Re: [TLS] Possible blocking of Encrypted SNI extension in China

[Rob Sayre <[e-mail]>]

On Tue, Aug 11, 2020 at 3:42 PM David Fifield <[e-mail]> wrote:

> With that said about website fingerprinting, on the topic of inference
> using packet sizes, timing, and other metadata, I have been impressed
> with this series of articles on inference against TLS and HTTPS, which I
> think avoid common missteps:
>         "Enhanced telemetry for encrypted threat analytics"
>         http://gen.lib.rus.ec/scimag/?q=10.1109%2FICNP.2016.7785325


Thanks for the links.

This 2016 paper is interesting. Understandably, it doesn't mention a bunch
of newer developments.

Its conclusion ends with:

"We identified features of a flow that can be easily collected, analyzed,
and stored such as
the sequence of packet lengths and times, the byte distribution, and the
TLS handshake
metadata. We showed how these data features can be combined with intuitive
machine
learning models to accurately classify malicious, encrypted network flows."

It seems to me that a lot of these papers studied more predictable packet
sizes than they might get under ECH, and would have less cleartext metadata
available under ECH. Additionally, many of these papers probably used TLS
1.2 or earlier.

thanks,
Rob