In order to diversify or imitate TLS fingerprints, there are currently 2 plausible paths for us to achieve that. - Rewrite: Reimplement the supports for missing extensions from TLS libraries used by browsers by extending [craftls](https://github.com/3andne/craftls) library - TakeOver: Run the original TLS libraries within wasm vm and take over the connection once the handshake is finished. Here is an abstract analysis of these methods before any experiments are run: #### Rewrite Pros Since all the code will be implemented in a single language and environment, the repository will be explainable and comparably easy to add or customize its configurations. #### Rewrite Cons Requires constant resync with upstream for new features and security updates. This would require constant maintenance. Requires constant work input to catch up with new extensions from browsers and other tls implementations. An active attacker can disrupt the connection and observe the reaction from tls client, unless all extensions are actually implemented, rewrite tls client will be detected with its error processing logic. #### TakeOver Pros There are no requirement for constant maintenance for working with handshaking related protocol changes; the project would use the same interface as ktls to take over and handle connections, without the need to constantly reimplement new extensions Less error prone than reimplementing all the extensions by running widely used and verified implementation of TLS, reducing the security implication of reimplementing security sensitive codes #### TakeOver Cons Creating a heterogeneous repository that requires cross language developments. As a result, the overall system is harder to customize or explain. Requires additional components to communication across language/runtime boundaries