Chad Brubaker, Amir Houmansadr, and Vitaly Shmatikov.

Proceedings on Privacy Enhancing Technologies 2018,3 (2018), 43-62. Secure asymmetry and deployability for decoy routing systems.

In 23rd ACM Conference on Computer and Communications Security (CCS). Slitheen: Perfectly imitated decoyrouting through traffic replacement. In 20th ACM Conference on Computer and Communications Security (CCS). Elligator: Elliptic-curve points indistinguishable from uniform random strings.

Daniel J Bernstein, Mike Hamburg, Anna Krasnova, and Tanja Lange.

Our results suggest that Conjure can be harder to block than TapDance, is simpler to maintain and deploy, and offers substantially better network performance. We define the Conjure protocol, analyze its security, and evaluate a prototype using an ISP testbed. These phantom hosts are difficult for a censor to distinguish from real ones, but can be used by clients as proxies. Instead of using real websites as the decoy destinations for proxy connections, our scheme connects to IP addresses where no web server exists leveraging proxy functionality from the core of the network. We present Conjure, an improved Refraction Networking approach that overcomes these limitations by leveraging unused address space at deploying ISPs.

These challenges may impede broader deployment and ultimately allow censors to block such techniques.

While one Refraction scheme, TapDance, has recently been deployed at ISP-scale, it suffers from several problems: a limited number of 'decoy' sites in realistic deployments, high technical complexity, and undesirable tradeoffs between performance and observability by the censor. Any connection that traverses these ISPs could be a conduit for the free flow of information, so censors cannot easily block access without also blocking many legitimate sites. Rather than trying to hide individual circumvention proxy servers from censors, proxy functionality is implemented in the core of the network, at cooperating ISPs in friendly countries. Refraction Networking (formerly known as 'Decoy Routing') has emerged as a promising next-generation approach for circumventing Internet censorship.

Psiphon amazon aws