{"action":"created","issue":{"url":"https://api.github.com/repos/v2ray/v2ray-core/issues/224","repository_url":"https://api.github.com/repos/v2ray/v2ray-core","labels_url":"https://api.github.com/repos/v2ray/v2ray-core/issues/224/labels{/name}","comments_url":"https://api.github.com/repos/v2ray/v2ray-core/issues/224/comments","events_url":"https://api.github.com/repos/v2ray/v2ray-core/issues/224/events","html_url":"https://github.com/v2ray/v2ray-core/issues/224","id":168455639,"number":224,"title":"Proposal: Surveillance proof proxy connection with plausible deniability. ","user":{"login":"xiaokangwang","id":1883569,"avatar_url":"https://avatars.githubusercontent.com/u/1883569?v=3","gravatar_id":"","url":"https://api.github.com/users/xiaokangwang","html_url":"https://github.com/xiaokangwang","followers_url":"https://api.github.com/users/xiaokangwang/followers","following_url":"https://api.github.com/users/xiaokangwang/following{/other_user}","gists_url":"https://api.github.com/users/xiaokangwang/gists{/gist_id}","starred_url":"https://api.github.com/users/xiaokangwang/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/xiaokangwang/subscriptions","organizations_url":"https://api.github.com/users/xiaokangwang/orgs","repos_url":"https://api.github.com/users/xiaokangwang/repos","events_url":"https://api.github.com/users/xiaokangwang/events{/privacy}","received_events_url":"https://api.github.com/users/xiaokangwang/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":11,"created_at":"2016-07-30T07:53:23Z","updated_at":"2016-08-04T11:50:41Z","closed_at":null,"body":"I was thinking about implementing a new transport, so that an observer will identify connection it create as valid TLS connection to an well-known site.\r\n\r\nThis transport consists of two parts, the first one will harvest the certifications from other sites, the content harvested also include offered encryption methods, signatures for key exchange if connection have perfect forward secrecy.\r\n\r\nThe rest part will integrated with your program, which will utilize content we have harvested. Before key change, both client and server will replay the content is harvested, incuding SNI, preferred encryption method and more if possible.  As for key exchange, for connections without PFS, server will use the pre-shared key as content it decrypted by its server private key as if it own the key. The client will also use the pre-shared key as content it encrypted with server's public key. Both side will compute the session key from client random, server random and pre-shared key. An observer will not be able to notice that server does not actually own the private key for the certificate it provided to client. For connections with FPS, we will send the the DH or ECDH info with harvested signature(both info and signature are harvested), both client and server will ignore the key from DH and use pre-shared key as key exchange result. The computation of session key is similar to that of non-PFS connections. The observer might notice the DH or ECDH info never change or have a limited possibility, but have no way to deduce if server have the private key.\r\n\r\n Currently, the use of TLS connection in v2ray is more complicated than an ordinary user can accept, as the issue of valid certificate follows a secure routine which can be hard to follow. The certificate user used is often self-signed which can be easy to detect or block. Even using the certificate from valid CA can raise notice as the observer can discover the user of V2Ray is accessing a uncommon site. In both case, the surveillance system can detect unusual event and could trigger an alert to authority.  With the use of certificate harvested, government might think twice before block our connection."},"comment":{"url":"https://api.github.com/repos/v2ray/v2ray-core/issues/comments/237530982","html_url":"https://github.com/v2ray/v2ray-core/issues/224#issuecomment-237530982","issue_url":"https://api.github.com/repos/v2ray/v2ray-core/issues/224","id":237530982,"user":{"login":"xiaokangwang","id":1883569,"avatar_url":"https://avatars.githubusercontent.com/u/1883569?v=3","gravatar_id":"","url":"https://api.github.com/users/xiaokangwang","html_url":"https://github.com/xiaokangwang","followers_url":"https://api.github.com/users/xiaokangwang/followers","following_url":"https://api.github.com/users/xiaokangwang/following{/other_user}","gists_url":"https://api.github.com/users/xiaokangwang/gists{/gist_id}","starred_url":"https://api.github.com/users/xiaokangwang/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/xiaokangwang/subscriptions","organizations_url":"https://api.github.com/users/xiaokangwang/orgs","repos_url":"https://api.github.com/users/xiaokangwang/repos","events_url":"https://api.github.com/users/xiaokangwang/events{/privacy}","received_events_url":"https://api.github.com/users/xiaokangwang/received_events","type":"User","site_admin":false},"created_at":"2016-08-04T11:50:41Z","updated_at":"2016-08-04T11:50:41Z","body":"I am not implementing WebSocket, just considering to use Websocket as a transport to discourage recognize. The websocket is already available as a official [repo](https://godoc.org/golang.org/x/net/websocket).  "}}
{"actor":{"display_login":"xiaokangwang"}}