rfc(0015): Pluggable Transport Skins for DPI resistance
- RFC-0015: Complete specification for censorship-resistant L0 - Transport Skins: RAW, MIMIC_HTTPS, MIMIC_DNS, MIMIC_VIDEO, STEGO - Polymorphic Noise Generator (PNG): Per-session traffic shaping - Anti-fingerprinting: TLS JA3 parroting, ECH, DoH tunneling - Gherkin BDD: 50+ scenarios for TDD implementation Targets: GFW, RKN, Iran/Turkmenistan edge cases Kenya compliant: Embedded-only, no cloud calls Features: - transport_skins.feature: Skin selection, probing, defense - polymorphic_noise.feature: PNG determinism, distributions Next: Sprint 5 implementation (MIMIC_HTTPS + PNG core)
This commit is contained in:
Markus Maiwald
parent
65f9af6b5d
commit
03c6389063
|
|
@ -0,0 +1,393 @@
|
||||||
|
# RFC-0015: Pluggable Transport Skins (PTS)
|
||||||
|
|
||||||
|
**Status:** Draft
|
||||||
|
**Author:** Frankie (Silicon Architect)
|
||||||
|
**Date:** 2026-02-03
|
||||||
|
**Target:** Janus SDK L0 Transport Layer
|
||||||
|
**Classification:** CRYPTOGRAPHIC / CENSORSHIP-RESISTANT
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
## Summary
|
||||||
|
|
||||||
|
Transport Skins provide **pluggable censorship resistance** for Libertaria's L0 Transport layer. Each "skin" wraps the standard LWF (Lightweight Wire Format) frame to mimic benign traffic patterns, defeating state-level Deep Packet Inspection (DPI) as deployed by China's GFW, Russia's RKN, Iran's Filternet, and similar adversaries.
|
||||||
|
|
||||||
|
**Core Innovation:** Per-session **Polymorphic Noise Generator (PNG)** ensures no two sessions ever exhibit identical traffic patterns.
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
## Threat Model
|
||||||
|
|
||||||
|
### Adversary Capabilities (GFW-Class)
|
||||||
|
| Technique | Capability | Our Counter |
|
||||||
|
|-----------|------------|-------------|
|
||||||
|
| Magic Byte Detection | Signature matching at line rate | Skins remove/replace magic bytes |
|
||||||
|
| TLS Fingerprinting (JA3/JA4) | Statistical TLS handshake analysis | utls-style parroting (Chrome/Firefox mimicry) |
|
||||||
|
| SNI Inspection | Cleartext server name identification | ECH (Encrypted Client Hello) + Domain Fronting |
|
||||||
|
| Packet Size Analysis | Fixed MTU detection | Probabilistic size distributions |
|
||||||
|
| Timing Correlation | Inter-packet timing patterns | Exponential/Gamma jitter |
|
||||||
|
| Flow Correlation | Long-term traffic statistics | Epoch rotation (100-1000 packets) |
|
||||||
|
| Active Probing | Sending test traffic to suspected relays | Honeytrap responses + IP blacklisting |
|
||||||
|
| DNS Manipulation | Poisoning, blocking, inspection | DoH (DNS-over-HTTPS) tunneling |
|
||||||
|
|
||||||
|
### Non-Goals
|
||||||
|
- **Traffic confirmation attacks** (end-to-end correlation): Out of scope; use L2 Membrane mixing
|
||||||
|
- **Physical layer interception**: Out of scope; requires steganographic hardware
|
||||||
|
- **Compromised endpoints**: Out of scope; requires TEE/SEV-SNP attestation
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
## Architecture
|
||||||
|
|
||||||
|
```
|
||||||
|
┌─────────────────────────────────────────────────────────────────────────┐
|
||||||
|
│ RFC-0015: TRANSPORT SKINS │
|
||||||
|
│ "Submarine Camouflage" │
|
||||||
|
├─────────────────────────────────────────────────────────────────────────┤
|
||||||
|
│ │
|
||||||
|
│ L3+ Application │
|
||||||
|
│ │ │
|
||||||
|
│ ▼ │
|
||||||
|
│ ┌─────────────────────────────────────────────────────────────────┐ │
|
||||||
|
│ │ LWF FRAME │ │
|
||||||
|
│ │ • 1350 bytes (configurable) │ │
|
||||||
|
│ │ • XChaCha20-Poly1305 encrypted │ │
|
||||||
|
│ │ • Magic bytes: LWF\0 (internal only) │ │
|
||||||
|
│ └─────────────────────────────────────────────────────────────────┘ │
|
||||||
|
│ │ │
|
||||||
|
│ ▼ │
|
||||||
|
│ ┌─────────────────────────────────────────────────────────────────┐ │
|
||||||
|
│ │ POLYMORPHIC NOISE GENERATOR (PNG) │ │
|
||||||
|
│ │ • ECDH-derived per-session seed │ │
|
||||||
|
│ │ • Epoch-based profile rotation (100-1000 packets) │ │
|
||||||
|
│ │ • Deterministic both ends (same seed = same noise) │ │
|
||||||
|
│ └─────────────────────────────────────────────────────────────────┘ │
|
||||||
|
│ │ │
|
||||||
|
│ ▼ │
|
||||||
|
│ ┌─────────────────────────────────────────────────────────────────┐ │
|
||||||
|
│ │ SKIN SELECTOR │ │
|
||||||
|
│ │ │ │
|
||||||
|
│ │ ┌─────────┐ ┌─────────────┐ ┌───────────┐ ┌───────────┐ │ │
|
||||||
|
│ │ │ RAW │ │MIMIC_HTTPS │ │MIMIC_DNS │ │MIMIC_VIDEO│ │ │
|
||||||
|
│ │ │ UDP │ │WebSocket/TLS│ │DoH Tunnel │ │HLS chunks │ │ │
|
||||||
|
│ │ └────┬────┘ └──────┬──────┘ └─────┬─────┘ └─────┬─────┘ │ │
|
||||||
|
│ │ │ │ │ │ │ │
|
||||||
|
│ │ └──────────────┴───────────────┴──────────────┘ │ │
|
||||||
|
│ │ │ │ │
|
||||||
|
│ │ Auto-selection via probing │ │
|
||||||
|
│ └─────────────────────────────────────────────────────────────────┘ │
|
||||||
|
│ │ │
|
||||||
|
│ ▼ │
|
||||||
|
│ NETWORK (ISP/GFW/RKN sees only the skin's traffic pattern) │
|
||||||
|
│ │
|
||||||
|
└─────────────────────────────────────────────────────────────────────────┘
|
||||||
|
```
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
## Polymorphic Noise Generator (PNG)
|
||||||
|
|
||||||
|
### Design Principles
|
||||||
|
1. **Per-session uniqueness:** ECDH handshake secret seeds ChaCha20 RNG
|
||||||
|
2. **Deterministic:** Both peers derive identical noise from shared secret
|
||||||
|
3. **Epoch rotation:** Profile changes every N packets (prevents long-term analysis)
|
||||||
|
4. **Distribution matching:** Sample sizes/timing from real-world captures
|
||||||
|
|
||||||
|
### Noise Parameters (Per Epoch)
|
||||||
|
```zig
|
||||||
|
pub const EpochProfile = struct {
|
||||||
|
// Packet size distribution
|
||||||
|
size_distribution: enum { Normal, Pareto, Bimodal, LogNormal },
|
||||||
|
size_mean: u16, // e.g., 1440 bytes
|
||||||
|
size_stddev: u16, // e.g., 200 bytes
|
||||||
|
|
||||||
|
// Timing distribution
|
||||||
|
timing_distribution: enum { Exponential, Gamma, Pareto },
|
||||||
|
timing_lambda: f64, // For exponential: mean inter-packet time
|
||||||
|
|
||||||
|
// Dummy packet injection
|
||||||
|
dummy_probability: f64, // 0.0-0.15 (0-15% fake packets)
|
||||||
|
dummy_distribution: enum { Uniform, Bursty },
|
||||||
|
|
||||||
|
// Epoch boundaries
|
||||||
|
epoch_packet_count: u32, // 100-1000 packets before rotation
|
||||||
|
};
|
||||||
|
```
|
||||||
|
|
||||||
|
### Seed Derivation
|
||||||
|
```
|
||||||
|
Session Secret (ECDH) → HKDF-SHA256 → 256-bit PNG Seed
|
||||||
|
↓
|
||||||
|
┌───────────────────────┐
|
||||||
|
│ ChaCha20 RNG State │
|
||||||
|
└───────────────────────┘
|
||||||
|
↓
|
||||||
|
┌───────────────────────┐
|
||||||
|
│ Epoch Profile Chain │
|
||||||
|
│ (deterministic) │
|
||||||
|
└───────────────────────┘
|
||||||
|
```
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
## Transport Skins
|
||||||
|
|
||||||
|
### Skin 0: RAW (Unrestricted Networks)
|
||||||
|
**Use case:** Friendly jurisdictions, LAN, high-performance paths
|
||||||
|
|
||||||
|
| Property | Value |
|
||||||
|
|----------|-------|
|
||||||
|
| Protocol | UDP direct |
|
||||||
|
| Port | 7844 (default) |
|
||||||
|
| Overhead | 0% |
|
||||||
|
| Latency | Minimal |
|
||||||
|
| Kenya Viable | ✅ Yes |
|
||||||
|
|
||||||
|
**Wire format:**
|
||||||
|
```
|
||||||
|
[LWF Frame: 1350 bytes]
|
||||||
|
```
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
### Skin 1: MIMIC_HTTPS (Standard Censorship Bypass)
|
||||||
|
**Use case:** GFW, RKN, corporate firewalls (90% coverage)
|
||||||
|
|
||||||
|
| Property | Value |
|
||||||
|
|----------|-------|
|
||||||
|
| Protocol | WebSocket over TLS 1.3 |
|
||||||
|
| Port | 443 |
|
||||||
|
| SNI | Domain fronting capable (ECH preferred) |
|
||||||
|
| Overhead | ~5% (TLS + WS framing) |
|
||||||
|
| Latency | +50-100ms |
|
||||||
|
| Kenya Viable | ✅ Yes |
|
||||||
|
|
||||||
|
**TLS Fingerprinting Defense:**
|
||||||
|
- utls-style parroting (exact Chrome/Firefox JA3 signatures)
|
||||||
|
- HTTP/2 settings matching browser defaults
|
||||||
|
- ALPN: `h2, http/1.1`
|
||||||
|
|
||||||
|
**Wire format:**
|
||||||
|
```
|
||||||
|
TLS 1.3 Record Layer {
|
||||||
|
Content Type: Application Data (23)
|
||||||
|
TLS Ciphertext: {
|
||||||
|
WebSocket Frame {
|
||||||
|
FIN: 1
|
||||||
|
Opcode: Binary (0x02)
|
||||||
|
Masked: 0 (server→client) / 1 (client→server)
|
||||||
|
Payload: [PNG Noise] + [LWF Frame]
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
|
```
|
||||||
|
|
||||||
|
**WebSocket Handshake (Cover):**
|
||||||
|
```
|
||||||
|
GET /api/v3/stream HTTP/1.1
|
||||||
|
Host: cdn.cloudflare.com
|
||||||
|
Upgrade: websocket
|
||||||
|
Connection: Upgrade
|
||||||
|
Sec-WebSocket-Key: <base64(random)>
|
||||||
|
Sec-WebSocket-Version: 13
|
||||||
|
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64)...
|
||||||
|
```
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
### Skin 2: MIMIC_DNS (Deep Censorship Bypass)
|
||||||
|
**Use case:** UDP blocked, HTTPS throttled, Iran/Turkmenistan edge cases
|
||||||
|
|
||||||
|
| Property | Value |
|
||||||
|
|----------|-------|
|
||||||
|
| Protocol | DNS-over-HTTPS (DoH) |
|
||||||
|
| Endpoint | 1.1.1.1, 8.8.8.8, 9.9.9.9 |
|
||||||
|
| Overhead | ~300% (Base64url encoding) |
|
||||||
|
| Latency | +200-500ms |
|
||||||
|
| Kenya Viable | ⚠️ Marginal (bandwidth-heavy) |
|
||||||
|
|
||||||
|
**DNS Tunnel Defenses:**
|
||||||
|
- **DoH not raw DNS:** Blends with real DoH traffic
|
||||||
|
- **Query distribution:** Match real DoH query timing (not regular intervals)
|
||||||
|
- **Label entropy:** Use dictionary words for subdomain labels (not base32)
|
||||||
|
|
||||||
|
**Wire format:**
|
||||||
|
```
|
||||||
|
POST /dns-query HTTP/2
|
||||||
|
Host: cloudflare-dns.com
|
||||||
|
Content-Type: application/dns-message
|
||||||
|
Accept: application/dns-message
|
||||||
|
|
||||||
|
Body: DNS Message {
|
||||||
|
Question: <LWF fragment encoded as DNS query name>
|
||||||
|
QTYPE: TXT (or HTTPS for larger payloads)
|
||||||
|
}
|
||||||
|
```
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
### Skin 3: MIMIC_VIDEO (High-Bandwidth Bypass)
|
||||||
|
**Use case:** Video-streaming-whitelisted networks, QoS prioritization
|
||||||
|
|
||||||
|
| Property | Value |
|
||||||
|
|----------|-------|
|
||||||
|
| Protocol | HTTPS with HLS (HTTP Live Streaming) chunk framing |
|
||||||
|
| Mimics | Netflix, YouTube, Twitch |
|
||||||
|
| Overhead | ~10% (HLS `.ts` container) |
|
||||||
|
| Latency | +100-200ms |
|
||||||
|
| Kenya Viable | ✅ Yes |
|
||||||
|
|
||||||
|
**Wire format:**
|
||||||
|
```
|
||||||
|
HTTP/2 200 OK
|
||||||
|
Content-Type: video/mp2t
|
||||||
|
X-LWF-Sequence: <epoch_packet_num>
|
||||||
|
|
||||||
|
Body: [HLS MPEG-TS Container] {
|
||||||
|
Adaptation Field: [PNG padding]
|
||||||
|
Payload: [LWF Frame]
|
||||||
|
}
|
||||||
|
```
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
### Skin 4: STEGO_IMAGE (Nuclear Option)
|
||||||
|
**Use case:** Total lockdown, emergency fallback only
|
||||||
|
|
||||||
|
| Property | Value |
|
||||||
|
|----------|-------|
|
||||||
|
| Protocol | HTTPS POST to image hosting (Imgur, etc.) |
|
||||||
|
| Stego Method | Generative steganography (StyleGAN encoding) |
|
||||||
|
| Bandwidth | ~1 byte per image (extremely slow) |
|
||||||
|
| Latency | Seconds to minutes |
|
||||||
|
| Kenya Viable | ❌ Emergency only |
|
||||||
|
|
||||||
|
**Note:** Traditional LSB steganography is broken against ML detection. Use generative encoding only.
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
## Automatic Skin Selection
|
||||||
|
|
||||||
|
### Probe Sequence
|
||||||
|
```zig
|
||||||
|
pub const SkinProbe = struct {
|
||||||
|
/// Attempt skin selection with timeouts
|
||||||
|
pub async fn auto_select(relay: RelayEndpoint) !TransportSkin {
|
||||||
|
// 1. RAW UDP (fastest, 100ms timeout)
|
||||||
|
if (try probe_raw(relay, 100ms)) {
|
||||||
|
return .raw;
|
||||||
|
}
|
||||||
|
|
||||||
|
// 2. HTTPS WebSocket (500ms timeout)
|
||||||
|
if (try probe_https(relay, 500ms)) {
|
||||||
|
return .mimic_https(relay);
|
||||||
|
}
|
||||||
|
|
||||||
|
// 3. DNS Tunnel (1s timeout)
|
||||||
|
if (try probe_dns(relay, 1s)) {
|
||||||
|
return .mimic_dns(relay);
|
||||||
|
}
|
||||||
|
|
||||||
|
// 4. Nuclear option (no probe, async only)
|
||||||
|
return .stego_async(relay);
|
||||||
|
}
|
||||||
|
};
|
||||||
|
```
|
||||||
|
|
||||||
|
### Multi-Path Agility (MPTCP-Style)
|
||||||
|
```zig
|
||||||
|
pub const MultiSkinSession = struct {
|
||||||
|
primary: TransportSkin, // 90% bandwidth (HTTPS)
|
||||||
|
secondary: TransportSkin, // 10% bandwidth (DNS keepalive)
|
||||||
|
|
||||||
|
/// If primary throttled, signal via secondary
|
||||||
|
pub fn adapt_to_throttling(self: *Self) void {
|
||||||
|
if (self.primary.detect_throttling()) {
|
||||||
|
self.secondary.signal_endpoint_switch();
|
||||||
|
}
|
||||||
|
}
|
||||||
|
};
|
||||||
|
```
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
## Active Probing Defenses
|
||||||
|
|
||||||
|
### Honeytrap Responses
|
||||||
|
When probed without valid session state:
|
||||||
|
1. **HTTPS Skin:** Respond as legitimate web server (nginx default page)
|
||||||
|
2. **DNS Skin:** Return NXDOMAIN or valid A record (not relay IP)
|
||||||
|
3. **Rate limit:** Exponential backoff on failed handshakes
|
||||||
|
|
||||||
|
### Reputation Tokens
|
||||||
|
Prevent rapid relay scanning:
|
||||||
|
```
|
||||||
|
Client → Relay: ClientHello + PoW (Argon2, 100ms)
|
||||||
|
Relay → Client: ServerHello (only if PoW valid)
|
||||||
|
```
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
## Implementation Phases
|
||||||
|
|
||||||
|
### Phase 1: Foundation (Sprint 5)
|
||||||
|
- [ ] PNG core (ChaCha20 RNG, epoch rotation)
|
||||||
|
- [ ] RAW skin (baseline)
|
||||||
|
- [ ] MIMIC_HTTPS skin (WebSocket + TLS)
|
||||||
|
- [ ] utls fingerprint parroting
|
||||||
|
- [ ] Automatic probe selection
|
||||||
|
|
||||||
|
### Phase 2: Deep Bypass (Sprint 6)
|
||||||
|
- [ ] MIMIC_DNS skin (DoH tunnel)
|
||||||
|
- [ ] ECH support (Encrypted Client Hello)
|
||||||
|
- [ ] Active probing defenses
|
||||||
|
- [ ] Multi-path agility
|
||||||
|
|
||||||
|
### Phase 3: Advanced (Sprint 7)
|
||||||
|
- [ ] MIMIC_VIDEO skin (HLS framing)
|
||||||
|
- [ ] Distribution matching from real captures
|
||||||
|
- [ ] Steganography (generative only)
|
||||||
|
- [ ] Formal security audit
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
## Kenya Compliance Check
|
||||||
|
|
||||||
|
| Skin | RAM | Binary Size | Cloud Calls | Viable? |
|
||||||
|
|------|-----|-------------|-------------|---------|
|
||||||
|
| RAW | <1MB | +0KB | None | ✅ |
|
||||||
|
| MIMIC_HTTPS | <2MB | +50KB (TLS) | None (embedded TLS) | ✅ |
|
||||||
|
| MIMIC_DNS | <1MB | +10KB | DoH to public resolver | ✅ |
|
||||||
|
| MIMIC_VIDEO | <2MB | +20KB (HLS) | None | ✅ |
|
||||||
|
| STEGO | >100MB | +500MB (ML models) | Image host upload | ❌ |
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
## Security Considerations
|
||||||
|
|
||||||
|
### TLS Fingerprinting (Critical)
|
||||||
|
**Risk:** Rustls default JA3 signature is trivially blockable.
|
||||||
|
**Mitigation:** Mandatory utls parroting; exact Chrome/Firefox match.
|
||||||
|
|
||||||
|
### DNS Tunnel Detectability (High)
|
||||||
|
**Risk:** Base32 subdomains have high entropy (4.8 vs 2.5 bits/char).
|
||||||
|
**Mitigation:** Use DoH to major providers; dictionary-word labels.
|
||||||
|
|
||||||
|
### Flow Correlation (Medium)
|
||||||
|
**Risk:** Long-term traffic statistics identify protocol.
|
||||||
|
**Mitigation:** PNG epoch rotation; per-session uniqueness.
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
## References
|
||||||
|
|
||||||
|
1. **utls:** [github.com/refraction-networking/utls](https://github.com/refraction-networking/utls) — TLS fingerprint parroting
|
||||||
|
2. **Snowflake:** [Tor Project](https://snowflake.torproject.org/) — WebRTC pluggable transport
|
||||||
|
3. **Conjure:** [refraction.network](https://refraction.network/) — Refraction networking
|
||||||
|
4. **ECH:** RFC 9446 — Encrypted Client Hello
|
||||||
|
5. **DoH:** RFC 8484 — DNS over HTTPS
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
*"The submarine wears chameleon skin. The hull remains the same."*
|
||||||
|
⚡️
|
||||||
|
|
@ -0,0 +1,251 @@
|
||||||
|
Feature: RFC-0015 Polymorphic Noise Generator (PNG)
|
||||||
|
As a Libertaria protocol developer
|
||||||
|
I want cryptographically secure per-session traffic shaping
|
||||||
|
So that state-level DPI cannot fingerprint or correlate sessions
|
||||||
|
|
||||||
|
Background:
|
||||||
|
Given the PNG is initialized with ChaCha20 RNG
|
||||||
|
And the entropy source is the ECDH shared secret
|
||||||
|
|
||||||
|
# ============================================================================
|
||||||
|
# Seed Derivation and Determinism
|
||||||
|
# ============================================================================
|
||||||
|
|
||||||
|
Scenario: PNG seed derives from ECDH shared secret
|
||||||
|
Given Alice and Bob perform X25519 ECDH
|
||||||
|
And the shared secret is 32 bytes
|
||||||
|
When Alice derives PNG seed via HKDF-SHA256
|
||||||
|
And Bob derives PNG seed via HKDF-SHA256
|
||||||
|
Then both seeds should be 256 bits
|
||||||
|
And the seeds should be identical
|
||||||
|
And the derivation should use "Libertaria-PNG-v1" as context
|
||||||
|
|
||||||
|
Scenario: Different sessions produce different seeds
|
||||||
|
Given Alice and Bob perform ECDH for Session A
|
||||||
|
And Alice and Bob perform ECDH for Session B
|
||||||
|
When PNG seeds are derived for both sessions
|
||||||
|
Then the seeds should be different
|
||||||
|
And the Hamming distance should be ~128 bits
|
||||||
|
|
||||||
|
Scenario: PNG seed has sufficient entropy
|
||||||
|
Given 1000 independent ECDH handshakes
|
||||||
|
When PNG seeds are derived for all sessions
|
||||||
|
Then no seed collisions should occur
|
||||||
|
And the distribution should pass Chi-square randomness test
|
||||||
|
|
||||||
|
# ============================================================================
|
||||||
|
# Epoch Profile Generation
|
||||||
|
# ============================================================================
|
||||||
|
|
||||||
|
Scenario: Epoch profile contains all noise parameters
|
||||||
|
Given a PNG with valid seed
|
||||||
|
When the first epoch profile is generated
|
||||||
|
Then it should contain size_distribution variant
|
||||||
|
And size_mean and size_stddev parameters
|
||||||
|
And timing_distribution variant
|
||||||
|
And timing_lambda parameter
|
||||||
|
And dummy_probability between 0.0 and 0.15
|
||||||
|
And epoch_packet_count between 100 and 1000
|
||||||
|
|
||||||
|
Scenario: Sequential epochs are deterministic
|
||||||
|
Given a PNG with seed S
|
||||||
|
When epoch 0 profile is generated
|
||||||
|
And epoch 1 profile is generated
|
||||||
|
And a second PNG with same seed S
|
||||||
|
When epoch 0 and 1 profiles are generated again
|
||||||
|
Then all corresponding epochs should match exactly
|
||||||
|
|
||||||
|
Scenario: Different seeds produce uncorrelated epochs
|
||||||
|
Given PNG A with seed S1
|
||||||
|
And PNG B with seed S2
|
||||||
|
When 10 epochs are generated for both
|
||||||
|
Then size_mean of corresponding epochs should not correlate
|
||||||
|
And timing_lambda values should not correlate
|
||||||
|
And Kolmogorov-Smirnov test should show different distributions
|
||||||
|
|
||||||
|
# ============================================================================
|
||||||
|
# Packet Size Noise
|
||||||
|
# ============================================================================
|
||||||
|
|
||||||
|
Scenario Outline: Packet size distributions match theoretical models
|
||||||
|
Given the epoch profile specifies <distribution> distribution
|
||||||
|
And size_mean = <mean> bytes
|
||||||
|
And size_stddev = <stddev> bytes
|
||||||
|
When 10000 packet sizes are sampled
|
||||||
|
Then the empirical distribution should match theoretical <distribution>
|
||||||
|
And the Chi-square test p-value should be > 0.05
|
||||||
|
|
||||||
|
Examples:
|
||||||
|
| distribution | mean | stddev |
|
||||||
|
| Normal | 1440 | 200 |
|
||||||
|
| Pareto | 1440 | 400 |
|
||||||
|
| Bimodal | 1200 | 300 |
|
||||||
|
| LogNormal | 1500 | 250 |
|
||||||
|
|
||||||
|
Scenario: Packet sizes stay within valid bounds
|
||||||
|
Given any epoch profile
|
||||||
|
When packet sizes are sampled
|
||||||
|
Then all sizes should be >= 64 bytes
|
||||||
|
And all sizes should be <= 1500 bytes (Ethernet MTU)
|
||||||
|
And sizes should never exceed interface MTU
|
||||||
|
|
||||||
|
Scenario: Bimodal distribution matches video streaming
|
||||||
|
Given video streaming capture data
|
||||||
|
And epoch specifies Bimodal distribution
|
||||||
|
When PNG samples packet sizes
|
||||||
|
Then the two modes should be at ~600 bytes and ~1440 bytes
|
||||||
|
And the ratio should be approximately 1:3
|
||||||
|
And the distribution should match YouTube 1080p captures
|
||||||
|
|
||||||
|
# ============================================================================
|
||||||
|
# Timing Noise (Inter-packet Jitter)
|
||||||
|
# ============================================================================
|
||||||
|
|
||||||
|
Scenario Outline: Timing distributions match theoretical models
|
||||||
|
Given the epoch profile specifies <distribution> timing
|
||||||
|
And timing_lambda = <lambda>
|
||||||
|
When 10000 inter-packet delays are sampled
|
||||||
|
Then the empirical distribution should match theoretical <distribution>
|
||||||
|
|
||||||
|
Examples:
|
||||||
|
| distribution | lambda |
|
||||||
|
| Exponential | 0.01 |
|
||||||
|
| Gamma | 0.005 |
|
||||||
|
| Pareto | 0.001 |
|
||||||
|
|
||||||
|
Scenario: Timing jitter prevents clock skew attacks
|
||||||
|
Given an adversary measures inter-packet timing
|
||||||
|
When the PNG applies jitter with Exponential distribution
|
||||||
|
Then the coefficient of variation should be high (>0.5)
|
||||||
|
And timing side-channel attacks should fail
|
||||||
|
|
||||||
|
Scenario: Maximum latency bound enforcement
|
||||||
|
Given real-time voice application requirements
|
||||||
|
And maximum acceptable latency of 500ms
|
||||||
|
When timing noise is applied
|
||||||
|
Then no single packet should be delayed >500ms
|
||||||
|
And 99th percentile latency should be <300ms
|
||||||
|
|
||||||
|
# ============================================================================
|
||||||
|
# Dummy Packet Injection
|
||||||
|
# ============================================================================
|
||||||
|
|
||||||
|
Scenario: Dummy injection rate follows probability
|
||||||
|
Given dummy_probability = 0.10 (10%)
|
||||||
|
When 10000 transmission opportunities occur
|
||||||
|
Then approximately 1000 dummy packets should be injected
|
||||||
|
And the binomial 95% confidence interval should contain the count
|
||||||
|
|
||||||
|
Scenario: Dummy packets are indistinguishable from real
|
||||||
|
Given a mix of real and dummy packets
|
||||||
|
When examined by adversary
|
||||||
|
Then packet sizes should have same distribution
|
||||||
|
And timing should follow same patterns
|
||||||
|
And entropy analysis should not distinguish them
|
||||||
|
|
||||||
|
Scenario: Bursty dummy injection pattern
|
||||||
|
Given dummy_distribution = Bursty
|
||||||
|
And dummy_probability = 0.15
|
||||||
|
When dummies are injected
|
||||||
|
Then they should arrive in clusters (bursts)
|
||||||
|
And inter-burst gaps should follow exponential distribution
|
||||||
|
And intra-burst timing should be rapid
|
||||||
|
|
||||||
|
# ============================================================================
|
||||||
|
# Epoch Rotation
|
||||||
|
# ============================================================================
|
||||||
|
|
||||||
|
Scenario: Epoch rotates after packet count threshold
|
||||||
|
Given epoch_packet_count = 500
|
||||||
|
When 499 packets are transmitted
|
||||||
|
Then the profile should remain unchanged
|
||||||
|
When the 500th packet is transmitted
|
||||||
|
Then epoch rotation should trigger
|
||||||
|
And a new epoch profile should be generated
|
||||||
|
|
||||||
|
Scenario: Epoch rotation preserves session state
|
||||||
|
Given an active encrypted session
|
||||||
|
And epoch rotation triggers
|
||||||
|
When the new epoch begins
|
||||||
|
Then encryption keys should remain valid
|
||||||
|
And sequence numbers should continue monotonically
|
||||||
|
And no rekeying should be required
|
||||||
|
|
||||||
|
Scenario: Maximum epoch duration prevents indefinite exposure
|
||||||
|
Given epoch_packet_count = 1000
|
||||||
|
And a low-bandwidth application sends 1 packet/minute
|
||||||
|
When 60 minutes elapse with only 60 packets
|
||||||
|
Then the epoch should rotate anyway (time-based fallback)
|
||||||
|
And the maximum epoch duration should be 10 minutes
|
||||||
|
|
||||||
|
# ============================================================================
|
||||||
|
# Integration with Transport Skins
|
||||||
|
# ============================================================================
|
||||||
|
|
||||||
|
Scenario: PNG noise applied before skin wrapping
|
||||||
|
Given MIMIC_HTTPS skin is active
|
||||||
|
And an LWF frame of 1350 bytes
|
||||||
|
When PNG adds padding noise
|
||||||
|
Then the total size should follow epoch's distribution
|
||||||
|
And the padding should be added before TLS encryption
|
||||||
|
And the WebSocket frame should contain padded payload
|
||||||
|
|
||||||
|
Scenario: PNG noise subtraction by receiving peer
|
||||||
|
Given PNG adds 50 bytes of padding to a packet
|
||||||
|
When the packet arrives at destination
|
||||||
|
And the peer uses same PNG seed
|
||||||
|
Then the padding should be identifiable
|
||||||
|
And the original 1350-byte LWF frame should be recoverable
|
||||||
|
|
||||||
|
Scenario: Different skins use same PNG instance
|
||||||
|
Given a session starts with RAW skin
|
||||||
|
And PNG is seeded
|
||||||
|
When skin switches to MIMIC_HTTPS
|
||||||
|
Then the PNG should continue same epoch sequence
|
||||||
|
And noise patterns should remain consistent
|
||||||
|
|
||||||
|
# ============================================================================
|
||||||
|
# Statistical Security Tests
|
||||||
|
# ============================================================================
|
||||||
|
|
||||||
|
Scenario: NIST SP 800-22 randomness tests
|
||||||
|
Given 1MB of PNG output (ChaCha20 keystream)
|
||||||
|
When subjected to NIST statistical test suite
|
||||||
|
Then all 15 tests should pass
|
||||||
|
Including Frequency, Runs, FFT, Template matching
|
||||||
|
|
||||||
|
Scenario: Dieharder randomness tests
|
||||||
|
Given 10MB of PNG output
|
||||||
|
When subjected to Dieharder test suite
|
||||||
|
Then no tests should report "WEAK" or "FAILED"
|
||||||
|
|
||||||
|
Scenario: Avalanche effect on seed changes
|
||||||
|
Given PNG seed S1 produces output stream O1
|
||||||
|
When one bit is flipped in seed (S2 = S1 XOR 0x01)
|
||||||
|
And output stream O2 is generated
|
||||||
|
Then O1 and O2 should differ in ~50% of bits
|
||||||
|
And the correlation coefficient should be ~0
|
||||||
|
|
||||||
|
# ============================================================================
|
||||||
|
# Performance and Resource Usage
|
||||||
|
# ============================================================================
|
||||||
|
|
||||||
|
Scenario: PNG generation is fast enough for line rate
|
||||||
|
Given 1 Gbps network interface
|
||||||
|
And 1500 byte packets
|
||||||
|
When PNG generates noise for each packet
|
||||||
|
Then generation time should be <1μs per packet
|
||||||
|
And CPU usage should be <5% of one core
|
||||||
|
|
||||||
|
Scenario: PNG memory footprint is minimal
|
||||||
|
Given the PNG is initialized
|
||||||
|
When measuring memory usage
|
||||||
|
Then ChaCha20 state should use ≤136 bytes
|
||||||
|
And epoch profile should use ≤64 bytes
|
||||||
|
And total PNG overhead should be <1KB per session
|
||||||
|
|
||||||
|
Scenario: PNG works on constrained devices
|
||||||
|
Given a device with 10MB RAM (Kenya compliance)
|
||||||
|
When 1000 concurrent sessions are active
|
||||||
|
Then total PNG memory should be <10MB
|
||||||
|
And each session PNG overhead should be <10KB
|
||||||
|
|
@ -0,0 +1,214 @@
|
||||||
|
Feature: RFC-0015 Pluggable Transport Skins
|
||||||
|
As a Libertaria node operator in a censored region
|
||||||
|
I want to automatically select camouflaged transport protocols
|
||||||
|
So that my traffic evades detection by state-level DPI (GFW, RKN, etc.)
|
||||||
|
|
||||||
|
Background:
|
||||||
|
Given the L0 transport layer is initialized
|
||||||
|
And the node has a valid relay endpoint configuration
|
||||||
|
And the Polymorphic Noise Generator (PNG) is seeded with ECDH secret
|
||||||
|
|
||||||
|
# ============================================================================
|
||||||
|
# Skin Selection and Probing
|
||||||
|
# ============================================================================
|
||||||
|
|
||||||
|
Scenario: Automatic skin selection succeeds with RAW UDP
|
||||||
|
Given the network allows outbound UDP to port 7844
|
||||||
|
When the skin probe sequence starts
|
||||||
|
And the RAW UDP probe completes within 100ms
|
||||||
|
Then the transport skin should be "RAW"
|
||||||
|
And the LWF frames should be sent unmodified over UDP
|
||||||
|
|
||||||
|
Scenario: Automatic skin selection falls back to HTTPS
|
||||||
|
Given the network blocks UDP port 7844
|
||||||
|
And HTTPS traffic to port 443 is allowed
|
||||||
|
When the RAW UDP probe times out after 100ms
|
||||||
|
And the HTTPS WebSocket probe completes within 500ms
|
||||||
|
Then the transport skin should be "MIMIC_HTTPS"
|
||||||
|
And the LWF frames should be wrapped in WebSocket frames over TLS 1.3
|
||||||
|
|
||||||
|
Scenario: Automatic skin selection falls back to DNS tunnel
|
||||||
|
Given the network blocks all UDP except DNS
|
||||||
|
And blocks HTTPS to non-whitelisted domains
|
||||||
|
When the RAW UDP probe times out
|
||||||
|
And the HTTPS probe times out after 500ms
|
||||||
|
And the DNS DoH probe completes within 1s
|
||||||
|
Then the transport skin should be "MIMIC_DNS"
|
||||||
|
And the LWF frames should be encoded as DNS queries over HTTPS
|
||||||
|
|
||||||
|
Scenario: Automatic skin selection reaches nuclear option
|
||||||
|
Given the network implements deep packet inspection on all protocols
|
||||||
|
And all previous probes fail
|
||||||
|
When the probe sequence reaches the steganography fallback
|
||||||
|
Then the transport skin should be "STEGO_IMAGE"
|
||||||
|
And the user should be warned of extreme latency
|
||||||
|
|
||||||
|
# ============================================================================
|
||||||
|
# Polymorphic Noise Generator (PNG)
|
||||||
|
# ============================================================================
|
||||||
|
|
||||||
|
Scenario: PNG generates per-session unique noise
|
||||||
|
Given two independent sessions to the same relay
|
||||||
|
And both sessions complete ECDH handshake
|
||||||
|
When Session A derives PNG seed from shared secret
|
||||||
|
And Session B derives PNG seed from its shared secret
|
||||||
|
Then the PNG seeds should be different
|
||||||
|
And the epoch profiles should be different
|
||||||
|
And the packet size distributions should not correlate
|
||||||
|
|
||||||
|
Scenario: PNG generates deterministic noise for session peers
|
||||||
|
Given a single session between Alice and Bob
|
||||||
|
And they complete ECDH handshake
|
||||||
|
When Alice derives PNG seed from shared secret
|
||||||
|
And Bob derives PNG seed from same shared secret
|
||||||
|
Then the PNG seeds should be identical
|
||||||
|
And Alice's noise can be subtracted by Bob
|
||||||
|
|
||||||
|
Scenario: PNG epoch rotation prevents long-term analysis
|
||||||
|
Given a session using MIMIC_HTTPS skin
|
||||||
|
And the epoch length is set to 500 packets
|
||||||
|
When 499 packets have been transmitted
|
||||||
|
Then the packet size distribution should follow Profile A
|
||||||
|
When the 500th packet is transmitted
|
||||||
|
Then the epoch should rotate
|
||||||
|
And the packet size distribution should follow Profile B
|
||||||
|
And Profile B should be different from Profile A
|
||||||
|
|
||||||
|
Scenario: PNG matches real-world distributions
|
||||||
|
Given MIMIC_HTTPS skin with Netflix emulation
|
||||||
|
When the PNG samples packet sizes
|
||||||
|
Then the distribution should be Pareto with mean 1440 bytes
|
||||||
|
And the distribution should match Netflix video chunk captures
|
||||||
|
|
||||||
|
# ============================================================================
|
||||||
|
# MIMIC_HTTPS Skin (WebSocket over TLS)
|
||||||
|
# ============================================================================
|
||||||
|
|
||||||
|
Scenario: HTTPS skin mimics Chrome TLS fingerprint
|
||||||
|
Given the transport skin is "MIMIC_HTTPS"
|
||||||
|
When the TLS handshake initiates
|
||||||
|
Then the ClientHello should match Chrome 120 JA3 signature
|
||||||
|
And the cipher suites should match Chrome defaults
|
||||||
|
And the extensions order should match Chrome
|
||||||
|
And the ALPN should be "h2,http/1.1"
|
||||||
|
|
||||||
|
Scenario: HTTPS skin WebSocket handshake looks legitimate
|
||||||
|
Given the transport skin is "MIMIC_HTTPS"
|
||||||
|
When the WebSocket upgrade request is sent
|
||||||
|
Then the HTTP headers should include legitimate User-Agent
|
||||||
|
And the request path should look like a real API endpoint
|
||||||
|
And the Origin header should be set appropriately
|
||||||
|
|
||||||
|
Scenario: HTTPS skin hides LWF magic bytes
|
||||||
|
Given an LWF frame with magic bytes "LWF\0"
|
||||||
|
When wrapped in MIMIC_HTTPS skin
|
||||||
|
Then the wire format should be TLS ciphertext
|
||||||
|
And the magic bytes should not appear in cleartext
|
||||||
|
And DPI signature matching should fail
|
||||||
|
|
||||||
|
Scenario: HTTPS skin with domain fronting
|
||||||
|
Given the relay supports domain fronting
|
||||||
|
And the cover domain is "cdn.cloudflare.com"
|
||||||
|
And the real endpoint is "relay.libertaria.network"
|
||||||
|
When the TLS handshake initiates
|
||||||
|
Then the SNI should be "cdn.cloudflare.com"
|
||||||
|
And the HTTP Host header should be "relay.libertaria.network"
|
||||||
|
|
||||||
|
Scenario: HTTPS skin with ECH (Encrypted Client Hello)
|
||||||
|
Given the relay supports ECH
|
||||||
|
And the client has ECH config for the relay
|
||||||
|
When the TLS handshake initiates
|
||||||
|
Then the ClientHelloInner should contain real SNI
|
||||||
|
And the ClientHelloOuter should have encrypted SNI
|
||||||
|
And passive DPI should not see the real destination
|
||||||
|
|
||||||
|
# ============================================================================
|
||||||
|
# MIMIC_DNS Skin (DoH Tunnel)
|
||||||
|
# ============================================================================
|
||||||
|
|
||||||
|
Scenario: DNS skin uses DoH not raw DNS
|
||||||
|
Given the transport skin is "MIMIC_DNS"
|
||||||
|
When a DNS query is sent
|
||||||
|
Then it should be an HTTPS POST to 1.1.1.1
|
||||||
|
And the Content-Type should be "application/dns-message"
|
||||||
|
And not use raw port 53 UDP
|
||||||
|
|
||||||
|
Scenario: DNS skin avoids high-entropy labels
|
||||||
|
Given the transport skin is "MIMIC_DNS"
|
||||||
|
When encoding LWF data as DNS queries
|
||||||
|
Then subdomain labels should use dictionary words
|
||||||
|
And the Shannon entropy should be < 3.5 bits/char
|
||||||
|
And not use Base32/Base64 encoding
|
||||||
|
|
||||||
|
Scenario: DNS skin matches real DoH timing
|
||||||
|
Given the transport skin is "MIMIC_DNS"
|
||||||
|
When sending queries
|
||||||
|
Then the inter-query timing should follow Gamma distribution
|
||||||
|
And not be perfectly regular
|
||||||
|
And should match Cloudflare DoH query patterns
|
||||||
|
|
||||||
|
# ============================================================================
|
||||||
|
# Anti-Fingerprinting and Active Defense
|
||||||
|
# ============================================================================
|
||||||
|
|
||||||
|
Scenario: Active probe receives honeytrap response
|
||||||
|
Given an adversary sends probe traffic to relay
|
||||||
|
And the probe has no valid session cookie
|
||||||
|
When the relay receives the probe
|
||||||
|
Then it should respond as nginx default server
|
||||||
|
And return HTTP 200 with generic index.html
|
||||||
|
And not reveal itself as Libertaria relay
|
||||||
|
|
||||||
|
Scenario: Rate limiting on failed handshakes
|
||||||
|
Given an adversary attempts rapid handshake scanning
|
||||||
|
When more than 10 failed handshakes occur from same IP in 1 minute
|
||||||
|
Then subsequent connections should be rate limited
|
||||||
|
And exponential backoff should apply
|
||||||
|
|
||||||
|
Scenario: PoW prevents relay enumeration
|
||||||
|
Given the relay requires proof-of-work
|
||||||
|
When a client connects without valid PoW
|
||||||
|
Then the connection should be rejected
|
||||||
|
When a client connects with valid Argon2 PoW (100ms compute)
|
||||||
|
Then the connection should proceed to handshake
|
||||||
|
|
||||||
|
# ============================================================================
|
||||||
|
# Multi-Path Agility
|
||||||
|
# ============================================================================
|
||||||
|
|
||||||
|
Scenario: Primary skin throttling triggers fallback
|
||||||
|
Given primary skin is MIMIC_HTTPS at 90% bandwidth
|
||||||
|
And secondary skin is MIMIC_DNS at 10% bandwidth
|
||||||
|
When GFW detects and throttles HTTPS traffic
|
||||||
|
Then the secondary channel should signal endpoint switch
|
||||||
|
And the primary should migrate to new relay IP
|
||||||
|
|
||||||
|
Scenario: Seamless skin switching without rekeying
|
||||||
|
Given an active session with MIMIC_HTTPS
|
||||||
|
When the skin switches to MIMIC_DNS due to blocking
|
||||||
|
Then the LWF encryption keys should remain valid
|
||||||
|
And no re-handshake should be required
|
||||||
|
And in-flight packets should not be lost
|
||||||
|
|
||||||
|
# ============================================================================
|
||||||
|
# Error Handling and Edge Cases
|
||||||
|
# ============================================================================
|
||||||
|
|
||||||
|
Scenario: All probes fail raises alert
|
||||||
|
Given all network paths are blocked
|
||||||
|
When the skin probe sequence completes
|
||||||
|
And no viable skin is found
|
||||||
|
Then the user should receive "Network severely restricted" alert
|
||||||
|
And manual configuration option should be offered
|
||||||
|
|
||||||
|
Scenario: Skin mid-session failure recovery
|
||||||
|
Given a session is active with MIMIC_HTTPS
|
||||||
|
When the TLS connection drops unexpectedly
|
||||||
|
Then automatic reconnection should attempt same skin first
|
||||||
|
And fallback to next skin after 3 retries
|
||||||
|
|
||||||
|
Scenario: Invalid skin configuration is rejected
|
||||||
|
Given the configuration specifies unknown skin "MIMIC_UNKNOWN"
|
||||||
|
When the transport initializes
|
||||||
|
Then initialization should fail with "Invalid skin"
|
||||||
|
And fallback to automatic selection should occur
|
||||||
Loading…
Reference in New Issue