DNS-Morph: UDP-Based Bootstrapping Protocol for Tor

Rami Ailabouni, Orr Dunkelman, Sara Bitan

Research output: Chapter in Book/Report/Conference proceedingConference contributionpeer-review


Tor is a popular system for anonymous communication and censorship circumvention on the web, this puts Tor as a target for attacks by organizations and governmental bodies whose goal is to hinder users’ ability to connect to it. These attacks include deep packet inspection (DPI) to classify Tor traffic as well as legitimate Tor client impersonation (active probing) to expose Tor bridges. As a response to Tor-blocking attempts, the Tor community has developed Pluggable Transports (PTs), tools that transform the appearance of Tor’s traffic flow. In this paper we introduce a new approach aiming to enhance the PT’s resistance against active probing attacks, as well as white-listing censorship by partitioning the handshake of the PT from its encrypted communication. Thus, allowing mixing different PTs, e.g., ScrambleSuit for the handshake and FTE for the traffic itself. We claim that this separation reduces the possibility of marking Tor related communications. To illustrate our claim, we introduce DNS-Morph: a new method of transforming the handshake data of a PT by imitating a sequence of DNS queries and responses. Using DNS-Morph, the Tor client acts as a DNS client which sends DNS queries to the Tor bridge, and receives DNS responses from it. We implemented and successfully tested DNS-Morph using one of the PTs (ScrambleSuit), and verified its capabilities.

Original languageEnglish
Title of host publicationCyber Security Cryptography and Machine Learning - 5th International Symposium, CSCML 2021, Proceedings
EditorsShlomi Dolev, Oded Margalit, Benny Pinkas, Alexander Schwarzmann
PublisherSpringer Science and Business Media Deutschland GmbH
Number of pages22
ISBN (Print)9783030780852
StatePublished - 2021
Event5th International Symposium on Cyber Security Cryptography and Machine Learning, CSCML 2021 - Be'er Sheva, Israel
Duration: 8 Jul 20219 Jul 2021

Publication series

NameLecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)
Volume12716 LNCS
ISSN (Print)0302-9743
ISSN (Electronic)1611-3349


Conference5th International Symposium on Cyber Security Cryptography and Machine Learning, CSCML 2021
CityBe'er Sheva

Bibliographical note

Publisher Copyright:
© 2021, Springer Nature Switzerland AG.


  • Bootstrapping
  • Bridge
  • Censorship
  • Circumvention
  • DNS
  • Pluggable Transport
  • Tor
  • UDP

ASJC Scopus subject areas

  • Theoretical Computer Science
  • General Computer Science


Dive into the research topics of 'DNS-Morph: UDP-Based Bootstrapping Protocol for Tor'. Together they form a unique fingerprint.

Cite this