RFC 8701 GREASE anti-ossification measures require compliant NGFWs and middleboxes to preserve TLS CHLO parameter orderings unmodified; simultaneously, popular browsers and applications randomize their JA3 fingerprints by shuffling cipher suites and extension order as a privacy measure. These two trends together make traffic with varied TLS CHLO orderings indistinguishable from legitimate application traffic at static inspection, eliminating a reliable detection signal for censors.

Static NGFW inspection cannot distinguish Helol tunnel TLS CHLO packets from legitimate privacy-motivated parameter randomization; only advanced statistical or ML monitoring of 'incumbent TLS CHLO trends' could potentially surface anomalies (§5). Local captures across 9 devices over 4 days yielded 96,825 TLS CHLO packets with only 137 distinct parameter-combination fingerprints, illustrating that real traffic is sparse enough for ML baselines to be practical but that the cover population is large.

§5 / §6.2 detection

Empirical testing of 3 enterprise NGFWs (2020–2024 software) found that 2 out of 3 complied with anti-ossification measures and preserved TLS CHLO parameter ordering, making them fully vulnerable to permutation-encoded covert channels; all 3 preserved parameter values within NIST-allowed sets, leaving all vulnerable to the lower-throughput bitmap (selection) encoding. None of the 3 products raised warnings about simulated malware sending repetitive TLS CHLO packets.

Appendix B / Table 2 evaluation

Helol tunnel supports a 'passive (IP-less)' variant in which an insider agent with tap access to layer-3 traffic encodes messages in the ordering of TLS CHLO parameters belonging to incumbent connections traversing the wire, without originating any new IP flows. This bypasses NGFW explicit-proxy and CGNAT defenses that prevent direct socket connections from internal hosts to the Internet.

Appendix C defense

The Helol tunnel encodes data in the permutation of TLS CHLO list-type parameters (cipher suites, extensions, elliptic curves, signature hashing algorithms), achieving a median throughput of roughly 8–12 bytes/packet from cipher-suite permutation alone, significantly outperforming SNICat across median and upper quartiles. The per-packet payload from full factorial encoding is ⌊log₂ N!⌋ bits for a list of N elements, yielding ~17–22 bytes/packet at median cipher-suite list lengths observed in local captures.

§6.1 / Figure 4–5 defense

The RKS Global report documents a two-tier Russian censorship architecture: TSPU network-layer blocking (documented by Xue et al. 2024) at the ISP level, now supplemented by mandated app-layer VPN detection in the 30 most popular Russian Android apps. This layered approach means a circumvention tool that successfully bypasses TSPU at the network layer can still be detected and reported by the app layer, closing the gap that network-only circumvention leaves open.

2026-rks-russian-apps-vpn-detection §2, §7 tls-fingerprintml-classifiermiddlebox-interference

Dominant failure modes differ systematically by country: China (AS45090) shows connect timeouts in 75% of DoT failures (IP-level blocking); Kazakhstan (AS48716) shows post-TLS-handshake timeouts in 72% of DoT failures (likely ACK or segment discard after handshake); Iran (AS197207) shows TLS handshake timeouts in 80% of DoT failures. Packet capture analysis confirmed that timeouts during and after the TLS handshake correspond to unacknowledged TCP segments, not connection resets.

2021-basso-measuring §V-F, §V-G, Table VIII ip-blockingtls-fingerprintmiddlebox-interference

Vodafone (AS12357, AS12430, AS6739) deployed Allot-based TLS interception to block womenonweb.org: the system resolver returned a legitimate IP (67.213.76.19), but connecting to it triggered a forged certificate signed by Allot; disabling TLS certificate validation fetched the Vodafone blockpage, confirming a man-in-the-middle box rather than a redirect. OONI's standard Web Connectivity test recorded only a generic ssl_error:certificate verify failed and missed this entirely.

2021-ververis-understanding §3.7, §3.8.3 dpimiddlebox-interferencetls-fingerprint

The paper identifies two unresolved fingerprinting surfaces: (1) traffic-shape analysis of packet sizes and inter-arrival times could distinguish Telex flows from normal TLS, and (2) the prototype exhibits detectable deviations from real servers at the IP layer (stale IP ID fields), TCP layer (incorrect congestion windows detectable by early acknowledgements), and TLS layer (different compression methods and cipher-suite extensions). Convincingly mimicking a diverse population of TCP/TLS server implementations is flagged as requiring substantial engineering effort.

2011-wustrow-telex §9 traffic-shapetls-fingerprintmiddlebox-interference

TSG's Context-Based Detector (CBD) evaluates circumvention tool signatures across JA3/JA4 TLS fingerprints, SSL certificate issuer fields, UDP payload length, first-packet byte patterns, server IP ranges, and FQDN matches, often combining multiple conditions with logical AND. Of 29 VPN and circumvention tool signatures logged in the VPN Signature File Update Log (March–November 2024), 21 carry risk level 5 (the maximum), indicating aggressive prioritization of blocking major tools including ExpressVPN, NordVPN, Tor Browser, and Psiphon.

2026-ablove-technical-analysis-geedge §4.1, §4.1.2, Table 3, Table 4 dpitls-fingerprinttraffic-shapeip-blockingsni-blocking

TLS ClientHello length-field permutation tests show that GFW II's parsing behavior matches an older tagged version of TSG's SSL module, while Kazakhstan and Pakistan (DROP mode) exhibit parsing behaviors consistent with TSG QUIC plugin deployments. QUIC version fingerprinting further confirms Kazakhstan runs an older version of TSG's QUIC parsing code, and Myanmar's supported QUIC versions exactly match TSG's, spanning at least five countries confirmed or plausibly running TSG components.

2026-ablove-technical-analysis-geedge §6.4, §6.5, Table 8, Table 9 dpitls-fingerprinthttp3-quic-blocksni-blocking