Ordinary
on the wire.

Every TLS 1.3 handshake message after the ServerHello is encrypted and framed as an application_data record. The contents become opaque, but record sizes, counts, timing, destination addresses, and connection history remain observable.

So the connection does not have to be TLS. It has to open like TLS. Everything past the ServerHello still needs measured shaping. A harvested ClientHello, a synthesised ServerHello, and an AEAD tunnel are the design — not a proof of indistinguishability. Active probing and traffic analysis remain part of the threat model.

Authentication: two different final edits

Resumption-shaped opening. Replace any existing pre_shared_key with one containing the supplied Twiddle credential ticket, a fresh random four-byte obfuscated_ticket_age (not elapsed ticket age), and a newly computed 32- or 48-byte binder. The binder is Twiddle's PSK-derived HMAC over the final serialized hello truncated at the binders, not an interoperable TLS binder calculation. This extension is last. The credential ticket is supplied, not newly minted by each call to Twiddle.

Full-handshake-shaped opening. Remove pre_shared_key. Put the 144-byte companion ticket at the start of the ECH payload and fill the remainder with fresh random bytes. Zero ClientHello.random for the calculation, compute a domain-separated HMAC-SHA256 over the entire serialized hello, then place that 32-byte MAC in random. A usable ECH carrier is required.

What stays unchanged

Ordinary cipher suites and their ordering, ALPN, non-GREASE supported groups, versions and signature algorithms, compression methods, and otherwise unhandled extension payloads are copied from the template. Extension ordering changes their offsets, not their contents.

This is an explicit rewrite list, not automatic browser-behavior discovery. For example, Chrome's newer varying 0xca34 payload is currently copied, not regenerated. Twiddle does not add or remove that extension, or 0x12e0, to turn an old capture into a newer browser fingerprint.

Before that: import-time sanitization

When templates pass through Sanitize, replace the captured SNI with same-length x characters, remove captured pre_shared_key and early_data, empty the legacy session_ticket payload, and zero random and the session-ID contents. These are import-time changes, separate from the per-connection rewrites. Calling Twiddle directly on a raw capture does not itself run this sanitizer.

Source: transformations · keys & resumption · full-handshake authentication · sanitization · serialization.

RFC 8446 §4.2.11.2 defines the PSK binder as HMAC(binder_key, Transcript-Hash(Truncate(ClientHello))) — a MAC over the opening, keyed by a secret shared with the server. That is exactly the authenticator we needed, in the field TLS already provides for it. Twiddle uses that shape for its own ticket authenticator; it does not establish an interoperable TLS session.

Both halves are opaque by specification: a ticket is server-chosen opaque data, and a binder is an HMAC under a key derived from it. No observer can validate either without the resumption secret. Opaque contents still need the lengths and surrounding structure of the selected cover profile.

A first contact should not already be a resumption

The merged full-handshake carrier omits pre_shared_key. Its ticket travels in the GREASE ECH payload; ClientHello.random carries a domain-separated MAC over the whole hello. The X25519 key share still supplies forward secrecy.

TicketKey.Issue mints a resumed ticket and a 144-byte full ticket for the same client, PSK, and issuance time. The shared timestamp matters: the replay gate rejects tickets older than the newest one that client has presented. A Microsoft-sized 256-byte resumed ticket cannot fit even the largest measured 240-byte ECH payload.

ContactMemory chooses full on first contact, then permits resumption after a completed full opening. The default horizon is six hours; a reset, eviction, or process restart asks for another full opening. Network-change callers should reset it explicitly.

Capability is not activation. Automatic selection falls back to resumption unless the credential has a companion ticket, the pool has an ECH carrier, and the cover has a measured full reply profile. An explicit full-handshake request fails if it cannot be supported. The built-in cover table has no full reply profile; per-egress probing is still required.

Because the ServerHello is synthesised, the egress cannot complete a genuine handshake with a peer it does not recognise. That makes the splitting egress load-bearing rather than optional hardening: an active prober must be forwarded to a real TLS server, byte for byte, or it has confirmed the transport by getting anything else.

The resumption number changed the design again: 26 of 636 observed connections resumed; a separate cold-process capture measured 13 of 485 (2.7%). These are samples, not a universal target ratio. The sharper requirement is a visible predecessor: do not always arrive at a new egress already claiming to resume. That motivated the full-handshake carrier and contact memory, rather than a knob tuned to 4.1%.

Prefer this device's current, sanitised browser captures; next try configuration-supplied captures. Sources are not merged. Mixed-build pools are partitioned and the majority build wins. The core requires an explicit opt-in for its embedded snapshot; lantern-box currently enables that fallback, so a working connection does not prove the fingerprint is fresh.

Sanitise before persistence: real browsing captures expose visited SNI names and may contain a site's resumption ticket. The historical sample above was captured against localhost.

A cover is a complete profile, not a hostname pasted over arbitrary bytes. The consolidated cloud provisioning work requires a measured identity and keeps the dial address pinned to the provisioned egress IP after DNS validation. SNI/address consistency remains a deployment constraint, not something a plausible-looking ClientHello fixes.

Full-handshake design · ECH measurements · Chrome 152 capture log

Known limits, not hidden guarantees

Per-egress full-profile probing and client activation still need integration. The fixed 370-byte rotation records are a known cover-fidelity mismatch. The varying body of Chrome 152's 0xca34 extension is sampled from captures, not regenerated. A replay cache pushed to its client-capacity limit can evict a still-valid entry. These bounds matter alongside packet sizes, timing, and destination consistency.

The nonce-race fix does not make shutdown bounded: Close can still wait on a stalled socket without a caller-supplied write deadline. Passing local and CI tests is evidence about tested behavior, not a claim that every observer sees ordinary TLS.