TLS fingerprinting vulns

[klzgrad]

Is the TLS stack used here being audited for fingerprinting potential?

• The cipher list in ClientHello (Tor had this issue).
• Other parameters in ClientHello (I noticed there is no padding. Bad.)
• The certificate format.
• SNI?
• I think in theory the TLS state machine in specific implementations will also have identifying information from its state transition.

[GreaterFire]

Thank you for your report. Can you please specify your listed vulnerabilities so that I can make improvements? For example, I don't know what you mean by SNI. Trojan indeed adds SNI in Client Hello.
BTW, can you elaborate on the reasons we need Client Hello padding?

[klzgrad]

There are no immediate issues to fix as I was just asking if you are aware of the list of potential TLS fingerprinting features because I didn't see any claims in the docs about it and a cursory look found at least the cipher list seemed quite unique. Tor had the lesson of getting detected by the GFW via TLS fingerprinting. It shouldn't be repeated.

[klzgrad]

Merge into #13.