X.509 certificates are used in TLS connections to verify the identity of clients and servers. To this end, clients and servers have to check whether a certificate is valid and correctly signed. This makes X.509 certificates an important target for advanced testing. As for TLS, we already built a framework for combinatorial testing of X.509 certificates, called X.509 Anvil. Your task will be to extend this framework. A possible direction:
More Test Templates [BA/MA]. Currently, we implemented 251 test templates from MUST and MUST NOT statements from RFC 5280. Your task will be to extend the existing test template testsuite by adding tests from other related RFCs. Possible RFCs include (but are not limited to) RFC 2313 and RFC 3279. The extended testsuite should then be evaluated against widely-used open-source TLS libraries such as OpenSSL and BoringSSL.
CA/Browser Forum Requirements [BA]. Similar to the testsuite extension above, this topic is about extending the test templates for the CA/Browser forum baseline requirements. In addition to RFCs, this set of guidelines is used by major browsers and TLS libraries. Oftentimes, libraries do not adhere to the RFC and instead following these guidelines, making it important to extend the testsuite for this. Your task will be to create the additional test templates and evaluate widely-used open-source TLS libraries against it.
What to bring:
- Programming Knowledge (Java)
- Interest in TLS/X.509
- Willingness to get used to Java Frameworks
What to gain:
- TLS-Anvil has been published on a Tier 1 conference for IT security and is part of an industry collaboration so you will be working on current research topics with a real world impact
