Differential Testing Revealed What Conformance Testing Missed: A Case Study with Open-Source eMRTD Libraries

Описание и применение

Сравнение библиотек gmrtd (Go) и JMRTD (Java) с помощью дифференциального тестирования показало, что при сбое протокола PACE обе библиотеки незаметно откатываются на BAC без явного оповещения приложения о понижении уровня безопасности.

Задача

Conformance testing only checks if a library passes its own tests, failing to show whether two independent implementations make the same security decision when presented with identical protocol traffic such as an eMRTD access control protocol downgrade.

Результат

Both independent libraries successfully completed BAC authentication after a PACE failure returned 6FFF, but neither surfaced the protocol downgrade explicitly enough to prevent a naive application from assuming a standard secure session.

Рабочий процесс

• Define a controlled synthetic protocol profile (pace-then-bac-downgrade) using JSON without physical silicon or NFC readers.
• Inject a failure code (6FFF) on the first PACE APDU command while keeping BAC functional.
• Execute the negotiation path against gmrtd in Go and JMRTD in Java using identical byte streams.
• Capture run metadata, APDU traces, return values, and session error fields into JSON trace files.
• Evaluate whether a naive application wrapper can catch or ignore the protocol fallback.

Доказательства

PACE failed during the initial negotiation. BAC then completed successfully. For an application that merely checks whether a secure session exists, there was no explicit indication that a protocol fallback had occurred.

Источник