security(anti-dpi): data-plane obf key is not rotated per epoch — 2^32 obf-nonce birthday bound over the whole connection lifetime #105
Labels
No labels
bug
documentation
duplicate
enhancement
good first issue
help wanted
invalid
question
wontfix
No milestone
No project
No assignees
1 participant
Notifications
Due date
No due date set.
Dependencies
No dependencies set
Reference
femboy/yip#105
Loading…
Reference in a new issue
No description provided.
Delete branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
session_obf_key is derived once at cold start and deliberately not rotated across rekeys (documented in handle_rekey_resp). The obf envelope is SipHash-CTR XOR keyed by (session_obf_key, 8-byte random nonce). With a fixed key for the connection's whole life, nonce collisions arrive at the ~2^32 birthday bound (~1h at 1e6 pps); a collision XORs two masked regions, leaking the XOR of their type||len headers and inner-AEAD ciphertexts (inner AEAD keeps content secret — statistical regularity, not a confidentiality break, but exactly what the anti-DPI layer exists to avoid). Fix: rotate the obf key per epoch (resync via epoch material) or widen the nonce / make it random||counter.
See docs/2026-07-25-project-review-and-roadmap.md for the full review synthesis.