Towards Internet-Based State Learning of TLS State Machines#
USENIX Security '25 (34th USENIX Security Symposium) digest Program Adjacent pick 13–15 August 2025
Marcel Maehren et al., Ruhr University Bochum; Paderborn University — Adjacent
- Why: Extends TLS state-machine learning (previously only usable in controlled local environments) to work across the real, noisy Internet at scale — a methodology advance more than a single vulnerability finding, though it did surface a real Citrix NetScaler integrity bug and new CBC padding oracles.
- What: The first large-scale (7,337 domains, 1,304 extracted models) study of TLS implementation state machines learned directly over the Internet, handling jitter, load balancers, and non-determinism that previously confined this technique to lab settings. Found a handshake transcript integrity vulnerability in Citrix NetScaler and new CBC padding oracle vulnerabilities. (from abstract only)
- How: Extends Mealy-machine state-learning techniques with new handling for large protocol alphabets and automated analysis of the resulting automata, plus support for session resumption, renegotiation, and CBC padding-oracle-relevant features previously excluded. (from abstract only)
- Where applicable: General TLS implementation testing methodology; directly useful to anyone auditing TLS stacks at scale rather than one implementation at a time.