Re: [Masque] MASQUE detection through tracking trackers

[Christian Huitema <[e-mail]>]

On 11/5/2019 1:32 PM, Töma Gavrichenkov wrote:

>
> On Tue, Nov 5, 2019, 8:15 PM Ted Hardie <[e-mail]
> <mailto:[e-mail]>> wrote:
>
>     The box you've described is fundamentally a traffic analysis
>     tool.  From the business perspective, it's likely a subscription
>     service
>
>
> I skipped that before, yet I think I have to say this: in the today's
> world, every DPI middlebox (worth ordering by whoever willing to make
> any profit on top of that) has this subscription service.  As has been
> rightly pointed out in this thread before, this is now an arms race,
> and we should expect the device to be updated on a weekly basis at
> least, and every maybe other hour at worst, or even worse.

It is an interesting topic, quickly delving into "spy vs spy" territory.
The general idea of the "stealth VPN" is to mimic the traffic of some
applications that are known to pass through the firewalls. The general
idea of the "network censor" is to find ways to distinguish the traffic
they want to allow from the traffic they want to block without
generating too many false positive. That game can go on for a long time,
with progress in detection matched over time by progress in stealth, and
vice-versa. This is similar to what happens with viruses that are being
tested against anti-virus software, and then anti-virus software that
are updated to catch the latest viruses, a "game" that has been going on
for at least two decades.

I don't think that the IETF can play that game, not when it takes more
than 3 years to produce a standard. The IRTF can play a role, and PEARG
would be a good place to publicize knowledge about censorship
techniques. But even the IRTF is probably too slow for the tit-for-tat
game. What the IETF might do, on the other hand, is to take requirements
from stealth designers on desired features of protocols. Not so much
actual stealth features, although it is clearly desirable to avoid
making Masque to easy to recognize. I am more thinking of features like
a padding API or cover traffic API that might then be used by the
stealth designers.

-- Christian Huitema