Objective 1: Make the Conjure pluggable transport more resistant to blocking
The Project will implement improvements to increase Conjure’s resilience against censorship by employing alternative registration methods, integrating uTLS to strengthen domain-fronted registration, and adding support for a second pluggable transport. These updates will ensure Conjure’s adaptability to various censorship tactics and enhance its robustness in dynamic environments.
In order to bring Conjure into wider use as an effective pluggable transport for Tor, it must be resilient against blocking by censors. There are a number of small improvements that we plan to make during this project—some of these improvements are blocking resistance measures that are already deployed for other pluggable transports, and some are specific to Conjure based on the nature of the tool.
1.1: Employ alternative registration methods to domain fronting — (2 weeks)
Conjure requires a bootstrapping or registration step with a registration server to select and exchange some information before the connection to the phantom proxy. This registration step requires a low-bandwidth but highly censorship-resistant channel, similar to other successful anti-censorship tools like Snowflake, and the exchange of proxy information in traditional client-server tools like obfs4. The modular design of Conjure allows for a variety of options for this channel to make it robust to new censorship events. We plan to expand the set of available registration methods.
1.2: Move to uTLS for domain fronted registration— (1 week)
We also plan to bolster the existing domain fronting registration method by using uTLS, a powerful anti-fingerprinting tool that is in use by many other successful anti-censorship tools.
1.3: Add support for second pluggable transport — (1 month)
Another key feature of Conjure’s modularity is that it supports multiple transports for use as the protocol between the client and the phantom proxy. As we are receiving more and more reports of protocol fingerprinting in Snowflake and now obfs4, our fully encrypted protocol, having a large pool of available transports and the ability to adaptively switch between them is key to adding robustness to Conjure as censorship evolves. As part of this work, we plan to expand the set of available transports and switch between them.