Traffic Confidentiality

1. Beyond Content: Hiding Who Talks and How Much

Encryption hides WHAT is said; traffic confidentiality hides communication patterns — source/destination identities, frequency, length, timing — which alone reveal plenty (embassy–capital spike before an announcement; fixed-size hourly bursts = telemetry). Stallings's measures escalate: (a) link encryption (hides headers per hop), (b) padding, (c) dummy traffic, (d) full covertness via mixes/onion routing.

\text{Attacker sees: } (src, dst, t_i, len_i) \Rightarrow \text{infer relationship + activity even with } C = E_K(P) \text{ unbroken}

2. Techniques (Stallings List + Modern Forms)

Technique	How	What it hides	Cost
Link encryption	Encrypt whole frame per hop	Addresses + payload on wire	Per-hop decrypt (trust nodes)
Padding / constant rate	Pad to fixed size / fixed schedule	Length + timing signatures	Bandwidth waste
Dummy / cover traffic	Random-filler packets when idle	Existence of real bursts	High overhead (military-grade)
Mixes (Chaum)	Batch + reorder + re-encrypt	Input↔output linkage	Latency (remailers, voting)
Onion routing (Tor)	Layered encrypt, 3-hop circuit	Source from destination and vice versa	Latency, exit-node trust
ECH / encrypted SNI	Encrypt TLS handshake server name	Destination hostname from snoopers	Needs DNS-over-HTTPS + server support

Worked padding math: messages $len \in \{100, 500, 900\}$ → pad all to 1024: attacker learns only count, not which; overhead $= (1024 - \bar{len}) \times N$ . Constant-rate 1 packet/s with dummies when idle: timing signal fully flat; cost = peak-rate bandwidth always.

3. What TLS/IPsec Leak (Exam Favourites)

TLS ≤1.2: SNI hostname, cert, packet sizes/timing visible — website fingerprinting identifies pages from size sequences (~90% accuracy in lab).
IPsec tunnel: inner addresses hidden, but outer endpoints + counts/sizes visible — flow correlation possible.
Metadata programs (and BEU case studies): "we only collected metadata" still maps social graphs, sleep patterns, business deals — hence ECH, QUIC padding, Tor.

4. Limits and Design Rule

Perfect traffic confidentiality = constant-rate cover traffic on every link — prohibitively expensive; real systems buy levels: ECH + padding (cheap, HTTPS), VPN/Tor (moderate, metadata-hiding), constant-rate + mixes (expensive, high-threat). Rule: classify what patterns hurt (identity? timing? volume?), then pay only for those — padding sizes is cheap, faking timing is dear.

Exam Points

Content-vs-pattern distinction + $(src, dst, t, len)$ tuple — 2-mark opener.
Six-technique table with hides/cost columns — 5-mark core.
Padding math ( $\{100,500,900\} \to 1024$ ) + constant-rate dummy logic.
TLS/IPsec leak list (SNI, sizes, outer endpoints) + "metadata maps graphs" closer.

Traffic Confidentiality