15:57:25 #startmeeting tor anti-censorship meeting 15:57:25 here is our meeting pad: https://pad.riseup.net/p/r.9574e996bb9c0266213d38b91b56c469 15:57:25 feel free to add what you've been working on and put items on the agenda 15:57:25 the read-write link for meeting pad can be requested via direct message 15:57:25 Meeting started Thu Jan 11 15:57:25 2024 UTC. The chair is shelikhoo. Information about MeetBot at http://wiki.debian.org/MeetBot. 15:57:25 Useful Commands: #action #agreed #help #info #idea #link #topic. 15:57:39 Hi~ Hi~ 15:58:13 hi 15:58:36 thanks for the hi, I almost think I started the meeting in the wrong time 15:58:39 Hi! 15:59:06 :) 15:59:12 hello! sorry, dealing with a bit of a situation over here >.< 16:00:04 Don't worry... 16:02:26 I'm new here and wanted to drop by to say hi, looking forward to contribute! 16:02:36 I'm currently in the start phase of writing my master thesis in communication tec hnology on reducing distinguishability of DTLS. 16:02:40 hello o/ 16:02:59 oh cool, welcome theodorsm! 16:03:13 glad to have you here 16:03:15 yeah! great to see you theodorsm :) 16:03:16 I didn't see any new discussion points, so I will start with announcements 16:03:28 nice work theodorsm! 16:03:34 Thanks! 16:03:43 I means it will be nice work... 16:03:50 I'm planning to implement a library similar to uTLS for DTLS, extending the pion golang library used in Snowflake today. Is this something the snowflake devs would like to use? 16:05:01 Also, sorry if I'm disturbing to flow of the meeting, first time! 16:05:41 I think this will depends on the library itself. Let's say what it can do 16:05:59 no worries, it's our first meeting of the year and we don't have much discussion :) 16:06:13 and how well it would be maintained 16:06:22 theodorsm: I can give you a bunch of links and references 16:06:41 to answer your question about whether it would be use ful for snowflake, yes, we have an open issue for it: tpo/anti-censorship/pluggable-transports/snowflake#40014 16:06:55 yes, the maintaining part is a concern. I do want to keep it syned with pion upstream 16:07:20 I will announce my work there 16:07:32 In the gitlab issue 16:07:54 theodorsm: you should, before anything else, contact Sean DuBois at Pion, because I know he has been interested in (and maybe has recently started) some anti-fingerprinting features in Pion 16:08:11 Thanks, great tip dcf1! 16:08:29 I can give you a bunch of other things to look at, but I'll let shelikhoo go back to facilitating 16:08:41 Great! 16:08:53 we have been upstreaming the censorship resistant changes to pion 16:09:09 that being said, it is more ad-hoc 16:09:20 okay, I will start with announcement 16:09:29 Since December 2023, getting TLS certificates for subdomains of torproject.net (e.g. snowflake-broker.torproject.net) requires asking the sysadmin team to create a CAA record in DNS to authorize a specific account. 16:09:29 https://gitlab.torproject.org/tpo/tpa/team/-/issues/41462 16:09:29 https://gitlab.torproject.org/tpo/tpa/team/-/wikis/howto/tls?version_id=41c7dd0c1eb7ea41a7c92b1876a38549749d70bd#certificate-authority-authorization-caa 16:10:26 I spent a while debugging this problem this week, luckily it got figured out before the certificates for the snowflake bridges began to expire 16:10:27 So if we wants to issue any new TLS certificates, we may need to contact TPA first when adding DNS records 16:10:59 I added some documentation to our bridge/broker installation guides talking about the need for a CAA record, but obviously the instructions haven't been tested with a new installation yet 16:11:17 shelikhoo: Yes, like if we set up an 03.snowflake.torproject.net, we need to ask for a CAA 16:12:28 there is no new discussion points 16:12:52 other than the one we have already discussed 16:13:01 and finally there is a interesting link: 16:13:02 https://opencollective.com/censorship-circumvention/projects/snowflake-daily-operations/updates/2023-december-update 16:14:02 Anything more we would like to discuss in this meeting? 16:14:34 theodorsm: don't go anywhere, I'm just about finished making a list of links for you 16:14:43 Hehe, thanks! 16:14:58 shelikhoo: I can paste it inside the meeting or after it ends, whatever you prefer 16:15:31 You can paste them now, if you have them ready:) 16:16:00 Also, I want to validate that my DTLS implementation is fingerprint resistant, does someone know if there is any updated data set of captured DTLS traffic? 16:16:03 I think it is okay to paste them here now 16:16:34 I am familiar with the data set from r esearchers at Princeton, however, the data set is already 4 years old, which concerns me. 16:18:04 theodorsm: there is an in-progress paper about snowflake, and one section of the paper talks about protocol fingerprinting, including DTLS fingerprinting (mainly in Section 3) 16:18:11 https://github.com/net4people/bbs/issues/296 16:18:14 https://github.com/net4people/bbs/files/12798010/snowflake.20231003.e6e1c30d.pdf 16:18:37 The text has references to some DTLS fingerprinting papers, including the Princeton ones you mentioned 16:18:41 https://github.com/turfed/snowflake-paper/blob/3ac92fb3394c8628fb8ac215a9fa3f90b32f2d08/snowflake.tex#L1219 16:19:05 "Fingerprintability of WebRTC" 2016 https://arxiv.org/abs/1605.08805 16:19:05 "Evaluating Snowflake as an Indistinguishable Censorship Circumvention Tool" 2020 https://arxiv.org/abs/2008.03254 16:19:08 "New Directions in Automated Traffic Analysis" (Section 5.3) 2021 https://dl.acm.org/doi/10.1145/3460120.3484758 16:19:11 "F-ACCUMUL: A Protocol Fingerprint and Accumulative Payload Length Sample-Based {Tor}-{Snowflake} Traffic-Identifying Framework" 2023 https://www.mdpi.com/2076-3417/13/1/622 16:19:14 "On Precisely Detecting Censorship Circumvention in Real-World Networks" 2024 https://www.robgjansen.com/publications/precisedetect-ndss2024.html 16:19:30 If you find any others in your research, please let us know so we can add them to the related works. 16:20:37 In answer to your question about data sets, it is true that the ones used in past research are somewhat questionable. The Princeton one that consists of 7,000 handshakes is a somewhat artificial closed world of 4 applications, and the evaluation doesn't consider base rates of circumvention traffic. 16:21:04 Nevertheless they have some good insights, and the 2020 one correctly predicted some fingerprint features that were used for blocking. 16:21:07 Thanks, I have checked the in-prograss paper as part of my preliminary research. 16:21:29 Great work! 16:21:45 The Wails et al. 2024 paper "On precisely detecting" is an example of how to do base rates right, and it also happens to evaluated Snowflake DTLS in one of its parts. 16:22:22 But yeah, so get in touch with Sean DuBois, who can bring you up to speed on the state of a uTLS-like for Pion more quickly. 16:22:23 I will read that one more carefully 16:22:36 That's all the references I can immediately think of. Thanks for working on this topic. 16:23:24 yes! thanks for all the links! 16:23:37 Great tips, will update my progress on the gitlab issue and if I find more research on the topi, I will let you know on the in-progress paper github. 16:24:12 The evaluation in the F-ACCUMUL one is pretty poor, but their Table 1 has a histogram of DTLS handshake feature importance, and also it's a good example of DTLS features being used in concert with other features (e.g. DNS) 16:24:34 thanks theodorsm 16:25:35 yes! thanks theodorsm and dcf1! 16:25:54 anything we wish to discuss in this meeting? 16:26:44 #endmeeting