3

Whether or not a connection is encrypted, I'm afraid the time an information is sent from one host to another might reveal too much. And I'm literally talking about the time when pieces of information are sent, and not the information itself.

Are there any way to mask when information is sent across a link?

I'm specifically looking for solutions on how to mask when packets are sent via wi-fi to a host in a LAN. But of course, this problem involves more than just wi-fi, and I acknowledge that others might be interested in a solution in the ballpark of what I need, so I'm keeping this question broad.

I'm also acknowledging that there might only ever be a solution for some types of medium, but not all. If that's the case, I'm open to know about solutions for those mediums as well.

Sal Rahman
  • 641
  • 1
  • 5
  • 14
  • 6
    How about just sending dummy data at random times that's similar to the "real" data you're trying to hide - if it's encrypted, its going to be hard for an attacker to know which is real and which is fake as long as the receiving host returns similar dummy data as it would for a real transfer. – Johnny Apr 04 '14 at 04:45
  • Yeah, above comment sums it up pretty well. If you can, make sure that hosts communicate all the time. If that's too prohibitive, make sure they do exchange useless messages as often as practical (and those useless messages must be indistinguishable from valid messages by an attacker). – Andrey Apr 04 '14 at 05:14

2 Answers2

3

So, you're looking at how to handle basic Traffic Analysis?

The basic countermeasures from Wikipedia (the above link) are exactly what I expected:

"It is difficult to defeat traffic analysis without both encrypting messages and masking the channel. When no actual messages are being sent, the channel can be masked by sending dummy traffic, similar to the encrypted traffic, thereby keeping bandwidth usage constant."

The real answer is to set up constant bidirectional traffic, at a fixed bit rate, all going through your current encryption.

Alternately, if you can handle non-realtime data, then simply set up a schedule. Transmit exactly N bytes every M time units in each direction, on slightly different schedules. For instance, machine 1 transmits exactly 8MB at 15 minutes after every hour, and machine 2 transmits exactly 8MB at 45 minutes after every hour, no matter what.

One primitive but easy way to generate the fixed data size is to create a fresh Truecrypt container for every transfer of that size, then dump it over the encrypted link; better ways are no doubt available.

Alternately, change from MB to KB, and from minutes after every hour to seconds after every minute.

You definitely want NTP running properly and reliable on these machines - synchronized clocks are required.

Anti-weakpasswords
  • 9,980
  • 2
  • 25
  • 53
0

I've not used any of their products, but on the Risky Business podcast one of the sponsors slots was for Senetas. They were talking about setting up their equipments to always send fixed sized frames at regular intervals to prevent timing/analytic attacks that can leak information about encrypted data.

I don't think that covers wireless, I got the impression it was only point to point where you have their kit at both ends but it might be something to look at.

Hybrid
  • 4,218
  • 2
  • 23
  • 23