Re: [TLS] Possible blocking of Encrypted SNI extension in China

[David Fifield <[e-mail]>]

On Tue, Aug 11, 2020 at 01:38:50AM -0700, Rob Sayre wrote:
> On Tue, Aug 11, 2020 at 12:14 AM Peter Gutmann <[e-mail]>
> 
>     There was a paper that looked a traffic morphing published a year
>     or two ago that came to the same conclusion, to look like you're Skype or a
>     SIP VoIP call you need to actually be Skype or a SIP VoIP call.
> 
> You could link it, perhaps.

Peter is surely referring to the influential "The Parrot is Dead" paper
from 2013, which found discrepancies in so-called "parrot" systems that
superficially imitate some other cover protocol. The authors recommend
not mere imitation, but tunnelling through a real implementation of the
cover protocol (Section XI).
	"The Parrot is Dead: Observing Unobservable Network Communications"
	https://censorbib.nymity.ch/#Houmansadr2013b
A point of clarification: "The Parrot is Dead" is not about "traffic
morphing" in the restricted sense of Wright et al.
(https://www.freehaven.net/anonbib/#morphing09), which is solely about
shaping packets' sizes, not their contents nor the interpacket timing.

"The Parrot is Dead" is rightly well-regarded, but one should not cite
it without also mentioning some follow-on work, like "Seeing through
Network-Protocol Obfuscation," which found many of the dead-parrot
attacks impractical due to high false-positive rates or easy
remediation. The authors proposed new detection attacks, optimizing for
low false-positive rates and low cost of deployment, in terms of state
and computation.
	"Seeing through Network-Protocol Obfuscation"
	https://censorbib.nymity.ch/#Wang2015a

It is worth noting that, despite these papers' claims of easy detection
of covert protocols, classification attacks of the type they propose are
not really observed in practice. Available evidence indicates that
network intermediaries, when they block, prefer to block using methods
that are simpler and more robust, generally preferring a large number of
false negatives to a small number of false positives. The following
paper takes a contrarian view and proposes more realistic threat models
based on the observed behavior of blockers: see the three "disconnects"
between research and practice in Section I.
	"Towards Grounding Censorship Circumvention in Empiricism"
	https://censorbib.nymity.ch/#Tschantz2016a
As an example, "Seeing through Network-Protocol Obfuscation" was
published in 2015, but none of its proposed attacks (Figure 1) have come
to pass, despite their ≈1.0 true-positive rates and ≈0.0 false-positive
rates. obfs3 was defeated by active probing
(https://censorbib.nymity.ch/#Ensafi2015b); even in China obfs4 is
attacked by enumeration at the proxy distributor, not passive detection;
and meek kept working until it was shut down by the CDNs, not the
network blockers it was intended against. (FTE did not have enough users
to make any strong statements about, I think.)

Attempts to infer information about the contents of an encrypted network
stream based on packet size and timing are usually filed under the term
"website fingerprinting." You'll find many papers with that term in the
title at https://www.freehaven.net/anonbib/. I am not as familiar with
that field, but I understand that a common criticism of website
fingerprinting research is that it may use unrealistic data or
assumptions, such that it's not clear that the results generalize or can
be effectively deployed. (There are echoes of this in Table 8 of "Seeing
through Network-Protocol Obfuscation," which reports a large loss in
accuracy when training and testing across corpora.) For a critical look
at research earlier than 2014, see:
	"A Critical Evaluation of Website Fingerprinting Attacks"
	https://www.freehaven.net/anonbib/#ccs2014-critical

With that said about website fingerprinting, on the topic of inference
using packet sizes, timing, and other metadata, I have been impressed
with this series of articles on inference against TLS and HTTPS, which I
think avoid common missteps:
	"Enhanced telemetry for encrypted threat analytics"
	http://gen.lib.rus.ec/scimag/?q=10.1109%2FICNP.2016.7785325

	"Deciphering Malware's use of TLS (without Decryption)"
	https://arxiv.org/abs/1607.01639

	"Identifying Encrypted Malware Traffic with Contextual Flow Data"
	http://gen.lib.rus.ec/scimag/?q=10.1145%2F2996758.2996768

	"Limitless HTTP in an HTTPS World: Inferring the Semantics of
	the HTTPS Protocol without Decryption"
	http://gen.lib.rus.ec/scimag/?q=10.1145%2F3292006.3300025
	https://www.youtube.com/watch?v=pBVu9GEfE1I&t=80