{"id":"https://openalex.org/W7166645857","doi":"https://doi.org/10.1145/3808212","title":"RAT: Retrieval-Augmented Testing of Certificate Revocation List Parsers in TLS Implementations","display_name":"RAT: Retrieval-Augmented Testing of Certificate Revocation List Parsers in TLS Implementations","publication_year":2026,"publication_date":"2026-06-30","ids":{"openalex":"https://openalex.org/W7166645857","doi":"https://doi.org/10.1145/3808212"},"language":"en","primary_location":{"id":"doi:10.1145/3808212","is_oa":true,"landing_page_url":"https://doi.org/10.1145/3808212","pdf_url":null,"source":{"id":"https://openalex.org/S4404663975","display_name":"Proceedings of the ACM on software engineering.","issn_l":"2994-970X","issn":["2994-970X"],"is_oa":false,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/P4310319798","host_organization_name":"Association for Computing Machinery","host_organization_lineage":["https://openalex.org/P4310319798"],"host_organization_lineage_names":["Association for Computing Machinery"],"type":"journal"},"license":"cc-by-nc-nd","license_id":"https://openalex.org/licenses/cc-by-nc-nd","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the ACM on Software Engineering","raw_type":"journal-article"},"type":"article","indexed_in":["crossref"],"open_access":{"is_oa":true,"oa_status":"hybrid","oa_url":"https://doi.org/10.1145/3808212","any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5135605493","display_name":"Chu Chen","orcid":"https://orcid.org/0000-0001-8015-9633"},"institutions":[{"id":"https://openalex.org/I202126657","display_name":"Qufu Normal University","ror":"https://ror.org/03ceheh96","country_code":"CN","type":"education","lineage":["https://openalex.org/I202126657"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Chu Chen","raw_affiliation_strings":["Qufu Normal University, School of Computer Science, Rizhao, China"],"raw_orcid":"https://orcid.org/0000-0001-8015-9633","affiliations":[{"raw_affiliation_string":"Qufu Normal University, School of Computer Science, Rizhao, China","institution_ids":["https://openalex.org/I202126657"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5139670395","display_name":"Qianxin Cheng","orcid":"https://orcid.org/0009-0006-9455-1875"},"institutions":[{"id":"https://openalex.org/I202126657","display_name":"Qufu Normal University","ror":"https://ror.org/03ceheh96","country_code":"CN","type":"education","lineage":["https://openalex.org/I202126657"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Qianxin Cheng","raw_affiliation_strings":["Qufu Normal University, School of Computer Science, Rizhao, China"],"raw_orcid":"https://orcid.org/0009-0006-9455-1875","affiliations":[{"raw_affiliation_string":"Qufu Normal University, School of Computer Science, Rizhao, China","institution_ids":["https://openalex.org/I202126657"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5112953884","display_name":"Pinghong Ren","orcid":null},"institutions":[{"id":"https://openalex.org/I202126657","display_name":"Qufu Normal University","ror":"https://ror.org/03ceheh96","country_code":"CN","type":"education","lineage":["https://openalex.org/I202126657"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Pinghong Ren","raw_affiliation_strings":["Qufu Normal University, School of Computer Science, Rizhao, China"],"raw_orcid":"https://orcid.org/0000-0002-0027-2976","affiliations":[{"raw_affiliation_string":"Qufu Normal University, School of Computer Science, Rizhao, China","institution_ids":["https://openalex.org/I202126657"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5081234576","display_name":"Hairong Yu","orcid":"https://orcid.org/0000-0003-3018-064X"},"institutions":[{"id":"https://openalex.org/I202126657","display_name":"Qufu Normal University","ror":"https://ror.org/03ceheh96","country_code":"CN","type":"education","lineage":["https://openalex.org/I202126657"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Hairong Yu","raw_affiliation_strings":["Qufu Normal University, School of Computer Science, Rizhao, China"],"raw_orcid":"https://orcid.org/0009-0000-1093-7268","affiliations":[{"raw_affiliation_string":"Qufu Normal University, School of Computer Science, Rizhao, China","institution_ids":["https://openalex.org/I202126657"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5003990194","display_name":"Cong Tian","orcid":"https://orcid.org/0000-0002-5429-4580"},"institutions":[{"id":"https://openalex.org/I149594827","display_name":"Xidian University","ror":"https://ror.org/05s92vm98","country_code":"CN","type":"education","lineage":["https://openalex.org/I149594827"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Cong Tian","raw_affiliation_strings":["Xidian University, School of Computer Science and Technology, Xi'an, China"],"raw_orcid":"https://orcid.org/0000-0002-5429-4580","affiliations":[{"raw_affiliation_string":"Xidian University, School of Computer Science and Technology, Xi'an, China","institution_ids":["https://openalex.org/I149594827"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5071051896","display_name":"Zhenhua Duan","orcid":"https://orcid.org/0000-0002-3119-3242"},"institutions":[{"id":"https://openalex.org/I149594827","display_name":"Xidian University","ror":"https://ror.org/05s92vm98","country_code":"CN","type":"education","lineage":["https://openalex.org/I149594827"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Zhenhua Duan","raw_affiliation_strings":["Xidian University, School of Computer Science and Technology, Xi'an, China"],"raw_orcid":"https://orcid.org/0000-0002-3119-3242","affiliations":[{"raw_affiliation_string":"Xidian University, School of Computer Science and Technology, Xi'an, China","institution_ids":["https://openalex.org/I149594827"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5075803725","display_name":"Xu Lu","orcid":"https://orcid.org/0000-0002-3421-1987"},"institutions":[{"id":"https://openalex.org/I149594827","display_name":"Xidian University","ror":"https://ror.org/05s92vm98","country_code":"CN","type":"education","lineage":["https://openalex.org/I149594827"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Xu Lu","raw_affiliation_strings":["Xidian University, School of Computer Science and Technology, Xi'an, China"],"raw_orcid":"https://orcid.org/0000-0002-3421-1987","affiliations":[{"raw_affiliation_string":"Xidian University, School of Computer Science and Technology, Xi'an, China","institution_ids":["https://openalex.org/I149594827"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5020586569","display_name":"Bin Yu","orcid":"https://orcid.org/0000-0002-1680-3129"},"institutions":[{"id":"https://openalex.org/I149594827","display_name":"Xidian University","ror":"https://ror.org/05s92vm98","country_code":"CN","type":"education","lineage":["https://openalex.org/I149594827"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Bin Yu","raw_affiliation_strings":["Xidian University, School of Computer Science and Technology, Xi'an, China"],"raw_orcid":"https://orcid.org/0000-0002-1680-3129","affiliations":[{"raw_affiliation_string":"Xidian University, School of Computer Science and Technology, Xi'an, China","institution_ids":["https://openalex.org/I149594827"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5100720713","display_name":"Wensheng Wang","orcid":"https://orcid.org/0000-0002-8842-3432"},"institutions":[{"id":"https://openalex.org/I149594827","display_name":"Xidian University","ror":"https://ror.org/05s92vm98","country_code":"CN","type":"education","lineage":["https://openalex.org/I149594827"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"WenSheng Wang","raw_affiliation_strings":["Xidian University, School of Computer Science and Technology, Xi'an, China"],"raw_orcid":"https://orcid.org/0009-0003-0980-7628","affiliations":[{"raw_affiliation_string":"Xidian University, School of Computer Science and Technology, Xi'an, China","institution_ids":["https://openalex.org/I149594827"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5100327072","display_name":"Jin Liu","orcid":"https://orcid.org/0000-0003-0359-0248"},"institutions":[{"id":"https://openalex.org/I4210131919","display_name":"Xi'an University of Technology","ror":"https://ror.org/038avdt50","country_code":"CN","type":"education","lineage":["https://openalex.org/I4210131919"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Jin Liu","raw_affiliation_strings":["Xi'an University of Technology, School of Computer Science and Engineering, Xi'an, China"],"raw_orcid":"https://orcid.org/0009-0004-1502-7238","affiliations":[{"raw_affiliation_string":"Xi'an University of Technology, School of Computer Science and Engineering, Xi'an, China","institution_ids":["https://openalex.org/I4210131919"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":3,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":0.0,"has_fulltext":false,"cited_by_count":0,"citation_normalized_percentile":{"value":0.89104231,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":null,"biblio":{"volume":"3","issue":"FSE","first_page":"4666","last_page":"4689"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T12479","display_name":"Web Application Security Vulnerabilities","score":0.46000000834465027,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T12479","display_name":"Web Application Security Vulnerabilities","score":0.46000000834465027,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11424","display_name":"Security and Verification in Computing","score":0.08739999681711197,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10743","display_name":"Software Testing and Debugging Techniques","score":0.05829999968409538,"subfield":{"id":"https://openalex.org/subfields/1712","display_name":"Software"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/implementation","display_name":"Implementation","score":0.49079999327659607},{"id":"https://openalex.org/keywords/transport-layer-security","display_name":"Transport Layer Security","score":0.47369998693466187},{"id":"https://openalex.org/keywords/certificate","display_name":"Certificate","score":0.46000000834465027},{"id":"https://openalex.org/keywords/encryption","display_name":"Encryption","score":0.388700008392334},{"id":"https://openalex.org/keywords/test-case","display_name":"Test case","score":0.38339999318122864},{"id":"https://openalex.org/keywords/authentication","display_name":"Authentication (law)","score":0.3734000027179718},{"id":"https://openalex.org/keywords/parsing","display_name":"Parsing","score":0.36970001459121704},{"id":"https://openalex.org/keywords/syntax","display_name":"Syntax","score":0.36410000920295715}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.840499997138977},{"id":"https://openalex.org/C26713055","wikidata":"https://www.wikidata.org/wiki/Q245962","display_name":"Implementation","level":2,"score":0.49079999327659607},{"id":"https://openalex.org/C148176105","wikidata":"https://www.wikidata.org/wiki/Q206494","display_name":"Transport Layer Security","level":3,"score":0.47369998693466187},{"id":"https://openalex.org/C96865113","wikidata":"https://www.wikidata.org/wiki/Q2946816","display_name":"Certificate","level":2,"score":0.46000000834465027},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.4392000138759613},{"id":"https://openalex.org/C199360897","wikidata":"https://www.wikidata.org/wiki/Q9143","display_name":"Programming language","level":1,"score":0.40139999985694885},{"id":"https://openalex.org/C148730421","wikidata":"https://www.wikidata.org/wiki/Q141090","display_name":"Encryption","level":2,"score":0.388700008392334},{"id":"https://openalex.org/C128942645","wikidata":"https://www.wikidata.org/wiki/Q1568346","display_name":"Test case","level":3,"score":0.38339999318122864},{"id":"https://openalex.org/C148417208","wikidata":"https://www.wikidata.org/wiki/Q4825882","display_name":"Authentication (law)","level":2,"score":0.3734000027179718},{"id":"https://openalex.org/C186644900","wikidata":"https://www.wikidata.org/wiki/Q194152","display_name":"Parsing","level":2,"score":0.36970001459121704},{"id":"https://openalex.org/C60048249","wikidata":"https://www.wikidata.org/wiki/Q37437","display_name":"Syntax","level":2,"score":0.36410000920295715},{"id":"https://openalex.org/C151552104","wikidata":"https://www.wikidata.org/wiki/Q7705809","display_name":"Test suite","level":4,"score":0.34929999709129333},{"id":"https://openalex.org/C110875604","wikidata":"https://www.wikidata.org/wiki/Q75","display_name":"The Internet","level":2,"score":0.3458999991416931},{"id":"https://openalex.org/C2777904410","wikidata":"https://www.wikidata.org/wiki/Q7397","display_name":"Software","level":2,"score":0.3353999853134155},{"id":"https://openalex.org/C79974875","wikidata":"https://www.wikidata.org/wiki/Q483639","display_name":"Cloud computing","level":2,"score":0.320499986410141},{"id":"https://openalex.org/C147296133","wikidata":"https://www.wikidata.org/wiki/Q196765","display_name":"Revocation list","level":5,"score":0.3197999894618988},{"id":"https://openalex.org/C2775892892","wikidata":"https://www.wikidata.org/wiki/Q6509517","display_name":"Revocation","level":3,"score":0.3109000027179718},{"id":"https://openalex.org/C93636275","wikidata":"https://www.wikidata.org/wiki/Q196776","display_name":"Certificate authority","level":4,"score":0.30160000920295715},{"id":"https://openalex.org/C118643609","wikidata":"https://www.wikidata.org/wiki/Q189210","display_name":"Web application","level":2,"score":0.2946000099182129},{"id":"https://openalex.org/C109297577","wikidata":"https://www.wikidata.org/wiki/Q161157","display_name":"Password","level":2,"score":0.28209999203681946},{"id":"https://openalex.org/C111919701","wikidata":"https://www.wikidata.org/wiki/Q9135","display_name":"Operating system","level":1,"score":0.26750001311302185},{"id":"https://openalex.org/C115903868","wikidata":"https://www.wikidata.org/wiki/Q80993","display_name":"Software engineering","level":1,"score":0.2635999917984009},{"id":"https://openalex.org/C55439883","wikidata":"https://www.wikidata.org/wiki/Q360812","display_name":"Correctness","level":2,"score":0.2574000060558319},{"id":"https://openalex.org/C195518309","wikidata":"https://www.wikidata.org/wiki/Q13424265","display_name":"Security testing","level":5,"score":0.25440001487731934},{"id":"https://openalex.org/C43214815","wikidata":"https://www.wikidata.org/wiki/Q7310987","display_name":"Reliability (semiconductor)","level":3,"score":0.25130000710487366}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1145/3808212","is_oa":true,"landing_page_url":"https://doi.org/10.1145/3808212","pdf_url":null,"source":{"id":"https://openalex.org/S4404663975","display_name":"Proceedings of the ACM on software engineering.","issn_l":"2994-970X","issn":["2994-970X"],"is_oa":false,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/P4310319798","host_organization_name":"Association for Computing Machinery","host_organization_lineage":["https://openalex.org/P4310319798"],"host_organization_lineage_names":["Association for Computing Machinery"],"type":"journal"},"license":"cc-by-nc-nd","license_id":"https://openalex.org/licenses/cc-by-nc-nd","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the ACM on Software Engineering","raw_type":"journal-article"}],"best_oa_location":{"id":"doi:10.1145/3808212","is_oa":true,"landing_page_url":"https://doi.org/10.1145/3808212","pdf_url":null,"source":{"id":"https://openalex.org/S4404663975","display_name":"Proceedings of the ACM on software engineering.","issn_l":"2994-970X","issn":["2994-970X"],"is_oa":false,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/P4310319798","host_organization_name":"Association for Computing Machinery","host_organization_lineage":["https://openalex.org/P4310319798"],"host_organization_lineage_names":["Association for Computing Machinery"],"type":"journal"},"license":"cc-by-nc-nd","license_id":"https://openalex.org/licenses/cc-by-nc-nd","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the ACM on Software Engineering","raw_type":"journal-article"},"sustainable_development_goals":[],"awards":[{"id":"https://openalex.org/G7878570961","display_name":null,"funder_award_id":"62192734, 61806158, 62402372, and 62202371","funder_id":"https://openalex.org/F4320321001","funder_display_name":"National Natural Science Foundation of China"}],"funders":[{"id":"https://openalex.org/F4320321001","display_name":"National Natural Science Foundation of China","ror":"https://ror.org/01h0zpd94"}],"has_content":{"grobid_xml":false,"pdf":false},"content_urls":null,"referenced_works_count":35,"referenced_works":["https://openalex.org/W1976919795","https://openalex.org/W2019016802","https://openalex.org/W2134825350","https://openalex.org/W2634547503","https://openalex.org/W2650293344","https://openalex.org/W2672575173","https://openalex.org/W2701082322","https://openalex.org/W2795354477","https://openalex.org/W2913334895","https://openalex.org/W2915352631","https://openalex.org/W2964160436","https://openalex.org/W2980273018","https://openalex.org/W3008428742","https://openalex.org/W3043516383","https://openalex.org/W3123015093","https://openalex.org/W3125053552","https://openalex.org/W3177813494","https://openalex.org/W3213115463","https://openalex.org/W4224270324","https://openalex.org/W4298051233","https://openalex.org/W4308644329","https://openalex.org/W4366549811","https://openalex.org/W4384155689","https://openalex.org/W4385492587","https://openalex.org/W4387880483","https://openalex.org/W4396832834","https://openalex.org/W4400119984","https://openalex.org/W4402264482","https://openalex.org/W4405182770","https://openalex.org/W4405543707","https://openalex.org/W4408612358","https://openalex.org/W4410263438","https://openalex.org/W4410361381","https://openalex.org/W4411450113","https://openalex.org/W4416549474"],"related_works":[],"abstract_inverted_index":{"Transport":[0],"Layer":[1],"Security":[2],"(TLS)":[3],"implementations":[4,108],"form":[5],"the":[6,36,41,60,184,197,259],"backbone":[7],"of":[8,21,38,239,263],"countless":[9],"software":[10,79],"systems,":[11],"spanning":[12],"web":[13],"browsers,":[14],"email":[15],"clients,":[16],"cloud":[17],"services,":[18],"and":[19,28,113,126,157,174,224,231,241,252,261],"Internet":[20],"Things":[22],"software,":[23],"by":[24,95],"enabling":[25,227],"secure":[26],"authentication":[27],"encrypted":[29],"communication.":[30],"However,":[31],"their":[32,164],"reliability":[33,260],"hinges":[34],"on":[35,192],"integrity":[37],"components":[39],"like":[40],"Certificate":[42],"Revocation":[43],"List":[44],"(CRL),":[45],"which":[46,66],"revokes":[47],"compromised":[48],"certificates":[49],"to":[50,80,100,121,162,200,217,257],"prevent":[51],"attackers":[52],"from":[53,220],"exploiting":[54],"expired":[55],"or":[56],"unauthorized":[57],"credentials.":[58],"Despite":[59],"CRL's":[61],"critical":[62],"role,":[63],"CRL":[64,68,103,155,179,203,264],"parsers,":[65,156],"decode":[67],"data":[69],"for":[70,131],"validation,":[71,194],"remain":[72],"overlooked":[73],"in":[74,105,178,250,266],"security":[75,262],"research,":[76],"exposing":[77],"TLS-dependent":[78],"potential":[81,256],"threats.":[82],"To":[83],"address":[84],"this":[85,195],"gap,":[86],"we":[87],"introduce":[88],"Retrieval-Augmented":[89],"Testing":[90],"(RAT),":[91],"a":[92,209],"framework":[93,212],"powered":[94],"Large":[96],"Language":[97],"Models":[98],"(LLMs),":[99],"systematically":[101,201],"evaluate":[102],"parsers":[104,265],"mainstream":[106],"TLS":[107,267],"such":[109],"as":[110],"OpenSSL,":[111],"GnuTLS,":[112],"wolfSSL.":[114],"RAT":[115,158,171,240],"begins":[116],"with":[117,129],"leveraging":[118],"an":[119,141,160,215,236],"LLM":[120,161,216],"retrieve":[122],"historical":[123],"bug":[124,222],"reports":[125,223],"cross-reference":[127],"them":[128],"Request":[130],"Comments":[132],"(RFC)":[133],"5280":[134],"specifications,":[135],"generating":[136],"structured":[137],"test":[138,149],"cases":[139,150],"via":[140],"Abstract":[142],"Syntax":[143],"Notation":[144],"One-aware":[145],"mutation":[146],"engine.":[147],"These":[148],"are":[151],"then":[152],"fed":[153],"into":[154],"employs":[159],"normalize":[163],"outputs.":[165],"By":[166],"analyzing":[167],"these":[168],"normalized":[169],"results,":[170],"detects":[172],"discrepancies":[173],"uncovers":[175],"latent":[176],"risks":[177],"parsers.":[180],"Our":[181],"work":[182,190],"makes":[183],"following":[185],"contributions:":[186],"(1)":[187],"Unlike":[188],"prior":[189],"focusing":[191],"certificate":[193],"is":[196],"first":[198],"study":[199],"assess":[202],"parsers;":[204],"(2)":[205],"We":[206,233],"propose":[207],"RAT,":[208],"novel":[210],"testing":[211],"that":[213],"leverages":[214],"integrate":[218],"insights":[219],"retrieved":[221],"RFC":[225],"5280,":[226],"automated":[228],"test-case":[229],"generation;":[230],"(3)":[232],"have":[234],"implemented":[235],"open-source":[237],"prototype":[238],"experiments":[242],"uncovered":[243],"23":[244],"new":[245],"bugs,":[246],"features,":[247],"enhancements,":[248],"fixes":[249],"commits,":[251],"x509s,":[253],"demonstrating":[254],"RAT's":[255],"strengthen":[258],"implementations.":[268]},"counts_by_year":[],"updated_date":"2026-07-02T06:12:58.138171","created_date":"2026-07-01T00:00:00"}