Analysis of DTLS Implementations Using Protocol State Fuzzing

Recent years have witnessed an increasing number of protocols relying on UDP. Compared to TCP, UDP offers performance advantages such as simplicity and lower latency. This has motivated its adoption in Voice over IP, tunneling technologies, IoT, and novel Web protocols. To protect sensitive data exchange in these scenarios, the DTLS protocol has been developed as a cryptographic variation of TLS. DTLS's main challenge is to support the stateless and unreliable transport of UDP. This has forced protocol designers to make choices that affect the complexity of DTLS, and to incorporate features that need not be addressed in the numerous TLS analyses. We present the first comprehensive analysis of DTLS implementations using protocol state fuzzing. To that end, we extend TLS-Attacker, an open source framework for analyzing TLS implementations, with support for DTLS tailored to the stateless and unreliable nature of the underlying UDP layer. We build a framework for applying protocol state fuzzing on DTLS servers, and use it to learn state machine models for thirteen DTLS implementations. Analysis of the learned state models reveals four serious security vulnerabilities, including a full client authentication bypass in the latest JSSE version, as well as several functional bugs and non-conformance issues. It also uncovers considerable differences between the models, confirming the complexity of DTLS state machines. Name Version Utility Algorithms Client Cert Auth URL GnuTLS 3.5.19 gnutls-serv DH,ECDH,RSA,PSK NONE,REQ,OPT https://www.gnutls.org 3.6.7 DH,ECDH,RSA,PSK NONE ,REQ ,OPT JSSE 9.0.4 -DH,ECDH,RSA NONE,REQ ,OPT https://www.oracle.com/java/ 12.0.2 DH ,ECDH ,RSA NONE ,REQ ,OPT MbedTLS 2.16.1 ssl-server2 DH,ECDH,RSA,PSK NONE ,REQ ,OPT https://tls.mbed.org NSS 3.46 tstclnt DH,ECDH,RSA NONE ,REQ,OPT https://nss-crypto.org OpenSSL 1.1.1b openssl s _ server DH,ECDH,RSA,PSK NONE ,REQ ,OPT https://www.openssl.org PionDTLS e4481fc -ECDH ,PSK NONE ,REQ ,OPT https://github.com/pion/dtls Scandium old c7895c6 -ECDH ,PSK NONE ,REQ ,OPT https://www.eclipse.org/californium/ Scandium new 6979a09 ECDH ,PSK NONE ,REQ ,OPT TinyDTLS C 53a0d97 dtls-server ECDH ,PSK NONE ,REQ https://github.com/contiki-ng/tinydtls