2 added 246 characters in body
source | link

No. Traffic analysis can still tell someone a lot.

Traffic analysis is the process of intercepting and examining messages in order to deduce information from patterns in communication. It can be performed even when the messages are encrypted and cannot be decrypted. In general, the greater the number of messages observed, or even intercepted and stored, the more can be inferred from the traffic.

 

With properly deployed TLS, we might assume that is usually deployed to preserve confidentiality -- an attacker knows your protocolshould not reach a high level of confidence about the contents of communication.

Assuming,

  1. an attacker knows your protocol,
  2. an attacker knows who is communicating with whom
  3. the attacker cannot decrypt messages.
  4. you do not obscure your real traffic in a lot of nonsense traffic (chaff)

An attacker can probably tell when you are awake and knows who is communicating with whomwhen you are asleep regardless of protocol, but cannot decrypt messagesand may be able to tell a lot more depending on the nature of the protocol you're using.

 

If your protocol is very simple:

  1. You send a message "fire the nukes at ..." when you want to fire nukes
  2. You don't send a message when you don't want to fire any nukes.

An eavesdropper who can't decrypt your data can determine by the mere presence of a message that you want to fire nukes, though maybe not at whom.


If your protocol is more complex:

  1. You ask for a book.
  2. I send you the content.

An attacker may not be able to tell who is reading "War and Peace" vs "Atlas Shrugged" but can distinguish, based purely on message size, whether they are reading one of the former vs. Kafka's 55 page novel "The Metamorphosis".


Unless you obscure your real traffic in a lot of nonsense traffic (chaff), an attacker can probably tell when you are awake and when you are asleep regardless of protocol.

No. Traffic analysis can still tell someone a lot.

Traffic analysis is the process of intercepting and examining messages in order to deduce information from patterns in communication. It can be performed even when the messages are encrypted and cannot be decrypted. In general, the greater the number of messages observed, or even intercepted and stored, the more can be inferred from the traffic.

With properly deployed TLS, we might assume that an attacker knows your protocol, and knows who is communicating with whom, but cannot decrypt messages.

If your protocol is very simple:

  1. You send a message "fire the nukes at ..." when you want to fire nukes
  2. You don't send a message when you don't want to fire any nukes.

An eavesdropper who can't decrypt your data can determine by the mere presence of a message that you want to fire nukes, though maybe not at whom.


If your protocol is more complex:

  1. You ask for a book.
  2. I send you the content.

An attacker may not be able to tell who is reading "War and Peace" vs "Atlas Shrugged" but can distinguish, based purely on message size, whether they are reading one of the former vs. Kafka's 55 page novel "The Metamorphosis".


Unless you obscure your real traffic in a lot of nonsense traffic (chaff), an attacker can probably tell when you are awake and when you are asleep regardless of protocol.

No. Traffic analysis can still tell someone a lot.

Traffic analysis is the process of intercepting and examining messages in order to deduce information from patterns in communication. It can be performed even when the messages are encrypted and cannot be decrypted. In general, the greater the number of messages observed, or even intercepted and stored, the more can be inferred from the traffic.

 

TLS is usually deployed to preserve confidentiality -- an attacker should not reach a high level of confidence about the contents of communication.

Assuming,

  1. an attacker knows your protocol,
  2. an attacker knows who is communicating with whom
  3. the attacker cannot decrypt messages.
  4. you do not obscure your real traffic in a lot of nonsense traffic (chaff)

An attacker can probably tell when you are awake and when you are asleep regardless of protocol, and may be able to tell a lot more depending on the nature of the protocol you're using.

 

If your protocol is very simple:

  1. You send a message "fire the nukes at ..." when you want to fire nukes
  2. You don't send a message when you don't want to fire any nukes.

An eavesdropper who can't decrypt your data can determine by the mere presence of a message that you want to fire nukes, though maybe not at whom.


If your protocol is more complex:

  1. You ask for a book.
  2. I send you the content.

An attacker may not be able to tell who is reading "War and Peace" vs "Atlas Shrugged" but can distinguish, based purely on message size, whether they are reading one of the former vs. Kafka's 55 page novel "The Metamorphosis".

1
source | link

No. Traffic analysis can still tell someone a lot.

Traffic analysis is the process of intercepting and examining messages in order to deduce information from patterns in communication. It can be performed even when the messages are encrypted and cannot be decrypted. In general, the greater the number of messages observed, or even intercepted and stored, the more can be inferred from the traffic.

With properly deployed TLS, we might assume that an attacker knows your protocol, and knows who is communicating with whom, but cannot decrypt messages.

If your protocol is very simple:

  1. You send a message "fire the nukes at ..." when you want to fire nukes
  2. You don't send a message when you don't want to fire any nukes.

An eavesdropper who can't decrypt your data can determine by the mere presence of a message that you want to fire nukes, though maybe not at whom.


If your protocol is more complex:

  1. You ask for a book.
  2. I send you the content.

An attacker may not be able to tell who is reading "War and Peace" vs "Atlas Shrugged" but can distinguish, based purely on message size, whether they are reading one of the former vs. Kafka's 55 page novel "The Metamorphosis".


Unless you obscure your real traffic in a lot of nonsense traffic (chaff), an attacker can probably tell when you are awake and when you are asleep regardless of protocol.