Research on SSL/TLS Security Differences Based on RFC Documents
Ziqiu Zheng, Xuejun Li, He Wang, Gaofei Wu, Yuqing Zhang · 2024
The RFC standard document provides a detailed description of how a system is designed and correctly used to maintain security. The document itself may already contain information for predicting the existence of certain security issues. RFCdiff is a tool that uses NLP technology to automatically extract rules from RFC documents, identify differences and assess their compliance with RFC specifications. Through evaluations of well-known TLS implementation libraries such as OpenSSL, mbedTLS, GnuTLS, and WolfSSL, total of 56 security issues due to differences were identified. This research offers a valuable reference for potential issues in the implementation of SSL/TLS.