Retrieved from https:\/\/tools.ietf.org\/html\/rfc2818.","DOI":"10.17487\/rfc2818"},{"key":"e_1_2_1_62_1","doi-asserted-by":"crossref","unstructured":"E. Rescorla M. Ray S. Dispensa and N. Oskov. 2010. Transport Layer Security (TLS) Renegotiation Indication Extension. Retrieved from https:\/\/tools.ietf.org\/html\/rfc5746.  E. Rescorla M. Ray S. Dispensa and N. Oskov. 2010. Transport Layer Security (TLS) Renegotiation Indication Extension. Retrieved from https:\/\/tools.ietf.org\/html\/rfc5746.","DOI":"10.17487\/rfc5746"},{"key":"e_1_2_1_63_1","doi-asserted-by":"crossref","unstructured":"P. Saint-Andre and J. Hodges. 2011. Representation and Verification of Domain-based Application Service Identity within Internet Public Key Infrastructure Using X.509 (PKIX) Certificates in the Context of Transport Layer Security (TLS). Retrieved from https:\/\/tools.ietf.org\/html\/rfc6125.  P. Saint-Andre and J. Hodges. 2011. Representation and Verification of Domain-based Application Service Identity within Internet Public Key Infrastructure Using X.509 (PKIX) Certificates in the Context of Transport Layer Security (TLS). Retrieved from https:\/\/tools.ietf.org\/html\/rfc6125.","DOI":"10.17487\/rfc6125"},{"key":"e_1_2_1_64_1","unstructured":"Inside Secure. 2016. matrixSSL. Retrieved from http:\/\/www.matrixssl.org.  Inside Secure. 2016. matrixSSL. Retrieved from http:\/\/www.matrixssl.org."},{"key":"e_1_2_1_65_1","volume-title":"Proceedings of the 18th International Conference on Computer Aided Verification (CAV\u201906)","author":"Sen K.","year":"1817"},{"key":"e_1_2_1_66_1","volume-title":"Proceedings of the 2nd Conference on Domain-specific Languages (DSL\u201999)","author":"Sirer E. G.","year":"1960"},{"key":"e_1_2_1_67_1","volume-title":"Proceedings of the IEEE Symposium on Security and Privacy (SP\u201917)","author":"Sivakorn S.","year":"2017"},{"key":"e_1_2_1_68_1","volume-title":"Proceedings of the 30th Annual Computer Security Applications Conference (ACSAC\u201914)","author":"Slankas J."},{"key":"e_1_2_1_69_1","doi-asserted-by":"publisher","DOI":"10.1145\/2976749.2978411"},{"key":"e_1_2_1_70_1","volume-title":"Proceedings of the 4th International Conference on Information Systems Security (ICISS\u201908)","author":"Song D."},{"key":"e_1_2_1_71_1","volume-title":"Fuzzing: Brute Force Vulnerability Discovery","author":"Sutton M.","year":"2007"},{"key":"e_1_2_1_72_1","doi-asserted-by":"crossref","unstructured":"S. Turner and T. Polk. 2011. Prohibiting Secure Sockets Layer (SSL) Version 2.0. Retrieved from https:\/\/tools.ietf.org\/html\/rfc6176.  S. Turner and T. Polk. 2011. Prohibiting Secure Sockets Layer (SSL) Version 2.0. Retrieved from https:\/\/tools.ietf.org\/html\/rfc6176.","DOI":"10.17487\/rfc6176"},{"key":"e_1_2_1_73_1","doi-asserted-by":"crossref","unstructured":"A. Walz and A. Sikora. 2018. Exploiting dissent: Towards fuzzing-based differential black box testing of TLS implementations. IEEE Trans. Depend. Secure Comput. (2018) 1--14. DOI:https:\/\/doi.org\/10.1109\/TDSC.2017.2763947  A. Walz and A. Sikora. 2018. Exploiting dissent: Towards fuzzing-based differential black box testing of TLS implementations. IEEE Trans. Depend. Secure Comput. (2018) 1--14. DOI:https:\/\/doi.org\/10.1109\/TDSC.2017.2763947","DOI":"10.1109\/TDSC.2017.2763947"},{"key":"e_1_2_1_74_1","volume-title":"Proceedings of the International Carnahan Conference on Security Technology (ICCST\u201918)","author":"Walz A.","year":"2018"},{"key":"e_1_2_1_75_1","unstructured":"wolfSSL Inc. 2016. wolfSSL. Retrieved from https:\/\/www.wolfssl.com.  wolfSSL Inc. 2016. wolfSSL. Retrieved from https:\/\/www.wolfssl.com."},{"key":"e_1_2_1_76_1","volume-title":"Proceedings of the ACM SIGSOFT 20th International Symposium on the Foundations of Software Engineering (FSE\u201912)","author":"Xiao X."},{"key":"e_1_2_1_78_1","volume-title":"Proceedings of the IEEE Symposium on Security and Privacy (SP\u201914)","author":"Yamaguchi F.","year":"2014"},{"key":"e_1_2_1_79_1","volume-title":"Proceedings of the 5th USENIX Conference on Offensive Technologies (WOOT\u201911)","author":"Yamaguchi F.","year":"2028"},{"key":"e_1_2_1_80_1","volume-title":"Proceedings of the 28th Annual Computer Security Applications Conference (ACSAC\u201912)","author":"Yamaguchi F.","year":"2095"},{"key":"e_1_2_1_81_1","volume-title":"Proceedings of the IEEE Symposium on Security and Privacy (SP\u201915)","author":"Yamaguchi F.","year":"2015"},{"key":"e_1_2_1_82_1","volume-title":"Proceedings of the ACM SIGSAC Conference on Computer and Communications Security (CCS\u201913)","author":"Yamaguchi F."},{"key":"e_1_2_1_83_1","volume-title":"Proceedings of the 32nd ACM SIGPLAN Conference on Programming Language Design and Implementation (PLDI\u201911)","author":"Yang X.","year":"1993"},{"key":"e_1_2_1_84_1","doi-asserted-by":"crossref","unstructured":"P. Yee. 2013. Updates to the Internet X.509 Public Key Infrastructure Certificate and Certificate Revocation List (CRL) Profile. Retrieved from https:\/\/tools.ietf.org\/html\/rfc6818.  P. Yee. 2013. Updates to the Internet X.509 Public Key Infrastructure Certificate and Certificate Revocation List (CRL) Profile. Retrieved from https:\/\/tools.ietf.org\/html\/rfc6818.","DOI":"10.17487\/rfc6818"}],"container-title":["ACM Transactions on Software Engineering and Methodology"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3355048","content-type":"unspecified","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/3355048","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,6,18]],"date-time":"2025-06-18T00:26:13Z","timestamp":1750206373000},"score":1,"resource":{"primary":{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3355048"}},"subtitle":["An RFC-guided Approach"],"short-title":[],"issued":{"date-parts":[[2019,10,9]]},"references-count":83,"journal-issue":{"issue":"4","published-print":{"date-parts":[[2019,10,31]]}},"alternative-id":["10.1145\/3355048"],"URL":"https:\/\/doi.org\/10.1145\/3355048","relation":{},"ISSN":["1049-331X","1557-7392"],"issn-type":[{"value":"1049-331X","type":"print"},{"value":"1557-7392","type":"electronic"}],"subject":[],"published":{"date-parts":[[2019,10,9]]},"assertion":[{"value":"2018-08-01","order":0,"name":"received","label":"Received","group":{"name":"publication_history","label":"Publication History"}},{"value":"2019-07-01","order":1,"name":"accepted","label":"Accepted","group":{"name":"publication_history","label":"Publication History"}},{"value":"2019-10-09","order":2,"name":"published","label":"Published","group":{"name":"publication_history","label":"Publication History"}}]}}