FINDING · DETECTION

The obfuscated-openssh handshake encrypts SSH with a key derived from an iterated-hash PBKDF whose slowness was intended to prevent real-time censor analysis; Wiley argues this defense fails because modern censors use statistical packet sampling with offline processing, and the slow key generation itself introduces a timing side-channel detectable from the inter-packet delay between the first and second packets.

From 2011-wiley-dust — Dust: A Blocking-Resistant Internet Transport Protocol · §2.2 · 2011 · University of Texas at Austin

Implications

Computational cost is not a reliable security margin against nation-state censors that batch-process sampled flows offline — cryptographic indistinguishability is required, not just slowness.
Any protocol design that makes the first-to-second-packet timing anomalous (e.g., due to key derivation) leaks a detectable fingerprint even when payload bytes are opaque.