Collected research

HVLearn: Automated Black-box Analysis of Hostname Verification in SSL/TLS Implementations

Suphannee Sivakorn, George Argyros, Kexin Pei, Angelos D. Keromytis and Suman Jana · cs.columbia.edu

HVLearn learns a finite automaton of exactly which hostnames each SSL/TLS library accepts for a given certificate common name, then compares those models across implementations and against RFC-derived rules. The disagreements expose eight specification violations in OpenSSL, GnuTLS, MatrixSSL, JSSE and others, several letting a man-in-the-middle present a certificate the client wrongly accepts.

Record

Researcher

Suphannee Sivakorn, George Argyros, Kexin Pei, Angelos D. Keromytis and Suman Jana

Published by

cs.columbia.edu

Format

Whitepaper

Topic

Crypto

In the archive

• Collected in the 2016–17 research round

Tags

• parser-differential
• tls
• https
• auth-bypass
• formal-analysis
• dynamic-analysis
• tooling
• owasp-a01-2021
• owasp-a02-2021

This page is the archive's own catalogue record. The research is the work of Suphannee Sivakorn, George Argyros, Kexin Pei, Angelos D. Keromytis and Suman Jana, first published at the original source. Preserved copies are kept so the citation survives its host; this one was last captured on 14 August 2026.