Sambhav Satija
ABSTRACT
Governments across the globe limit which sites their citizens can visit by employing multiple kinds of censorship techniques for different types of traffic. ISPs have been able to effectively censor HTTPS traffic by inspecting the TLS handshake which leaks the domain being visited. TLS1.3 attempts to solve this with a proposed ESNI extension which encrypts the SNI (server name indication) value. Since ESNI is optional, ISPs have been known to simply drop handshakes that attempt to use it; SNI based censorship is therefore still a problem even in TLS1.3. We present BlindTLS, a technique that hides the true SNI value in TLS1.2. BlindTLS requires no server modifications and expects only minimal (existing) external infrastructure to circumvent TLS-based censorship. We evaluate and show that BlindTLS is able to successfully provide access to a majority of websites blocked by a real-world ISP with minimal performance overhead.
References
- Giuseppe Aceto, Alessio Botta, Antonio Pescapè, Nick Feamster, M Faheem Awan, Tahir Ahmad, and Saad Qaisar. 2015. Monitoring Internet censorship with UBICA. In International Workshop on Traffic Monitoring and Analysis. Springer, 143--157.Google Scholar
Cross Ref
- Kevin Bock, Yair Fax, Kyle Reese, Jasraj Singh, and Dave Levin. 2020. Detecting and Evading Censorship-in-Depth: A Case Study of Iran's Protocol Whitelister. In 10th USENIX Workshop on Free and Open Communications on the Internet (FOCI 20). USENIX Association. https://www.usenix.org/conference/foci20/presentation/bockGoogle Scholar
- Zimo Chai, Amirhossein Ghafari, and Amir Houmansadr. 2019. On the importance of encrypted-SNI ({ESNI}) to censorship circumvention. In 9th {USENIX} Workshop on Free and Open Communications on the Internet ({FOCI} 19).Google Scholar
- CloudFlare Christopher Patton. 2020. Good-bye ESNI, hello ECH! https://blog.cloudflare.com/encrypted-client-hello/. (2020).Google Scholar
- Cloudflare. 2021. TLS Session Resumption: Full-speed and Secure. https://blog.cloudflare.com/tls-session-resumption-full-speed-and-secure/. (2021).Google Scholar
- Roger Dingledine, Nick Mathewson, and Paul Syverson. 2004. Tor: The Second-Generation Onion Router. In Proceedings of the 13th Conference on USENIX Security Symposium - Volume 13 (SSYM'04). USENIX Association, USA, 21.Google ScholarDigital Library
- Eric Doerr. 2021. Securing our approach to domain fronting within Azure. https://www.microsoft.com/security/blog/2021/03/26/securing-our-approach-to-domain-fronting-within-azure/. (2021).Google Scholar
- N. Sullivan E. Rescorla, K. Oku. 2020. TLS Encrypted Client Hello. RFC. https://tools.ietf.org/html/draft-ietf-tls-esni-08Google Scholar
- D. Eastlake. 2011. Transport Layer Security (TLS) Extensions: Extension Definitions. RFC 6066.Google Scholar
- David Fifield, Chang Lan, Rod Hynes, Percy Wegmann, and Vern Paxson. 2015. Blocking-resistant communication through domain fronting. Proceedings on Privacy Enhancing Technologies 2015, 2 (2015), 46--64.Google ScholarCross Ref
- P. Hoffman and P. McManus. 2018. DNS Queries over HTTPS (DoH). RFC 8484.Google Scholar
- Z. Hu, L. Zhu, J. Heidemann, A. Mankin, D. Wessels, and P. Hoffman. 2016. Specification for DNS over Transport Layer Security (TLS). RFC 7858.Google Scholar
- Erik Hunstad. 2020. New tool brings back 'domain fronting' as 'domain hiding'. https://www.zdnet.com/article/def-con-new-tool-brings-back-domain-fronting-as-domain-hiding/. (2020).Google Scholar
- Josh Karlin, Daniel Ellard, Alden W Jackson, Christine E Jones, Greg Lauer, David Mankins, and W Timothy Strayer. 2011. Decoy Routing: Toward Unblockable Internet Communication.. In FOCI.Google Scholar
- Dave Levin Kevin Bock. 2020. Exposing and Circumventing China's Censorship of ESNI. https://gfw.report/blog/gfw_esni_blocking/en/. (2020).Google Scholar
- David Lazar, Yossi Gilad, and Nickolai Zeldovich. 2018. Karaoke: Distributed Private Messaging Immune to Passive Traffic Analysis. In 13th USENIX Symposium on Operating Systems Design and Implementation (OSD1 18). USENIX Association, Carlsbad, CA, 711--725. https://www.usenix.org/conference/osdi18/presentation/lazarGoogle Scholar
- LetsEncrypt. 2021. HTTPS stats. https://letsencrypt.org/stats. (2021).Google Scholar
- Colm MacCarthaigh. 2018. Enhanced Domain Protections for Amazon CloudFront Requests. https://aws.amazon.com/blogs/security/enhanced-domain-protections-for-amazon-cloudfront-requests/. (2018).Google Scholar
- Victoria Manfredi and Pi Songkuntham. 2018. MultiFlow: Cross-Connection Decoy Routing using {TLS} 1.3 Session Resumption. In 8th {USENIX} Workshop on Free and Open Communications on the Internet ({FOCI} 18).Google Scholar
- Daiyuu Nobori and Yasushi Shinjo. 2014. VPN Gate: A Volunteer-Organized Public VPN Relay System with Blocking Resistance for Bypassing Government Censorship Firewalls. In 11th USENIX Symposium on Networked Systems Design and Implementation (NSD1 14). USENIX Association, Seattle, WA, 229--241. https://www.usenix.org/conference/nsdi14/technical-sessions/presentation/noboriGoogle Scholar
- Telecom Regulatory Authority of India. 2021. Telecom Subscription Data as on 28th February, 2021. https://www.trai.gov.in/sites/default/files/PR_No.27of2021_0.pdf. (2021).Google Scholar
- Proton. 2020. Proton VPN. https://protonvpn.com/. (2020).Google Scholar
- E. Rescorla. 2018. The Transport Layer Security (TLS) Protocol Version 1.3. RFC 8446.Google Scholar
- J. Salowey, H. Zhou, P. Eronen, and H. Tschofenig. 2008. Transport Layer Security (TLS) Session Resumption without Server-Side State. RFC 5077.Google Scholar
- Kushagra Singh, Gurshabad Grover, and Varun Bansal. 2020. How India Censors the Web. In 12th ACM Conference on Web Science (WebSci '20). Association for Computing Machinery, New York, NY, USA, 21--28. https://doi.org/10.1145/3394231.3397891Google Scholar
- The OpenSSL Project. 2003. OpenSSL: The Open Source toolkit for SSL/TLS. (April 2003). www.openssl.org.Google Scholar
- Tor. 2021. Tor BridgeDB. https://bridges.torproject.org/bridges. (2021).Google Scholar
- W3Techs. 2020. Usage statistics and market share of Cloudflare. https://w3techs.com/technologies/details/cn-cloudflare. (2020).Google Scholar
- Tarun Kumar Yadav, Akshat Sinha, Devashish Gosain, Piyush Kumar Sharma, and Sambuddho Chakravarty. 2018. Where The Light Gets In: Analyzing Web Censorship Mechanisms in India. In Proceedings of the Internet Measurement Conference 2018 (IMC '18). Association for Computing Machinery, New York, NY, USA, 252--264. https://doi.org/10.1145/3278532.3278555Google ScholarDigital Library
Index Terms
BlindTLS: Circumventing TLS-based HTTPS censorship
Comments