State Machine Frameworks for Website Fingerprinting Defenses: Maybe Not

Abstract

Tor is an anonymity network used by millions of people every day to evade censorship and protect their browsing activity from privacy threats such as mass surveillance. Unfortunately, Tor has been shown to be vulnerable to website fingerprinting attacks, in which an adversary observes the connection between a user and the Tor network and uses features of the encrypted traffic, such as the timing and volume of packets, to identify the websites that are being visited. In response, researchers have proposed a number of defenses against website fingerprinting attacks, and a "circuit padding framework" has been added to the Tor software which supports the implementation of defenses. However, many proposed defenses are not supported by this framework, and no defenses are currently present in Tor. As Arti, a reimplementation of Tor in Rust, is being developed, the issue arises of whether a new state machine framework should be included or if alternative models should instead be considered for future defense implementation. We address this question by using an improved Rust-based state machine framework, Maybenot, to implement three state-of-the-art website fingerprinting defenses. Through our evaluation, we demonstrate the potential of state machine frameworks to support effective defenses, and we highlight important features that they should contain to do so. However, our evaluation also raises uncertainty about the long-term feasibility of state machine frameworks for defense implementation. We recommend enhancements to Maybenot and substantial further evaluation, along with consideration of alternative designs, before any decision is made regarding a mechanism for implementing website fingerprinting defenses in Arti.