Re: [tor-talk] passive analysis of encrypted traffic and traffic obfuscation

2011-05-17 Thread vecna
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Brandon Wiley wrote: > This is > an interesting method of obfuscation as it seems like it would interfere to > some extent with the three most popular DPI techniques: string matching, > packet lengths, and packet timings. However, like most obfuscation

Re: [tor-talk] passive analysis of encrypted traffic and traffic obfuscation

2011-05-17 Thread Brandon Wiley
Sniffjoke looks interesting. I'm having trouble finding a clear description of what it actually does to the packets to get them past DPI filters. The best description I could find mentions insertion of fake packets which will be discarded by the receiver but which will confuse the filter. [1] This

Re: [tor-talk] passive analysis of encrypted traffic and traffic obfuscation

2011-05-17 Thread Fabio Pietrosanti (naif)
On 5/17/11 11:12 AM, vecna wrote: > Hi tor guys, > > encrypted traffic analysis is an analysis apply to an encrypted session > in order not to disclose the protected data, but to detect the protocol > protected. COOL > 1) try a blocked TOR version in IRAN, to verify if the session is > protec

[tor-talk] passive analysis of encrypted traffic and traffic obfuscation

2011-05-17 Thread vecna
Hi tor guys, encrypted traffic analysis is an analysis apply to an encrypted session in order not to disclose the protected data, but to detect the protocol protected. the IRAN attack in TOR was, more or less, an attack like them. (more or less because was based on the HTTPS pattern, not in an an