Systematic parsing of X.509: Eradicating security issues with a parse tree

Abstract

X.509 certificate parsing and validation is a critical task which has shown consistent lack of effectiveness, with practical attacks being reported with a steady rate during the last 10 years. In this work we analyze the X.509 standard and provide a grammar description of it amenable to the automated generation of a parser with strong termination guarantees, providing unambiguous input parsing. We report the results of analyzing a 11M X.509 certificate dump of the HTTPS servers running on the entire IPv4 space, showing that 21.5% of the certificates in use are syntactically invalid. We compare the results of our parsing against 7 widely used TLS libraries showing that 631k to 1, 156k syntactically incorrect certificates are deemed valid by them (5.7%-10.5%), including instances with security critical mis-parsings. We prove the criticality of such mis-parsing exploiting one of the syntactic flaws found in existing certificates to perform an impersonation attack.SYSTEMATIC PARSING OF X.509 -DECEMBER 13, 2018 against the X.509 certificate validation have been pointed out for the last 10 years, leading to effective impersonations against TLS/SSL enabled software.Some among the most renown security issues involve certificates which are deemed valid to be binding a public key to the identity of a Certification Authority (CA), while such an information is contradicted either by the values contained in the certificate [29] or by misinterpretations in the subject name contained in it [30], both leading to effective impersonation of an arbitrary identity. More recently, in [23] it was shown that inconsistent validations were performed by different TLS libraries, due to integer overflows in the recognition of some X.509 certificate fields, providing ground for attacks. Broken certificates are common even among the Alexa top 1M visited sites [39], and the diversity in the Application Program Interface (API) exposed by the existing TLS/SSL libraries was proven a further source of security issues [16]. The latest among the reported issues on X.509 validation shows that, due to a misinterpretation issue of the encoding, it was effectively possible to get certificates with forged signatures accepted [12,11].An interesting point to be noted is that all the aforementioned issues do not stem from a cryptographic vulnerability of the employed primitives, but rather from a non systematic approach to the syntactic recognition of the certificate. Indeed, mainly due to the high complexity of the data format, no methodical approach at content format recognition and syntactic verification, i.e., parsing, has been either proposed or employed in the use of existing X.509 digital certificates. All the existing available implementations dealing with X.509 certificates employ ad-hoc handcrafted code to parse the certificate contents, in turn resulting in software artifacts which are difficult to test for correctness. A practical validation of such issue is reported in [7] where the authors employed a tool to generate pseudo-random X.509 certif...

Certificate Transparency Revisited: The Public Inspections on Third-party Monitors

“…Chen et al [7] introduced SBDT and discovered several bugs in certificate parsers by employing differential testing. Barenghi et al [3] showed that 21.5% of the X.509 certificates are syntactically incorrect and proposed a more secure approach for parsing X.509 certificates. Debnath et al [13] re-engineered the X.509 standard specification alleviating its design complexity, ambiguities, or under-specifications.…”

“…Cloudflare Monitoring, DigiCert Monitoring, EZMonitor, Hardenize and Report-URI provide only the subscription services and CT-Observatory was suspended in September 2018 3. Some monitors also use other name fields such as organization (O) and organizational unit (OU) as keywords 4.…”

Measurement techniques to understand how diversity in TLS implementations & deployments influences protocol security

“…Large body of prior research extends this line of work with the aim to improve the synthetic certificate generation process, including, but not limited to: Mucerts [20] that uses code coverage guidance, Coveringcerts [21] that uses combinatorial methods with theoretical guarantees, SymCerts [22] that adds symbolic execution, RFCcerts [23] that leverages certificate rules from protocol specification documents, Transcerts [24] that relies on coverage transfer graphs, NEZHA [25] that keeps track of behavioral asymmetries across multiple programs, and DRLgencert [26] that uses deep reinforcement learning to perform mutations on a certificate. Note that in contrast to these techniques that automatically generate synthetic certificates, Barenghi et al [27] work to first manually obtain a grammar for TLS certificates, and then build a parser to find legitimate issues in certificates that are missed by various implementations.…”