China is now blocking all encrypted HTTPS traffic using TLS 1.3 and ESNI

guest · Aug 8, 2020

China is now blocking all encrypted HTTPS traffic using TLS 1.3 and ESNI
Block was put in place at the end of July and is enforced via China's Great Firewall internet surveillance technology
August 8, 2020
https://www.zdnet.com/article/china...crypted-https-traffic-using-tls-1-3-and-esni/

The Chinese government is currently using the Great Firewall censorship tool to block certain types of encrypted HTTPS connections.

The block has been in place for more than a week, according to a joint report authored by three organizations tracking Chinese censorship -- iYouPort, the University of Maryland, and the Great Firewall Report.
CHINA NOW BLOCKING HTTPS+TLS1.3+ESNI
Per the report, China's Great Firewall (GFW) is now blocking HTTPS connections set up via the new TLS 1.3 encryption protocol and which use ESNI (Encrypted Server Name Indication).
The reason for the ban is obvious for experts.
Click to expand...

HTTPS connections negotiated via TLS 1.3 and ESNI prevent third-party observers from detecting what website a user is attempting to access. This effectively blinds the Chinese government's Great Firewall surveillance tool from seeing what users are doing online.

There is a myth surrounding HTTPS connections that network observers (such as internet service providers) cannot see what users are doing. This is technically incorrect.
[...] there is a short period before HTTPS connections are established when third-parties can detect to what server the user is connecting.
Click to expand...

According to iYouPort, the University of Maryland, and the Great Firewall Report, the Chinese government is currently dropping all HTTPS connections where TLS 1.3 and ESNI is used and temporarily blocking the IP addresses involved in the connection for between two and three minutes -- depending on the location of the Great Firewall where the "unwanted" connection settings are detected.
Click to expand...

Exposing and Circumventing China's Censorship of ESNI

On 2020-07-30, iyouport reported (archive) the apparent blocking of TLS connections with the encrypted SNI (ESNI) extension in China. iyouport says that the first occurrence of blocking was one day earlier, on 2020-07-29.

We confirm that the Great Firewall (GFW) of China has recently begun blocking ESNI—one of the foundational features of TLS 1.3 and HTTPS. We empirically demonstrate what triggers this censorship and how long residual censorship lasts. We also present several evasion strategies discovered by Geneva that can be run either client-side or server-side to evade blocking.
Details About the Blocking [...]
Click to expand...

guest · Sep 22, 2020

Russia wants to ban the use of secure protocols such as TLS 1.3, DoH, DoT, ESNI
Amendment to IT law would make it illegal to use encryption protocols that fully hide the traffic's destination
September 22, 2020
https://www.zdnet.com/article/russi...ecure-protocols-such-as-tls-1-3-doh-dot-esni/

The Russian government is working on updating its technology laws so it can ban the use of modern internet protocols that can hinder its surveillance and censorship capabilities.

According to a copy of the proposed law amendments and an explanatory note, the ban targets internet protocols and technologies such as TLS 1.3, DoH, DoT, and ESNI.
HTTPS TRAFFIC HAS LEAKS
Today, while HTTPS encrypts the content of an internet connection, there are various techniques that third-parties such as telcos can apply and determine to what site a user is connecting.

The primary two techniques used by telcos today include (1) watching DNS traffic or (2) analyzing the SNI (Server Name Identification) field in HTTPS traffic.
Click to expand...

With TLS 1.3, DoH, DoT, and ESNI gaining adoption, all of Russia's current surveillance and censorship tools will become useless, as they rely on having access to the website identifiers that leak from encrypted web traffic.
And just like China, Russia is cracking down on these new technologies. According to the proposed law amendment, any company or website that uses technology to hide its website identifier in encrypted traffic will be banned inside Russia after a one-day warning.
Click to expand...

guest · Oct 2, 2021

Academics discover hidden layer in China’s Great Firewall
October 2, 2021
https://therecord.media/academics-discover-hidden-layer-in-chinas-great-firewall/

A team of academics from the University of Maryland has discovered a previously hidden layer in China’s Great Firewall censorship system.

Introduced in the late 90s, the Great Firewall (GFW) is a system of middleboxes installed at China’s internet exchange points and internet service providers that allow the government to intercept internet traffic, sniff on its content, and block connections to websites and servers the state doesn’t deem acceptable.
While there are different censorship mechanisms inside China’s Great Firewall that cater to different protocols, its most potent and technically advanced system is the one meant for dealing with HTTPS encrypted web traffic.
Click to expand...

Even if Chinese censors can’t decrypt the content of the actual HTTPS connection, this SNI field allows the Chinese government to block users from accessing unwanted sites.

The second, introduced last year, is similar to the first but caters to HTTPS connections that use modern protocols that encrypt the SNI field (as eSNI).
Academics find parallel HTTPS SNI filtering system
But in a research paper [PDF] published this week, academics from the University of Maryland revealed they found a secondary HTTPS SNI filtering system working in parallel with the first.

“This was actually an accidental discovery, and something we stumbled onto back in 2019,” Kevin Bock, a Ph.D. candidate in the computer science department at the University of Maryland, told The Record in an email.
“We didn’t fully understand it at the time, but since then, our tooling and understanding of the GFW has improved, and now we understand these strange results,” Bock added.
Click to expand...

Bock and his colleagues say the system is just as effective as the first layer in censoring HTTPS traffic, even if it intervenes in the latter stages of a connection.

“This is actually not the first time we’ve discovered the GFW is running multiple middleboxes in parallel – this is just the first time we’ve seen them do it as redundancy for the same protocol,” Bock said.
“This discovery means that the GFW is now running at least three different middleboxes in parallel to censor HTTPS: two for SNI-based connections and another family of middleboxes entirely to censor ESNI-based connections,” the researcher added.
Click to expand...

Research paper: "Even Censors Have a Backup: Examining China’s Double HTTPS Censorship Middleboxes"
(PDF): https://geneva.cs.umd.edu/papers/foci21.pdf

Log in or Sign up

China is now blocking all encrypted HTTPS traffic using TLS 1.3 and ESNI

guest Guest

guest Guest

guest Guest

Log in or Sign up

China is now blocking all encrypted HTTPS traffic using TLS 1.3 and ESNI

guest Guest

guest Guest

guest Guest

Useful Searches