Break It Yourself
summary
Property-based model testing using model-based QuickCheck exercises a TLS-like state machine implemented in Erlang and ships a simplified crypto stub that exposes handshake and application-state transitions. The test harness generates random but constrained sequences, runs them against the implementation, and flags violations; it uncovers multiple subtle bugs including a case where a server accepts an unexpected certificate that enables a masquerade-like failure. Tests run against other implementations show some differences but not universal fixes.
AI-written summary · about
chapters (8)
- 0:00Introduction
- 10:07Property-based testing matters
- 13:40Model-based validation
- 17:10Security model details
- 19:51TLS handshake violations
- 23:49Small flaws, big problems
- 24:33Project future work
- 25:34Q&A
related talks
33mLets Generate Tests
42mSurprise yourself with Property Based Testing
45mTesting Web Services with QuickCheck
46mGraphical models for Quickcheck
47mTesting the Hard Stuff and Staying Sane
20mType-level Property Based Testing
37mBreaking the bank with test contract
40mPerformance and Testing of an Open Source Erlang TCP/IP Stack