Re: [TLS] TLS grammar checker?

[Eric Rescorla <[e-mail]>]

On Mon, Jun 17, 2013 at 6:48 AM, Paul Hoffman <[e-mail]> wrote:

> On Jun 16, 2013, at 11:09 PM, Peter Gutmann <[e-mail]>
> wrote:
>
> > Paul Hoffman <[e-mail]> writes:
> >
> >> Greetings again. The recent errata shows that some of the TLS documents
> that
> >> use the grammar invented for SSL can have some errors. People have
> developed
> >> tools for checking ABNF grammar in Internet Drafts and RFCs; has anyone
> >> developed an SSL grammar checker?
> >
> > The SSL grammar isn't, AFAIK, any kind of machine-parseable formal
> grammar, in
> > published automated analyses the authors had to re-state what was going
> on in
> > their own notation in order to make it amenable to automated analysis,
> and
> > even then could usually only do a subset of the protocol.  So you'd need
> to
> > come up with your own grammar that's amenable to automated processing
> and re-
> > specific TLS in that.  I can't really see that happening any time soon.
>
> Indeed, so my question was hopeful that it had been done in the past.
>
> > (Having said that, I'd like to see it done.  The grammar used in the
> SSL/TLS
> > RFCs is pretty confusing in places).
>
> It could be / would have been an interesting task for a CS intern or
> summer student, or a prof researching widely-used grammars.
>

I've built parsers for subsets of the grammar. I'm not sure anyone has
built one for the entire TLS protocol. I think you would probably have to
iterate:

1. Build the parser.
2. Try to parse the grammar in the specifications.
3. Look at where it fails and try to decide whether your parser
    was wrong or the specs were wrong.
4. File errata and/or fix your parser.
5. Rinse, repeat

-Ekr