Conceptio › Archive › arXiv CS

arXiv CSopen access

Closing the Loop: Bidirectional Fully Encrypted Protocols

· arxiv_cs

arXiv CS · Papers · License: Open Access

Open Source ↗Direct PDF ↓

cryptography cybersecurity privacy security

cryptography, security, privacy, cybersecurity

arXiv:2609.17397v1 [cs.CR] 15 Sep 2026

Closing the Loop: Bidirectional Fully Encrypted Protocols Baigang Chen

Nicholas Hopper

University of Minnesota [email protected]

Abstract—Fully encrypted protocols (FEPs) provide encrypted channels that make all protocol-generated bytes computationally indistinguishable from uniform random strings. Several previous works have explored security definitions and constructions of unidirectional FEPs: protocols in which one party acts only as a sender, and the other acts only as a receiver. However, most applications require two-way information exchange, and a network adversary can observe communication in both directions and their shared lifetime. Because the semantics of bidirectional channels involve more complex shared state, it is possible that the “naı̈ve” composition of two unidirectional channels can result in a two-way protocol that can be detected based on dependencies between the two directions, such as traffic imbalance, channel closure, failures, or connection tear-down. To address this issue, we introduce new formal security definitions for bidirectional FEPs that capture exact shaping, delivery, protocol-state integrity, private half-close, and crossdirection isolation, while revealing a public “sending schedule” and “closing epoch” that may be randomized. We show that the trivial composition fails to meet these definitions, leading to practical detection attacks. We then construct provably secure bidirectional FEPs (BiFEPs) for both the datastream and datagram settings. For datastream, we combine two directionseparated FEPs with a “wrapper” layer that prevents detection based on the mismatch between uni- and bi-directional connection states. For datagram, we add encrypted DATA/FIN/ACK with replay protection and loss-tolerant close. We validate the design through a Rust implementation and show that none of the surveyed deployed protocols provides the full set of BiFEP security properties.

I. I NTRODUCTION Encryption hides message contents, but not necessarily the protocol carrying them. For instance, TLS and QUIC retain recognizable handshakes and other structured features that contribute to a protocol’s observable wire fingerprint [1]–[3]. An observer can use this fingerprint to classify, throttle, or block traffic without decrypting it. Obfuscated transports such as obfs4 and Shadowsocks seek to remove fixed protocol markers by making all protocol-controlled bytes appear random [4], [5]. Random-looking bytes alone, however, do not make a connection unidentifiable: message lengths, timing,

Network and Distributed System Security (NDSS) Symposium 2027 22–26 March 2027, Seoul, Republic of Korea ISBN 978-1-970672-09-1 https://dx.doi.org/10.14722/ndss.2027.240467 www.ndss-symposium.org

and responses to active probes can remain distinctive, and some censors specifically target high-entropy traffic [6], [7]. Protocol mimicry is likewise fragile when its imitation differs detectably from the target protocol [8]. These limitations motivate a precise separation between cryptographically hiding protocol-generated bytes and controlling the metadata that remains visible. Fenske and Johnson formalized this goal with fully encrypted protocols (FEPs), which make protocol-generated bytes indistinguishable from uniform strings of the same public length [9]. Their definitions, however, model only one direction at a time. Two secure FEPs run in parallel can therefore leak session structure through their interaction. In a request–response exchange, for example, a naı̈ve composition may cause the request direction to go silent when the requester half-closes while the response direction remains active, exposing that private event although every transmitted byte looks random. Cross-direction reactions can similarly enable active probes. We formalize and measure this gap (§III-D, §VIII-G), motivating a single bidirectional security object that jointly governs shaping, failure, and close behavior. We construct bidirectional FEPs (BiFEPs) for both datastreams and datagrams. The core difficulty in recognizing this extension is allowing the connection to close without revealing the private events that made it ready to close. If an authenticated FIN or a decryption failure immediately closes the transport, an observer learns when the private protocol state changed. An active adversary can also use this response as a probe. A protocol that never closes avoids this leakage but is not practical. Our datastream construction separates private close readiness from the public close time. Each endpoint continues the public traffic schedule after a half-close, and the transport closes only at the next epoch in a public schedule. The observer learns a quantized close time, but not the exact time of the private close event. This design treats termination as part of the secure channel [10]. Datagrams require a separate construction because UDP may lose, reorder, or duplicate packets [11]. A datastream FIN is drained once its ciphertext prefix leaves the sender, but a transmitted datagram may never arrive. Treating transmission as delivery could therefore cause the two endpoints to reach inconsistent close states. Our datagram construction places encrypted FIN and ACK bits inside authenticated, scheduled datagrams. It retransmits these control bits idempotently and

requested length on each invocation. In §IV, UD.Enck (r, u) denotes this sender’s complete record-encoding step; the bidirectional wrapper owns the ciphertext queue and scheduled prefix release. Because the wrapper supplies authenticated cover, we set ℓp ≡ 0 and reject nonzero padding lengths. With AES-256-GCM, the inner per-record overhead is cenc = 36 bytes. Under a length-additive IND$-CPA and INT-CTXT AEAD, the layer provides datastream shaping and active FEP security [9]. The atomic datagram FEP. The datagram FEP of [9] carries a fresh transmitted nonce in every packet and encrypts either a null message ⊤ (chaff) or an application message. If the requested length cannot hold a nonce and tag, the sender emits uniform bytes and the receiver returns ⊤, so short traffic has no semantic output in either world. We use this design as our atomic layer (§V) and add bidirectional semantics above it.

requires authenticated evidence from both directions before closing. After becoming ready to close, an endpoint remains live through a public number of additional close buckets and retransmits its acknowledgment. A later ACK-bearing datagram can therefore repair an isolated loss. Packet loss may prevent termination, but it cannot create false close readiness. Contributions. • Security framework and proofs. We formalize new security conditions for the bidirectional case, including correctness, traffic shaping, passive and active security, protocol-state integrity, and private close. We show that trivial composition of two uni-directional FEPs does not satisfy these security goals. • Bidirectional constructions. We construct BiFEPs for both datastreams and datagrams, providing exact perdirection traffic schedules and encrypted close coordination tailored to each transport model. We prove both constructions secure while exposing only the public schedule and quantized close epochs. • Implementation and evaluation. We implement both constructions in Rust and evaluate their behavior under active modification, replay, loss, and timing variation. We also compare TLS 1.3 [1], QUIC v1 [2], [3], [12], WireGuard [13], Shadowsocks 2022 [5], obfs4 [4], and Tor [14] at the specification level. None provides all bidirectional FEP properties. We further quantify the costs and practical constraints of cover traffic.

III. M ODEL , S COPE , AND G OALS A. Endpoints, epochs, and schedules Two trusted endpoints A and B share direction-separated symmetric keys established before the FEP session begins. Time is divided into logical epochs. In each epoch t, each endpoint X ∈ {A, B} accepts at most one application input, emits scheduled traffic toward its peer X, processes traffic received from X, and may report visible close. Let M = {0, 1}∗ be the application-message space. The input is µ ∈ M ∪ {⊥, closeReq}. An input m ∈ M is application data and may be the empty message ϵ; ⊥ means that the application supplies no event in the epoch; and closeReq requests a local half-close. The close request is an application-level event that causes the protocol to generate an encrypted FIN. A public schedule ΓX (t) fixes the number of protocolpayload bytes X emits while live: for datastreams, a bytestream prefix that TCP may segment arbitrarily; for datagrams, the exact payload length of one UDP datagram. The pair (ΓA , ΓB ) need not be identical, and is preferred to be divergent and randomized for anti-fingerprinting. The schedule may be fixed or sampled at session setup, but its generator must be independent of application content, sizes, queue occupancy, FIN, authentication failures, and every other session secret. Sampling a fresh schedule per session avoids a single constant pattern and permits a distribution designed to resemble cover traffic [18]–[21]. It does not by itself prevent fingerprinting: lengths, directions, packet counts, and timing remain observable, and the schedule distribution may itself be distinctive. Uniform-looking payloads can also form a detectable traffic class [6]. Epoch boundaries and the generator profile are fixed public protocol parameters; LBD below records the realized per-session lengths and close outputs. Our theorems establish payload security conditioned on these public values. Selecting a statistically resistant schedule distribution is separate (§X). Let Ecl denote the public set of epochs at which visible closure is permitted. The close grid may be fixed in advance or sampled during session setup, provided that its distribution

II. BACKGROUND FEP security notions. Fenske and Johnson formalize FEP security for both datastreams and datagrams [9]. Passive security replaces each sender output with a uniform random string of the same length and requires indistinguishability of the transcripts. The active datastream experiment also exposes a receiver oracle and tracks whether the adversary-delivered stream remains a prefix of the honestly shown stream. Oracle outputs are suppressed while synchronized; after the first deviation, the ideal experiment ceases decryption, so any realworld semantic output is a forgery. Datastream traffic shaping requires exactly the requested number of bytes per sender call, making length and timing explicit inputs. The corresponding datagram notion (FEP-CCA) covers atomic packets with chosen-ciphertext access. Channel-security work under fragmentation [15], [16] and for bidirectional channels [17] studies related correctness and integrity questions without additionally requiring a random wire image. The datastream FEP. Our bidirectional datastream construction uses the datastream FEP of [9] as its inner layer. One abstract record with body u consumes two AEAD sequence numbers: with record counter r and key k, Hr = Enck (2r, BE16 (|Cr |)) , Cr = Enck 2r + 1, BE16 (ℓp ) ∥ 0ℓp ∥ u ,

(1)

where BEw denotes a w-bit big-endian encoding, so BE16 occupies two bytes, and ℓp is an inner-layer padding length. The sender buffers generated ciphertext and releases a prefix of the

is independent of application data and private protocol state. If no permitted epoch remains after an endpoint becomes ready, its visible-close output is ⊥. Unlike the per-direction emission schedules ΓA and ΓB , the grid is shared: an emission schedule governs one direction, whereas visible closure terminates the session as a whole. Thus, endpoints that become ready within the same epoch can close simultaneously. Endpoint-specific grids EclA ̸= EclB would fit the definitions unchanged, since the close output of Eq. (7) is endpoint-local, but they would make one-directional tails structural: between the two closure epochs one endpoint is silent while the other pays its full schedule, and in the datagram case an earlier closure can strand its peer (§VIII-F). For endpoint X, the close leakage e⋆X is ⊥ if X never becomes ready or no later close bucket exists. Otherwise it is fixed by the selected construction’s public close rule: the datastream closes at the first epoch in Ecl at or after readiness, whereas the datagram construction defers close by the fixed public linger depth L ∈ N of further permitted buckets (§V). The endpoints may realize different close epochs when readiness occurs on opposite sides of a bucket boundary because of asymmetric FIN drain or unequal delivery of FIN/ACK evidence (§VIII-F).

control events, or close transitions to be accepted. Accordingly, our security guarantees exclude availability while preserving authenticity under denial of service. D. Security notions A bidirectional protocol is a tuple Π = (Init, SendA , SendB , RecvA , RecvB ). With security parameter λ, Init(1λ , ΓA , ΓB , Ecl ) returns two endpoint states; L and all session bounds are fixed public protocol parameters. A send call SendX (t, stX , µ) returns an updated state, one scheduled ciphertext of length ΓX (t), and a local close bit. A receive call RecvX (t, stX , c) returns an updated state, a delivery output (a list for datastreams and x or ⊥ for datagrams), and a close bit. In each epoch the sends run first, each receive uses its endpoint’s post-send state, and only the combined close bits are applied absorbingly afterward (Algorithm 3). Definition 1 (Passive BiFEP security). After fixing the public schedules and close grid, a PPT adversary adaptively supplies both endpoints’ Send inputs at each epoch. Let V0 be its view of the honest execution. In V1 , the same leakage LBD is shown, but X’s epoch-t output is an independent uniform string of length ΓX (t) when e⋆X = ⊥ or t ≤ e⋆X , and is ϵ afterward. The protocol is passively secure if every PPT adversary distinguishes V0 from V1 with only negligible advantage. See Appendix A, Algorithm 7, for the full experiment.

B. Adversary The adversary observes both directions and may delay, drop, fragment, coalesce, insert, delete, replay, reflect, reorder, and modify traffic arbitrarily. It sees the full transport/network wire image: addresses, ports, TCP/UDP headers, lengths, directions, timing, packet counts, and transport termination. The FEP claim covers exactly the protocol-controlled payload bytes, conditioned on the declared leakage LBD = (ΓA , ΓB , Ecl , e⋆A , e⋆B ),

Definition 2 (Active BiFEP security). The active game extends Definition 1 by letting the adversary modify and deliver traffic in both directions. The ideal world processes only honest sender output: a datastream direction stops after its first deviation, whereas each datagram is checked atomically. The event Bad records accepted forged or replayed DATA/FIN/ACK, DATA after FIN, nonempty datastream output after deviation, or premature close. We call Π actively secure if both the distinguishing advantage and Pr[Bad = 1 | b = 0] are negligible, where b = 0 denotes the real experiment. Appendix A specifies the full oracles and integrity monitor (Algorithms 8–13).

(2)

where e⋆X is X’s realized close bucket (or ⊥). TLS, QUIC, and other deployed transports intentionally expose selected protocol structure on the wire [1]–[3] and do not aim to provide the FEP guarantees studied here.

The key difference from [9] is who controls output lengths. In the unidirectional games, the adversary requests each length, so the definition protects byte contents but not application-dependent length patterns or per-channel close behavior. In Definition 1, lengths instead follow the public schedule until each leaked full-close epoch, jointly constraining both directions and hiding earlier local half-closes.

C. Goals We require: (i) correctness: reliable in-order datastream delivery of admitted data; for datagrams, authentic DATA accepted before peer FIN is delivered atomically and at most once, while loss and reordering across FIN are availability events; (ii) shaping: exact public output lengths in both directions in every live epoch, including idle ones; (iii) passive security: live protocol bytes indistinguishable from uniform; (iv) protocol-state integrity: only authentic peer actions may produce DATA delivery or advance the close state; forged DATA, forged FIN/ACK, DATA after FIN, and premature close are rejected; (v) private half-close and scheduled close: half-close invisible; full close visible only in Ecl . An active adversary may mount a denial-of-service attack by dropping or modifying traffic, thereby delaying delivery, stalling a direction, or preventing termination. Such interference does not violate integrity unless it causes forged data,

Proposition 1 (Naive-composition separation). Two channels can each satisfy the unidirectional FEP definitions while their parallel composition fails passive BiFEP security. Proof. Let ΓA (t) = ΓB (t) = 1024 and Ecl = {8, 16, . . .}. After sending its request in epoch 2, A half-closes while B’s response continues through epoch 6; both are ready to close by epoch 8. A naive pair of unidirectional FEPs may emit nothing from A → B after epoch 2, which their individual games permit because the requested length is zero in both worlds. Testing |cA→B (3)| = 0 therefore reveals A’s halfclose. In contrast, Definition 1 requires 1,024 bytes in both

directions through the leaked epoch-8 close bucket, hiding the event.

Application at most one input per epoch: µ {⊥, closeReq} ∪ M

Wrapper key akX→Y , sequence s: chunk to ≤Lmax ; F = τ ∥x, τ ∈ {DATA, DUMMY, FIN}; P = BE32 (|d|) ∥ d, d = Encak (s, F )

IV. B IDIRECTIONAL DATASTREAM C ONSTRUCTION We define the bidirectional datastream construction

Inner FEP key kX→Y , record r: body u of ≤Brec queued wrapper bytes; H=Enck (2r, BE16 (|C|)), C=Enck (2r+1, BE16 (0)∥u)

ΠBD = (Init, SendA , SendB , RecvA , RecvB ) under the syntax of §III and Appendix A. For each direction X → Y , the construction applies an authenticated wrapper around an independently keyed unidirectional datastream FEP. The wrapper encodes application data, cover traffic, and close control as encrypted objects; the inner FEP converts the resulting object stream into ciphertexts of the requested length. The wrapper uses a nonce-based AEAD scheme (Enc, Dec) satisfying IND$-CPA and INT-CTXT security. Let ν be an injective map from 64-bit sequence numbers to AEAD nonces. We use Encak (s, m) := Encak (ν(s), m)

Brec − Lin < 28Lin ,

DUMMY fills any deficit

Scheduled release ciphertext buffer obuf; release exactly ΓX (t) bytes in epoch t, FIN drains only when its record fully leaves Transport (TCP) reads, writes, and packets carry no record, epoch, or object boundary

Fig. 1. Sender-side layering for direction X → Y . The reverse direction uses independent keys. Wrapper structure is inner-layer plaintext and is not visible on the wire.

where stUD is the inner receiver state, sR the expected wrapper sequence, ibuf the reassembly buffer, and rfin the peer-FIN S , σYR→X , closedX , badX ) bit. Endpoint X’s state is (σX→Y with the absorbing visible-close bit closedX and the private failure bit badX ; X is live in epoch t if closedX = 0 when the epoch begins.

as shorthand, and define Decak (s, ·) analogously. The wrapper sequence s and inner record counter r are bounded public session counters; admissible sessions end before either value repeats. The inner layer is the unidirectional datastream FEP ΠUD of Eq. (1), with sender UD.Enc and receiver UD.Recv. We instantiate it with a trivial close function CUD ≡ 0, so the inner layer never produces a close event. In particular, FIN processing and visible termination are governed entirely by the bidirectional wrapper, while the inner layer continues to emit the length requested by the public schedule. Let Lin and Ltype denote, in bytes, the encoded-length and frame-type widths; let Lmax be the maximum applicationchunk length, Brec the maximum inner-record body length, and caead and cenc the AEAD and inner-record overheads. Define cwrap = Lin + Ltype + caead . We require cwrap ≤ Brec ,

∈

Init(1λ , ΓA , ΓB , Ecl ) samples the four keys kA→B , akA→B , kB→A , akB→A independently and uniformly, sets every counter and bit to zero, every buffer to ϵ, wst = open, and finrem = finlim = ⊥. No key or state variable is shared across directions or layers. B. Protected objects A wrapper frame is F = τ ∥x with τ ∈ {DATA, DUMMY, FIN}: DATA carries one application chunk, DUMMY carries uniformly random cover bytes, and FIN has an empty payload. Protection of a frame at sequence number s is defined as

(3)

d = EncakX→Y (s, τ ∥x),

so an authenticated empty DUMMY fits in one record and every protected-object length is representable.

P ROTECT(τ, x, s) = BE8Lin (|d|)∥d,

(4)

after which the caller increments sS . The sequence-derived nonce and the direction-separated key bind each object’s type, payload, position, and direction, so replayed, reordered, and cross-direction-reflected objects fail authentication. The length prefix is itself inner-layer plaintext: on the wire it sits inside the inner encrypted datastream, so object boundaries are invisible. Application input is chunked canonically: C HUNK(m) is the unique sequence (m1 , . . . , mj ) with m = m1 ∥ · · · ∥mj , |mi | = Lmax for i < j, and 0 < |mj | ≤ Lmax ; by convention C HUNK(ϵ) = (ϵ), so an empty DATA message is one authenticated object, distinct from supplying no input, which produces cover instead. To fill a ciphertext deficit δ, the sender sizes one DUMMY as

A. State and initialization Definition 3 (Endpoint state). For direction X → Y , the send state is S σX→Y = k, ak, r, sS , buf, obuf, out, finrem, finlim, wst , where k and ak are the inner and wrapper keys; r and sS are the next inner record and wrapper sequence numbers; buf holds protected wrapper plaintext not yet placed in an inner record; obuf holds generated inner ciphertext not yet released; out ∈ N counts released ciphertext bytes; finrem, finlim ∈ N ∪ {⊥} track the FIN position; and wst ∈ {open, finQueued, finDrained} is the write state. The receive state for the opposite direction is σYR→X = stUD , ak, sR , ibuf, rfin ,

ℓmax = min{Lmax , Brec − cwrap }, d ℓd = min{ℓmax , max{0, δ − cenc − cwrap }}. d

(5)

Algorithm 1 Close-aware datastream send at endpoint X

visible close

Require: epoch t, input µ, live directional state toward Y 1: p ← ΓX (t) 2: if µ = m ∈ M then 3: if wst ̸= open then 4: bad ← 1; reject m 5: else 6: for all mi ∈ C HUNK(m) do 7: buf ← buf∥P ROTECT(DATA, mi , sS ); sS ← sS + 1 8: else if µ = closeReq and wst = open then 9: P ← P ROTECT(FIN, ϵ, sS ); sS ← sS + 1 10: finrem ← |buf| + |P |; buf ← buf∥P 11: wst ← finQueued 12: while |obuf| < p do 13: if buf = ϵ then 14: δ ← p − |obuf|; compute ℓd by Eq. (5) 15: x ← {0, 1}ℓd uniformly 16: buf ← P ROTECT(DUMMY, x, sS ); sS ← sS + 1 17: u ← longest prefix of buf with |u| ≤ Brec ; remove u 18: dUD ← UD.Enck (r, u); r ← r + 1 19: if finrem ̸= ⊥ then 20: if |u| ≥ finrem then 21: finrem ← ⊥; finlim ← out + |obuf| + |dUD | 22: else 23: finrem ← finrem − |u| 24: obuf ← obuf∥dUD 25: c ← obuf[1..p]; remove this prefix; out ← out + p 26: if finlim ̸= ⊥ and out ≥ finlim then 27: finlim ← ⊥; wst ← finDrained 28: return (c, clX (t)) and updated state

closeReq ready (private)

A zero output

scheduled bytes every epoch

B closeReq ready (private) visible close

∈ Ecl

epoch t

∈ Ecl

Fig. 2. Close discipline on the baseline profile (Ecl = {4, 8, . . . }). Both applications request close in epoch 2; FINs drain and authenticate in epoch 3; the connection stays byte-for-byte on schedule through epoch 4 and reveals close exactly there.

Overshooting a deficit is harmless: unused ciphertext stays in obuf for later epochs. C. Close state and the FIN-drain invariant Upon the first close request, the sender appends one protected FIN after queued DATA, enters finQueued, and sets finrem to the number of inner-layer plaintext bytes through the FIN’s final byte. Record generation decrements this counter by the bytes removed from buf. For the record that consumes the final FIN byte, the sender sets finlim = out + |obuf| + |dUD |,

and (3), so cwrap + ℓd ≤ Brec by the definition of ℓmax d the object enters a single record. Thus, whether buf already contains pending protected objects or is populated with a newly generated DUMMY object, the iteration removes a nonempty prefix u of buf and appends dUD with |dUD | = |u| + cenc ≥ 1 + cenc to obuf. Hence |obuf| strictly increases; the guard |obuf| < p fails after finitely many iterations, and the explicit prefix release returns exactly p = ΓX (t) bytes.

(6)

where dUD is that inner ciphertext record. Thus finlim is the absolute position of its final byte, and the sender enters finDrained only when out ≥ finlim. A peer FIN sets only the private bit rfin; it does not itself produce end-of-file, visible close, or a transport action. Endpoint X is ready when its own FIN is drained, and its peer’s FIN has been authenticated. The only close-related output is

Proposition 3 (FIN-drain soundness). If wstX→Y = finDrained, then every byte of the inner record containing the FIN object has been returned by some earlier or current SendX invocation.

clX (t) = 1[wstX→Y = finDrained ∧ rfinY →X ∧ t ∈ Ecl ]. (7) Figure 2 shows the resulting behavior: both endpoints keep their full schedules through the closing epoch, and termination becomes visible only at the next public bucket after private readiness.

Proof. When the inner record containing the final FIN byte is generated, its final ciphertext position is recorded as finlim = out + |obuf| + |dUD |. Since records are released in order, the transition to finDrained occurs only when out ≥ finlim, after the complete record has been released.

D. Scheduled datastream sender In epoch t, Algorithm 1 queues the wrapper object for input µ ∈ {⊥, closeReq} ∪ M, fills obuf with inner records, and releases p = ΓX (t) bytes. The following propositions give the shaping and FIN-drain properties used in Theorem 1.

Because obuf releases arbitrary ciphertext prefixes, epoch boundaries need not align with inner-record boundaries. Correctness likewise does not depend on the boundaries of transport reads, writes, or TCP segments. E. Datastream receiver and failure discipline

Proposition 2 (Traffic shaping). Suppose Eq. (3) holds. For every epoch t, live endpoint X, input µ, and reachable endpoint state, Algorithm 1 completes after finitely many iterations and returns a ciphertext string c satisfying |c| = ΓX (t).

Algorithm 2 appends inner plaintext to ibuf and processes complete length-delimited objects in order, independent of input fragmentation; ϕUD is the inner receiver’s failure bit. Let P = BE8Lin (|d|)∥d be the complete object at the head of ibuf. At the expected sequence number sR , the receiver accepts P only if DecakY →X (sR , d) = τ ∥x and

Proof. Consider one iteration of the loop. If buf = ϵ, the sender creates one DUMMY whose protected length is

Algorithm 2 Close-aware datastream receive at endpoint X

Algorithm 4 Atomic datagram receive AtomicOpenk (c) → (v, n)

Require: epoch t, incoming datastream fragment c, state from Y 1: (stUD , z, ϕUD ) ← UD.Recv(stUD , c) 2: bad ← bad ∨ ϕUD ; ibuf ← ibuf∥z; L ← [ ] 3: while |ibuf| ≥ Lin do 4: q ← D ECODE BE(ibuf[1..Lin ]) 5: if |ibuf| < Lin + q then break ▷ retain incomplete object 6: remove P = BE8Lin (q)∥d from the front of ibuf 7: F ← DecakY →X (sR , d) 8: if F = ⊥ or F is not a valid τ ∥x then bad ← 1; break 9: if τ = DATA and ¬rfin then 10: append x to L 11: else if τ = DUMMY then 12: discard x 13: else if τ = FIN and x = ϵ and ¬rfin then 14: rfin ← 1 15: else 16: bad ← 1; break 17: sR ← s R + 1 18: return (L, clX (t)) and updated state

1: if |c| < h + 1 then return (⊤, ⊥) 2: if |c| > 65507 then return (invalid, ⊥) 3: parse c = n∥d; z ← Deck (n, d) 4: if z = ⊥ or |z| = 0 then return (invalid, n) 5: if z[1] = 0 then return (⊤, n) 6: if z[1] ̸= 1 or |z| < 3 then return (invalid, n) 7: ℓ ← D ECODE BE(z[2..3]) 8: if ℓ > |z| − 3 then return (invalid, n) 9: return (the final ℓ bytes of z, n)

▷ short chaff

message that is undeliverable, due to length or close state, to the application layer, an operation which we refer to as “backpressure.” The construction uses the nonce-based AEAD of §IV with transmitted uniform nonces. For fixed public parameters L ∈ N and Nsess ≤ 264 , Init(1λ , ΓA , ΓB , Ecl ) samples independent direction keys kA→B and kB→A and initializes each endpoint’s semantic state: sequence sS = 0, replay sets Rn = Rs = ∅, readiness epoch ρ = ⊥, and all bits of Eq. (10) zero. Here L is the linger depth of Eq. (12); sender algorithms abbreviate kX→Y as k. We first define an atomic shaped channel, then the bidirectional semantics implemented by the wrapper.

Algorithm 3 Bidirectional epoch coordinator 1: (cA→B , clS A ) ← SendA (t, µA ) 2: (cB→A , clS B ) ← SendB (t, µB ) 3: adversary/transport produces deliveries ĉA→B , ĉB→A 4: (LB , clR B ) ← RecvB (t, ĉA→B ) 5: (LA , clR A ) ← RecvA (t, ĉB→A ) R S R 6: clA ← clS A ∨ clA ; clB ← clB ∨ clB 7: apply clA , clB as absorbing state updates only now 8: return both scheduled outputs, deliveries, and close bits

A. Atomic shaped channel Let p ∈ [0, 65507] be the requested UDP payload length (the IPv4 format bound), let ℓnonce and ℓtag be the AEAD nonce and tag lengths in bytes, and let h = ℓnonce + ℓtag . The channel has two sender maps, each returning exactly p bytes, and one decoder. In both maps, n ← {0, 1}8ℓnonce is a fresh uniform nonce, transmitted in the clear. For null input ⊤, AtomicSendChaff k (p) outputs p uniform bytes when p < h + 1, and otherwise n∥Enck (n, 0∥0p−h−1 ). For a message m with |m| ≤ 216 − 1 and p ≥ h + 3 + |m|, AtomicSendDatak (m, p) outputs n∥Enck (n, z) with plaintext

τ = DUMMY ∨ ¬rfin ∧ (τ = DATA ∨ (τ = FIN ∧ x = ϵ)) . Acceptance increments sR and applies the semantics of τ . Failure removes P , sets bad, and ends the call without incrementing sR ; the receiver never searches later byte offsets for another boundary. Inner-receiver failures are permanently fail-stop because record alignment cannot be recovered; wrapper failures end only the current call. In both cases, bad remains private and affects neither output length nor visible close. Recovery requires a new higher-layer session.

z = 1∥BE16 (|m|)∥0p−h−3−|m| ∥m.

F. Epoch operation and absorbing close

(8)

With AES-256-GCM, h = 28: lengths 0–28 are unauthenticated uniform chaff, 29 bytes is the smallest authenticated null, and base DATA needs 31 + |m| bytes. Although 65,507 bytes is the maximum UDP payload size, the schedule generator should produce values ΓX (t) that avoid IP fragmentation along the intended network path [22]. Algorithm 4 is the complete decoder AtomicOpenk . Padding precedes the message, so the authenticated 16-bit length selects the final ℓ bytes without putting ℓ on the wire. Short and authenticated-null datagrams have no semantic output, so replaying them is harmless and consumes no antireplay state. Authentication failure is local to one datagram: unlike a datastream, it creates no alignment problem for later packets.

Algorithm 3 runs both sends first. Each receive then uses its endpoint’s post-send state; only the visible-close update is deferred. It combines clX ← clSX ∨clR X and applies closedX ← closedX ∨ clX absorbingly. A closed endpoint subsequently ignores inputs and returns (ϵ, 1). This ordering preserves all ΓX (t) bytes in the closing epoch and emits none afterward. Cross-direction isolation is structural: by Definition 3, S σX→Y and σYR→X share no keys, counters, or buffers, and the only value computed from both is the close conjunction of Eq. (7), which is exactly the declared leakage. V. B IDIRECTIONAL DATAGRAM C ONSTRUCTION The companion construction ΠDG = (Init, SendA , SendB , RecvA , RecvB ) uses the same epoch interface and coordinator (Algorithm 3). Datagrams are atomic, may be reordered, duplicated, or lost, and provide no stream position from which to infer FIN delivery. As a result of this atomicity, the Send algorithm may return a

B. Semantic frame and endpoint state The non-null message given to the atomic channel is the semantic frame M = f ∥BE64 (s)∥x, (9)

Algorithm 5 Scheduled datagram send at endpoint X

where the flag byte f has fixed DATA, FIN, and ACK bit positions, s is the sender’s semantic sequence number, and x is the application payload (possibly ϵ). Algorithm 6 enforces the valid flag combinations. Flags, sequence, and payload are all encrypted. Endpoint X’s semantic state is its outgoing sequence number sS , exact sets Rn , Rs of accepted semantic nonces and sequences, the readiness epoch ρ ∈ N ∪ {⊥} recorded when Eq. (11) first holds, and monotone bits

Require: epoch t, input µ, live endpoint state 1: p ← ΓX (t); x ← ϵ; haveData ← 0 2: if µ = m ∈ M then 3: if ownFin then 4: bad ← 1; reject m 5: else if p < 40 or |m| > p − 40 or sS ≥ Nsess then 6: backpressure m 7: else 8: x ← m; haveData ← 1 ▷ atomic admission 9: else if µ = closeReq and ¬ownFin then 10: if p < 40 or sS ≥ Nsess then backpressure close else ownFin ← 1 11: need ← (haveData ∨ ownFin ∨ peerFin) ∧ sS < Nsess 12: if need and p ≥ 40 then 13: f ←0 14: if haveData then f ← f ∨ DATA 15: if ownFin then f ← f ∨ FIN 16: if peerFin then f ← f ∨ ACK 17: M ← f ∥BE64 (sS )∥x 18: c ← AtomicSendDatak (M, p); sS ← sS + 1 19: if f contains ACK then peerAckSent ← 1 20: else 21: c ← AtomicSendChaff k (p) 22: if ρ = ⊥ and readyX then ρ ← t 23: return (c, clX (t)) and updated state

(ownFin, peerFin, ownFinAck, peerAckSent, closed, bad). (10) Endpoint X is ready, written readyX , exactly when ownFinX ∧ peerFinX ∧ ownFinAckX ∧ peerAckSentX . (11) Valid semantic sequence numbers lie in {0, . . . , Nsess − 1}. Once sS = Nsess , inputs requiring a new semantic frame receive backpressure and the sender emits scheduled chaff; previously established close bits may still advance through received traffic. An authenticated frame with s ≥ Nsess is invalid and yields no semantic output. Thus exhaustion prevents further DATA or control transmission but does not erase readiness already obtained from existing evidence. The exact sets Rn and Rs admit a frame only when both its nonce and sequence number are fresh, irrespective of arrival order. The semantic wrapper adds nine bytes (one flag byte and eight sequence bytes), so the smallest semantic datagram is 28 + 3 + 9 = 40 bytes and the largest application payload at public length p is p − 40. Input that does not fit receives backpressure without changing endpoint state, and SendX emits exactly p bytes of chaff.

Algorithm 6 Datagram receive at endpoint X Require: epoch t, received atomic datagram c from Y 1: (v, n) ← AtomicOpenkY →X (c) 2: if v = ⊤ then return (⊥, clX (t)) 3: if v = invalid then bad ← 1; return (⊥, clX (t)) 4: if n ∈ Rn then return replay with no output 5: insert n into Rn 6: if |v| < 9 then bad ← 1; return no output 7: parse v = f ∥BE64 (s)∥x 8: if s ≥ Nsess then bad ← 1; return no output 9: if s ∈ Rs then return replay with no output 10: insert s into Rs 11: if f = 0 or f has reserved bits or DATA+FIN then 12: bad ← 1; return no output 13: if f has ACK and ¬ownFin then 14: bad ← 1; return no output 15: if f has DATA and peerFin then 16: bad ← 1; return no output 17: if f has FIN then peerFin ← 1 18: if f has ACK then ownFinAck ← 1 19: if f has DATA then deliver x atomically else deliver nothing 20: if ρ = ⊥ and readyX then ρ ← t 21: return delivery and clX (t)

C. Datagram sender Algorithm 5 accepts at most one application input per epoch. After local half-close it repeats FIN, and after peer FIN it repeats ACK, within the existing schedule and through the linger phase of Eq. (12). DATA and FIN are mutually exclusive because DATA is rejected after ownFin is set. DATA+ACK permits continued sending before local half-close; FIN+ACK carries both close signals. With no applicable flag, the sender emits chaff, so it never generates a zero flag byte.

for the peer’s FIN. The send and receive algorithms record ρX when Eq. (11) first holds. The close output is clX (t) = 1 readyX ∧ t ∈ Ecl ∧ |Ecl ∩ [ρX , t)| ≥ L , (12)

D. Datagram receiver, replay, and close After atomic authentication of a non-null message, Algorithm 6 checks both the transmitted nonce and hidden sequence, rejecting repeated ciphertexts and duplicate semantic positions while allowing reordering. FIN and ACK bits are monotone. ACK is valid only after local half-close, and DATA first arriving after authenticated peer FIN is rejected, including earlier DATA reordered across FIN. Such reordering is an availability loss, not acceptance of incorrect semantics. Authentication or semantic-validation failure discards only that datagram and sets private bad; later datagrams remain independently processable. ownFinAck records an authenticated acknowledgment of X’s FIN, while peerAckSent records that X released an ACK

so visible close occurs at the (L+1)-st permitted bucket at or after readiness; L = 0 closes at the first. While sS < Nsess , linger epochs with ΓX (t) ≥ 40 emit fresh FIN+ACK frames; other epochs emit chaff. Algorithm 3 applies the absorbing close only after same-epoch traffic is emitted and processed. Peer liveness requires acceptance of an eligible linger frame; loss, corruption, short schedules, or sequence exhaustion can prevent it. Figure 3 contrasts the two disciplines on one adversarial execution: without linger the acknowledged endpoint’s close makes the peer’s missing ACK permanently

wrapper and inner sequence numbers never repeat within a session, and failure state is private. Then the construction of §IV provides bidirectional traffic shaping, correctness, authenticated wrapper-state integrity, and active BiFEP security with leakage LBD .

(a) immediate bucket close (L=0): e⋆ = ⊥ / 4 A

B FIN

FIN

FIN+ACK

t=2 ready

t=3

Proof sketch. Hybridize each direction’s inner channel to uniform strings; the public schedule fixes every hybrid’s lengths (Proposition 2), and all wrapper state (types, sequence numbers, FIN) is inner-layer plaintext, hence hidden. Halfclose timing is likewise hidden because drain is a releaseside event (Proposition 3). For active traffic, an accepted out-of-sync DATA or FIN implies either an inner activesecurity break or a wrapper AEAD forgery at the still-expected sequence number. Absent such an event, the wrapper state machine is deterministic in honest inputs, so post-FIN DATA is rejected and close cannot occur before Eq. (7) holds. A union bound over the two directions yields the concrete bound in Appendix A. □

t=4 4 ∈ Ecl : B closes, e⋆ B =4 cover, every epoch t≥5

B is silent, so the missing ACK can never arrive: A is never ready and keeps its schedule, e⋆ A =⊥.

(b) one-bucket linger (L=1): e⋆ = 12 / 8 A

B FIN

FIN

FIN+ACK

t=2

t=3

t=4

ready, ρB =3

4 ∈ Ecl : B lingers, keeps FIN+ACK

Theorem 2 (Datagram security). Assume the atomic datagram channel is correct and FEP-CCA secure, the two datagram direction keys are independent of each other and of all datastream keys, transmitted nonces repeat only with negligible probability, and the schedule is application-independent. Then the construction of §V provides exact bidirectional datagram shaping, authentic atomic delivery before peer FIN, replaysafe wrapper integrity, and active BiFEP security with leakage LBD . Close liveness additionally requires timely acceptance of the required FIN/ACK evidence while both endpoints are live, eligible control epochs and semantic sequence space remain, and a permitted close bucket exists (Proposition 4).

t=5 FIN+ACK ready, ρA =5 t=8

t=12

one bucket since ρB : B closes, e⋆ B =8 one bucket since ρA : A closes, e⋆ A =12

Fig. 3. One-sided ACK-phase loss on the baseline profile (Ecl = {4, 8, . . . }, close requests in epoch 2, B-to-A ACK-bearing epochs 3–4 dropped). (a) Under immediate bucket close, B closes at epoch 4 and falls silent, so A never authenticates an ACK and stays live indefinitely. (b) With a one-bucket linger, B stays on schedule through epoch 8, its epoch-5 FIN+ACK completes A’s evidence, and both endpoints close (Table VI, k=2 column).

undeliverable, while a one-bucket linger retransmits it past the drop window. Section VIII-F evaluates the loss boundary. Three invariants follow from the algorithms. Traffic shaping: every live epoch emits one datagram of ΓX (t) bytes. At-mostonce semantics: Rn and Rs admit each semantic datagram’s DATA and control meaning at most once despite reordering or duplication. Close safety: Eq. (11) requires the four FIN/ACK bits except with the atomic channel’s forgery probability (Lemma 1, Appendix B), and Eq. (12) can only defer visible close.

Proof sketch. Hybridize the two atomic channels independently; short chaff is null in both worlds. A fresh accepted semantic frame not produced by the honest sender is a FEPCCA forgery. Nonce and hidden-sequence replay sets make every honest frame effective at most once, and the FIN/ACK bits are monotone, so the close predicate of Eq. (11) cannot become true without an authenticated peer FIN, an authenticated ACK of the endpoint’s own FIN, and a locally emitted ACK (Lemma 1, Appendix B). Loss may delay liveness and thereby change the leaked close bucket. The linger rule is determined by the readiness epoch and public pair (Ecl , L); it changes only the realized bucket e⋆X , adds no further leakage, and cannot be advanced by the adversary. □

VI. S ECURITY A NALYSIS We analyze the constructions under Definitions 1 and 2 of §III-D, with leakage LBD from Eq. (2). The passive game replaces each live output with an equal-length uniform string; the active game adds adversarial delivery to both receivers, with prefix synchronization for streams and atomic matching for datagrams. The monotone wrapper-integrity game covers forged DATA or FIN, post-FIN DATA, and early close; Appendix A gives its concrete bound.

Proposition 4 (Linger close liveness). Suppose endpoint X becomes ready at epoch ρX and closes at e⋆X . If Y accepts any fresh FIN+ACK frame emitted by X in an epoch t ∈ [ρX , e⋆X ], then Y becomes ready upon acceptance and its close output follows Eq. (12). Consequently, X can close while Y remains unready only if no eligible linger frame is accepted because of loss or modification, a schedule below the 40-byte control minimum, or semantic-sequence exhaustion.

Theorem 1 (Datastream security). Assume the inner unidirectional datastream FEP is correct and actively secure with public output lengths and zero inner close, the wrapper AEAD has pseudorandom ciphertexts (IND$-CPA) and INTCTXT security, the four direction/layer keys are independent,

Proof. Readiness of X implies ownFinY , peerFinY , and peerAckSentY ; thus only ownFinAckY may be missing. By

TABLE I M ECHANISMS OF THE UNIDIRECTIONAL FEP S OF [9] AND OF THIS WORK . C OLUMNS ARE PAIRED SO THAT EACH CONSTRUCTION SITS BESIDE THE UNIDIRECTIONAL CHANNEL IT BUILDS ON ; “—” MEANS THE NOTION DOES NOT ARISE . Datastream

Datagram

Unidirectional [9]

This work (§IV)

Unidirectional [9]

This work (§V)

Directions Unit Delivery Nonce Cover

one byte prefix reliable, ordered implicit counter inner-layer padding

two byte prefix reliable, ordered implicit counter authenticated DUMMY object

one atomic datagram loss/reorder/duplicate transmitted fresh null message ⊤

two atomic datagram loss/reorder/duplicate transmitted fresh null ⊤ shaped to ΓX (t)

Frame typing

none (lengths only)

authenticated DATA/DUMMY/FIN wrapper counter s datastream position private; cover continues FIN record released ∧ peer FIN public bucket Ecl fail-stop (inner); call-local (wrapper) structural (four keys)

none — not required by FEP-CCA — none — discard one packet —

authenticated DATA/FIN/ACK flags hidden 64-bit counter exact nonce and sequence sets private; cover continues FIN acknowledged ∧ ACK sent public bucket Ecl , L-bucket linger discard one packet structural (two keys)

one requested byte amortized

zero-byte payload —

zero-byte payload 40-byte payload

Semantic sequence — Replay defense datastream position Half-close — Close evidence sender-side CUD Visible close sender-chosen Failure fail-stop Cross-direction isola- — tion Minimum cover one byte Minimum semantics amortized

Algorithm 5, every semantic datagram emitted by X from ρX to e⋆X carries FIN+ACK. Any fresh such datagram sets ownFinAckY , satisfying Eq. (11); closure then follows from Eq. (12).

Datagram instantiation. The datagram construction adds two direction-specific keys, for six keys when both constructions are instantiated. Each datagram transmits a freshly sampled 12-byte nonce, giving h = 28, a minimum authenticatednull size of 29 bytes, a minimum semantic-datagram size of 40 bytes, and p − 40 application bytes at public length p. The configured session limit is Nsess = 232 semantic datagrams per direction. The datagram evaluation reuses the datastream profile’s baseline schedule and close grid. The conformance, active, and passive datagram suites run at linger depth L=0, which reproduces immediate bucket close; the close-loss sweep of §VIII-F sweeps L ∈ {0, . . . , 3}. Resource policies. The implementation bounds sender queues and per-call receive input at 8 MiB; oversized inputs produce backpressure without changing state or scheduled output. An incomplete wrapper object is limited to 1 MiB and 64 receive calls, after which the receiver enters a permanent non-delivering state. DUMMY payloads are generated by ChaCha20 [25] using operating-system entropy, except in the deterministic evaluation harness. Adapters and coordination. For datastreams, TCP and timed adapters wrap the same endpoint objects; socket reads and writes define neither epochs nor record boundaries. For datagrams, the UDP adapter invokes one send per datagram. In each epoch, both endpoints send, both process delivered peer traffic, and absorbing close is applied last. The harness asserts this order in every trace. Instrumentation and artifact I/O are excluded from byte accounting.

The guarantees are conditional on the fixed public epoch timing and generator profile and on LBD , which reveals realized lengths and close buckets. Because the theorems are parametric in the generator, any application-independent schedule and bucket distribution satisfies the same payload guarantees, including fingerprinting-resistant designs [18]– [21], [23], [24]. Selecting a distribution that resists statistical traffic analysis is outside the games (§III). VII. I MPLEMENTATION The reference implementation contains approximately 20.4k lines of Rust: 2,195 for the datastream construction, 989 for the datagram construction, 813 shared by both (the publicparameter layer and the AEAD boundary), and 16,375 of evaluation harness, with dependencies pinned by its lockfile. AES-256-GCM provides all AEAD operations, using 32-byte keys, 12-byte nonces, and 16-byte tags. Datastream nonces are derived from nonrepeating, context-separated counters; sessions end before counter exhaustion, preventing nonce reuse under a fixed key. The evaluation harness derives keys deterministically for reproducibility; production constructors obtain keys from the operating system’s cryptographically secure random-number generator. Datastream instantiation. Each direction uses an independent inner key and wrapper key (four keys total). Wrapper parameters are Lin = 4, Ltype = 1, Lmax = 1024, Brec = 4096; with the 16-byte wrapper tag and the 36-byte inner overhead of Eq. (1), a protected zero-payload DUMMY costs 21 bytes, and the smallest scheduled epoch is one byte. The baseline evaluation profile uses the asymmetric schedule ΓA =1200, ΓB =1000 bytes/epoch with close buckets every fourth epoch over a 64-epoch evaluation horizon.

VIII. E VALUATION A. Methodology and evidence classes Our evaluation studies the following questions. •

RQ1 (conformance): Do the implementations preserve transcripts, schedules, and close state under adversarial delivery?

TABLE II E VALUATION OUTCOMES . ROWS ARE NON - ADDITIVE ; ACTIVE ROWS ARE SUBSETS , AND DATAGRAM ACTIVE TRIALS COMPRISE 60 MUTATIONS PLUS 60 REPLAYS . Assertions

491 360 30 pairs 6 pairs 150 1,532 cases 60+60 93 points 3 pairs

62,119 — 7,200 1,440 — 3,328 — 442 9

Outcome Class

passed 0 forged; target stalled 0 forged; target stalled 0 forged; target stalled oracle match passed 0 forged; 0 redelivered passed naive 3/3; B I FEP 0/3

Correctness/shape Exact schedule Close behavior Workloads Wrapper progression Inner fail-stop Active integrity

Scenarios

Trials

Normal/stall

Fail

54 43 19 9 5 1 12

54 43 19 9 5 1 360

54/0 43/0 19/0 9/0 5/0 1/0 0/360

0 0 0 0 0 0 0

7.999343 7.999279 7.999457 7.999294

0.004071 0.004668 0.003168 0.003974

0 0 0 0

DATA CHAFF

7.999749 0.001978 7.999724 0.000219

— —

datastream DATA vs. ChaCha20 datastream DATA vs. DUMMY

REPORTS SESSIONS COMPLETING NORMALLY VERSUS SESSIONS IN WHICH THE TARGETED DIRECTION STALLED ; FAIL COUNTS ASSERTION FAILURES .

|corr| 16-B dup.

DATA A→B DATA B→A DUMMY A→B DUMMY B→A

Classifier

TABLE III D ETERMINISTIC DATASTREAM CONFORMANCE RESULTS . N ORMAL / STALL

Category

Entropy (bits/B)

Stream conformance Stream mutations TCP mutations TCP length changes Timed TCP Datagram conformance Datagram active Parameter sweeps Close-leak witness

Trials

CORRELATION IS THE MAXIMUM ABSOLUTE BYTE CORRELATION OVER LAGS 1–16 FOR DATASTREAMS AND LAG 1 FOR DATAGRAMS . T HE 16- BYTE DUPLICATE TEST APPLIES ONLY TO DATASTREAMS .

Harness

TABLE IV PASSIVE BYTE DIAGNOSTICS . E NTROPY IS EMPIRICAL BYTE ENTROPY;

ROC-AUC

95% CI

0.485 0.459

[0.428, 0.542] [0.402, 0.516]

control. Three invariants held throughout: a close visible in epoch t never shortened epoch t’s output; peer FIN caused neither application EOF nor visible transport close; and closed endpoints emitted zero bytes thereafter. Additional tests confirmed the failure discipline of §IV: wrapper failure is calllocal and non-advancing, whereas inner-record failure and resource quarantine are permanently non-delivering. C. Active integrity (RQ2) To test active integrity, we ran a series of paired trials, in which an identical application stream was either delivered normally or subjected to one or more active attacks, and the results were compared. Across 360 datastream trials— insertion, deletion, truncation, duplication, replay, reflection, injection before/within/after the stream, single- and multi-bit flips, and FIN-adjacent flips, rotated across both directions and simultaneous targeting—none delivered forged DATA or FIN or caused premature close. In each single-direction mutation, the reverse-direction workload completed unchanged as expected; the targeted direction could stall. The datastream suite replays the workload of [9] using loopback TCP sockets: 30 control/mutation pairs (2 directions × 5 target emissions × 3 bit offsets). Each mutation caused authentication or parsing failure in the targeted direction, while the other direction completed. In six length-changing attacks (3-byte insertion, deletion, and truncation in each direction), insertion and deletion failed authentication; truncation left the receiver awaiting the missing suffix. Across 60 datagram mutation trials, bit flips, truncation, extension, and uniform replacement prevented delivery of the target datagram, while datagrams in the reverse direction and a later independent datagram always delivered. In 60 replay trials, the transmitted-nonce check rejected every previously accepted ciphertext, producing no duplicate application output.

RQ2 (active integrity): Can the tested modifications forge semantics, couple the directions, or force premature close? • RQ3 (passive diagnostics): Do finite byte statistics reveal an implementation artifact? • RQ4 (cost): What in-memory processing rate and cover expansion does the prototype exhibit, and what pacing error occurs on this host? All experiments ran on Windows 11 (build 26200), an AMD Ryzen 7 7735HS with 16 logical CPUs, and Rust 1.94.0 (MSVC, release profile). Deterministic oracle tests assess protocol conformance; TCP/UDP loopback runs check adapter byte accounting; passive statistical tests inspect byte-level artifacts; and timed runs measure scheduler behavior on the evaluation host. The cryptographic claims follow from the analysis of §VI. •

B. Datastream conformance and close (RQ1) The deterministic suite comprised 143 scenarios, 491 trials, and 5,321 logical epochs; all 62,119 assertions passed (Table III). Correctness cases sweep application chunks of 0– 16,507 bytes across the Lmax =1024 and Brec =4096 boundaries under direct delivery, one-byte and boundary-straddling fragments, seeded random fragments, one-epoch delay, and coalescing after a hold. All 10,642 per-direction live-epoch measurements matched their scheduled lengths exactly. Nineteen close scenarios cover one-sided, simultaneous, staggered, and duplicate close, sparse/dense buckets, backlog, FIN at record boundaries, post-FIN writes, and a no-close

D. Passive diagnostics (RQ3) Table IV reports byte-level diagnostics from 32 datastream sessions of eight epochs per class and 64 datagram sessions. Empirical byte entropy ranged from 7.999279 to 7.999749 bits/byte, and the largest absolute correlation was 0.004668.

TABLE V I N - MEMORY PROCESSING RESULTS ( LOWER SAMPLE MEDIANS , 30 REPETITIONS ). S TREAM AND DATAGRAM ROWS REPRESENT DIFFERENT OPERATIONS AND ARE NOT A RELATIVE - OVERHEAD COMPARISON .

TABLE VI DATAGRAM CLOSE UNDER LOSS . B OTH ENDPOINTS REQUEST CLOSE AT EPOCH 2, WITH CLOSE BUCKETS EVERY FOUR EPOCHS ; THE INDICATED k FIN/ACK EPOCHS ARE DROPPED . E NTRIES SHOW FIRST VISIBLE CLOSE EPOCHS A/B, WITH ⊥ DENOTING NO CLOSE BY EPOCH 32. L OWER BLOCKS REPEAT THE PATTERNS FOR L = 1, 2, 3.

App./op Output/op µs/op Goodput (bytes) (MiB/s)

Operation B I FEP stream epoch B I -DG-FEP atomic send/receive

1,100 600

2,200 1,200

37.0 1.36

k dropped

28.2 420

16 1/load

4 20 goodput

goodput (MiB/s)

cover expansion (×)

expansion 8

0.2

0.4

0.6

0.8

offered load (fraction of 2,200-byte schedule)

Fig. 4. Cover expansion and delivered goodput versus offered load on the fixed 1,200/1,000-byte schedule (10 repetitions × 256 epochs). Each epoch emits 2,200 bytes; expansion reaches 1.09×.

Immediate bucket close (L=0) FIN loss, symmetric 4/4 FIN loss, one-sided 4/4 ACK loss, one-sided 4/4

8/8 8/8 ⊥/4

12 / 12 12 / 12 ⊥/4

One-bucket linger (L=1) FIN loss, symmetric 8/8 FIN loss, one-sided 8/8 ACK loss, one-sided 8/8

12 / 12 12 / 12 12 / 8

16 / 16 16 / 16 ⊥/8

Two-bucket linger (L=2) FIN loss, symmetric 12 / 12 FIN loss, one-sided 12 / 12 ACK loss, one-sided 12 / 12

16 / 16 16 / 16 16 / 12

20 / 20 20 / 20 20 / 12

Three-bucket linger (L=3) FIN loss, symmetric 16 / 16 FIN loss, one-sided 16 / 16 ACK loss, one-sided 16 / 16

20 / 20 20 / 20 20 / 16

24 / 24 24 / 24 24 / 16

by the scheduled traffic per epoch – against our fixed 2,200byte schedule; at nonzero load, we calculated expansion as the scheduled output divided by delivered application data. Figure 4 shows the reults. At idle, all 2,200 bytes/epoch are cover. Expansion is 2.0× at half load and falls to 1.09× at the largest tested load; the excess comprises wrapper/inner framing, schedule headroom, and packing slack. Every point emitted the prescribed per-epoch lengths. Scaling with schedule size. For symmetric schedules ΓA = ΓB = Γ, a sweep from 200 to 12,800 bytes/epoch at 50% load increased median epoch cost from 20 µs to 234 µs. Thus, a 64× increase in scheduled bytes produced an approximately 13.9× increase in median time, reducing measured time per scheduled byte.

No tested 16-byte datastream block repeated, and all 1,024 authenticated datagram nonces were distinct. The linear nearestcentroid classifiers used session-disjoint even/odd training/test splits (256 observations per class in each split), bytehistogram, bit-balance, lag-correlation, run, and compressionproxy features, and normal-approximation intervals adjusted for two comparisons. Table IV reports their held-out ROCAUC values; neither interval excludes 0.5. These finite-sample diagnostics detected no byte-level implementation artifact and do not establish computational indistinguishability. E. Processing cost and cover bandwidth (RQ4)

F. Close under loss (RQ1/RQ2)

To test throughput and computational cost of our prototype, we ran an experiment using prebuilt 600/500-byte inputs and timed both endpoints’ send and receive paths, including cover generation, wrapper and lower-layer cryptography, parsing, and state updates, excluding evaluation traces and assertions, network I/O, and payload generation. Across 7,680 live epochs, each operation delivered 1,100 bytes, emitted exactly 2,200 scheduled bytes, and emptied both queues. The timing results are shown in Table V, where App./op is admitted application data, Output/op is scheduled protocol output, and goodput is App./op divided by elapsed operation time. For each stream operation, The lower median was 37.0 µs per epoch, 28.2 MiB/s of application goodput, and 56.4 MiB/s of shaped output. The distinct datagram operation sends and receives one 600-byte message at a 1,200-byte public length; it costs 1.36 µs and yields 420 MiB/s. Cover expansion versus load. To test the ciphertext expansion of our prototype, we ran a series of trials sweeping the offered load – application data supplied per epoch divided

Because datagram FIN/ACK evidence may be lost, we test whether loss can delay visible close without causing premature termination. Both endpoints request close at epoch 2, while an adversary drops the first k FIN- or ACK-carrying epochs in one or both directions; we then record each endpoint’s first visible close epoch. FIN and ACK bits persist on every semantic datagram (Algorithm 5), and a ready endpoint retransmits them through its linger window (Eq. (12)). Table VI reports L ∈ {0, . . . , 3}; the no-loss controls (k=0) close at 4 / 4, 8 / 8, 12 / 12, and 16 / 16, respectively. FIN-phase loss delayed closure in public-bucket steps. The symmetric and one-sided FIN rows coincide because the ACK exchange completes within one epoch after a FIN is delivered. With L=0, one-sided ACK loss let B close while A remained open: A did not receive the ACK for its FIN before B entered absorbing close. With L=1, every tested pattern with k ≤ 5 ended in bilateral close, with the endpoints closing at most one bucket apart. At k=6, the one-sided

H. Wall-clock scheduling fidelity

TABLE VII H ALF - CLOSE LEAKAGE . C LOSE REQUESTS OCCUR AT THE STARTS OF EPOCHS 2 AND 6; SILENCE ONSET IS A → B / B → A. W ITNESS

While our formal definition of traffic shaping is in terms of traffic per epoch, a deployed implementation would adhere to a wall-clock schedule. To measure the ability of our prototype to meet wall-clock start times, we ran two independently clocked endpoint tasks over loopback TCP at fixed periods of 5, 10, 20, 50, and 100 ms. Start jitter is actual minus nominal start time, so positive values denote delay. An epoch overruns if it completes after the next nominal start. All 150 ten-epoch trials matched the logical oracle, and late epochs were neither skipped nor merged. Across periods, 77–89% of endpointepochs started more than 2 ms late, and median start jitter was 4.2–6.7 ms. Overruns affected 56% of 5 ms epochs, 21% of 10 ms epochs, and 0.33% of 20 ms epochs; none were observed at 50 or 100 ms. These measurements characterize only the tested host and scheduler.

REPORTS SUCCESSFUL DISTINCTIONS AMONG THREE DETERMINISTIC PAIRS .

Silence onset

Half-close inference

Witness

2/6 9/9

epochs 2 and 6 none

3/3 0/3

Naive composition B I FEP (this work)

100

6 jitter

overrun 20

100

median start jitter (ms)

epochs started >2 ms late (%)

late start (A, B)

I. Comparison with deployed transports Table VIII applies the properties of §III-C at the specification level and includes naive composition as a calibration row. Independent unidirectional FEPs provide per-direction passive security and integrity, together with isolation from the independently keyed reverse direction, but not the joint shaping and close properties measured in Table VII. Deployed transports expose different public structure or make padding and cover optional: TLS 1.3 retains outer record metadata and treats a bad record MAC as connectionfatal [1]; QUIC exposes public header fields and Initial-packet processing [2], [3]; and WireGuard exposes message types and counters [13]. Shadowsocks 2022 and obfs4 do not mandate idle cover in both directions or scheduled close [4], [5], while Tor padding is configurable [14]. No surveyed specification mandates the conjunction of bidirectional shaping, idle cover in both directions, hidden half-close, and scheduled close.

public epoch duration (ms)

Fig. 5. Wall-clock fidelity on this host (30 trials × 10 epochs, both endpoints; 2 ms late-start threshold). No overrun was observed at 50 or 100 ms; late starts occurred at every tested period.

ACK-loss pattern suppressed every ACK-bearing datagram from B before its epoch-8 close, leaving A open (Figure 3 traces the k=2 executions of the first two blocks). Each unit of L delayed every otherwise successful close, including the lossless control, by one public bucket, and the L=2 and L=3 blocks left no endpoint open at any tested k: on this grid the acknowledged endpoint closes at epoch 4L+4, so the onesided stall requires k ≥ 4L+2, beyond the tested window for L ≥ 2. Every observed close occurred at a permitted bucket after the four authenticated conditions of Eq. (11); cases without bilateral close were liveness failures permitted by Proposition 4.

IX. D ISCUSSION AND L IMITATIONS Deployment requirements. Our construction assumes authenticated shared keys and agreed public parameters; as we discuss in section X, other work has considered fullyencrypted key exchange and integrating such definitions with our work and prototype remains an interesting question for future work. We note that given fresh shared session material and domain-separated derivation, the endpoints can obtain a common sampled schedule and close grid without an additional in-session message. Note that any in-band negotiation must itself satisfy the declared leakage boundary. Full deployments would need to additionally provide congestion control, NAT traversal, fragmentation-safe sizing, and application-data reliability within the public schedule. Costs and operating points. BiFEP’s schedule determines its bandwidth, latency, and processing costs. Provisioning capacity above the application load increases cover traffic (Figure 4), while longer scheduling intervals amortize processing overhead but may increase buffering delay (§VIII-E). Very short intervals can also exceed the implementation’s processing capacity: on our evaluation host, we observed

G. Naive composition versus BiFEP We compare B I FEP with a naive composition of two unidirectional FEPs under the same staggered-close workload and measure whether per-direction silence reveals private halfclose times. The sweep instantiates the sender-side witness of Proposition 1 with two independent inner-FEP senders. Each meets its requested length while open and emits zero after local half-close and drain. Close requests occur at epochs 2 and 6 on the baseline 1,200/1,000 schedule with grid {4, 8, . . . }. Table VII gives the deterministic outcome: naive composition exposes both half-close times and their order, whereas B I FEP keeps both directions scheduled through the shared close bucket. Valid inner-FEP ciphertext alone does not provide the joint idle-cover, half-close, and coordinated-close properties of Definitions 1–2.

TABLE VIII S PECIFICATION - LEVEL PROPERTY COMPARISON , NOT AN IMPLEMENTATION BENCHMARK . “PARTIAL” DENOTES OPTIONAL , MODE - DEPENDENT, OR INCOMPLETE SUPPORT. T HE ILLUSTRATIVE UNIT IS PROTOCOL - SPECIFIC , EXCLUDES IP/TCP/UDP HEADERS , AND IS NOT COMPARABLE ACROSS ROWS . Protocol

Uniform payload

Active integrity

DATA/ctl. indist.

Bidir. shaping

Idle cover

Hidden half-close

Scheduled close

Cross-dir. isolation

Illustrative unit

TLS 1.3 QUIC v1 WireGuard Shadowsocks 2022 obfs4 Tor Naive 2×UD-FEP B I FEP datastream B I -DG-FEP

No No No Partial Partial No Yes Yes Yes

Yes Partial Yes Yes Yes Yes Yes Yes Yes

Partial Partial No Partial Partial Partial Yes Yes Yes

No No No No No No No Yes Yes

No No No No No Partial No Yes Yes

No Partial N/A No No Partial No Yes Yes

No No N/A No No No No Yes Yes

No Partial Partial Partial No No Yes Yes Yes

22 B Initial ≥1200 B 32 B keepalive ≥69 B ≥ 44 B (profile) 514-B cell 1 requested B 1 requested B 0 B chaff / 40 B ctl.

deadline overruns at 5, 10, and 20,ms, but none at 50 or 100,ms (Figure 5). A deployment should therefore select its schedule according to expected load, latency requirements, and available processing capacity. Close latency versus liveness. The public datagram linger depth L trades close latency for loss resilience: each increment delays visible close, including in lossless sessions, by one bucket of Ecl and extends retransmission through the intervening eligible epochs. If n eligible FIN+ACK datagrams in this window are lost independently with probability q, the probability that all are lost is q n (§VIII-F). A public application-level timeout can bound resource use, but yields an abort rather than authenticated full close. Replay memory. Our implementation detects replays by storing every accepted nonce or sequence number for the session. This permits arbitrary packet reordering, but memory grows linearly with the number of accepted semantic datagrams. Although Nsess = 232 bounds the number of semantic frames per direction, it is not intended as a feasible size for this replay set. A deployment can instead use a bounded DTLSstyle anti-replay window [26], which limits memory at the cost of rejecting packets reordered beyond the configured window.

Evidence [1] [2], [3], [12] [13] [5] [4], [9] [14] §VIII-G §VI §VI

do not explicitly treat message ordering, lengths, reactions, or close behavior. Channel security and traffic analysis. Previous work on bidirectional channel security [17], security under ciphertext fragmentation [15], [16],and secure termination [10] studied state, fragmentation, and close behavior without requiring a random wire shape. Website-fingerprinting attacks and defenses instead select an emission schedule and quantify its cost [23], [24], [34]–[36]. These defenses mitigate leakage intentionally left outside the BiFEP abstraction; the security of the resulting public schedule distribution must therefore be evaluated separately. TLS/QUIC wire-image management [1]–[3] and Encrypted Client Hello (ECH), which encrypts privacy-sensitive TLS handshake metadata [37], [38], reduce selected protocol-visible information but do not seek a uniform wire image. BiFEP is complementary: it targets leakage from the subsequent bidirectional traffic pattern and session termination. XI. C ONCLUSION We introduced BiFEPs, to the best of our knowledge, the first framework for fully encrypted bidirectional communication that treats the two traffic directions and session termination as a single security object. We formalized its security requirements and constructed both datastream and datagram BiFEPs, including mechanisms for traffic shaping, authenticated protocol state, and privacy-preserving termination. We evaluated these constructions through a Rust implementation and a specification-level analysis of existing protocols. The implementation passed a suite of security tests, including adversarial mutation, dropping and replay tests, while achieving cover expansion from 2.0× at half load to 1.09× near saturation. We also examined existing deployed transports against the BiFEP requirements and found that none of the surveyed protocols satisfies the full property set. Together, these results show that bidirectional fully encrypted communication requires more than independently protecting two unidirectional channels: traffic behavior and termination must be coordinated across the session. BiFEPs provides a formal model and a concrete realization of this stronger notion, combining bidirectional traffic shaping, active integrity, and private termination.

X. R ELATED W ORK FEPs and obfuscation transports. Our work builds directly on Fenske and Johnson’s definitions and unidirectional constructions [9]. Our new contributions are a bidirectional FEP model that captures both traffic directions and shared termination, a formal treatment of close and half-close behavior, and a datagram construction using authenticated FIN/ACK state. Deployed obfuscation transports, including obfs4, Shadowsocks, and ScrambleSuit, seek random-looking wire images but are not specified under the FEP formal definitions [4], [5], [27]. Prior work on obfuscated transports and their detectability shows that protocol mimicry and ad hoc randomization can leave classifier-visible artifacts [7], [8]. Other works have shown that application- and transport-level characteristics [28]–[30] and packet-level reactions [31] can lead to distinguishers, motivating our explicit treatment of lengths, reactions, and close behavior. Günther et al. [32], [33] have recently studied the obfuscation of key exchange and KEM-based public key encryption, but those works also

E THICAL C ONSIDERATIONS

[20] J. K. Holland, J. Carpenter, S. E. Oh, and N. Hopper, “Detorrent: An adversarial padding-only traffic analysis defense,” Proceedings on Privacy Enhancing Technologies, vol. 1, pp. 98–115, 2024. [21] E. Witwer, J. K. Holland, and N. Hopper, “Padding-only defenses add delay in tor,” in Proceedings of the 21st workshop on privacy in the electronic society, 2022, pp. 29–33. [22] L. Eggert, G. Fairhurst, and G. Shepherd, “Rfc 8085: Udp usage guidelines,” 2017. [23] P. Zhan, L. Wang, and Y. Tang, “Website fingerprinting on early quic traffic,” Computer Networks, vol. 200, p. 108538, 2021. [24] S. Siby, L. Barman, C. Wood, M. Fayed, N. Sullivan, and C. Troncoso, “Evaluating practical quic website fingerprinting defenses for the masses,” Proceedings on Privacy Enhancing Technologies, 2023. [25] Y. Nir and A. Langley, “Rfc 8439: Chacha20 and poly1305 for ietf protocols,” 2018. [26] E. Rescorla, H. Tschofenig, and N. Modadugu, “Rfc 9147: The datagram transport layer security (dtls) protocol version 1.3,” 2022. [27] P. Winter, T. Pulls, and J. Fuss, “Scramblesuit: A polymorphic network protocol to circumvent censorship,” in Proceedings of the 12th ACM workshop on Workshop on privacy in the electronic society, 2013, pp. 213–224. [28] D. Xue, M. Kallitsis, A. Houmansadr, and R. Ensafi, “Fingerprinting obfuscated proxy traffic with encapsulated TLS handshakes,” in USENIX Security Symposium. USENIX, 2024. [Online]. Available: https://www.usenix.org/system/files/sec24summer-prepub-465-xue.pdf [29] M. Hanlon, G. Wan, A. Ascheman, and Z. Durumeric, “Detecting VPN traffic through encapsulated TCP behavior,” in Free and Open Communications on the Internet, 2024. [Online]. Available: https://www.petsymposium.org/foci/2024/foci-2024-0016.pdf [30] W. Wang, D. Xue, P. Kumar, A. Mishra, R. Ensafi et al., “Is custom congestion control a bad idea for circumvention tools?” Free and Open Communications on the Internet, 2025. [31] D. Fifield, “Comments on certain past cryptographic flaws affecting fully encrypted censorship circumvention protocols,” Cryptology ePrint Archive, Paper 2023/1362, 2023. [Online]. Available: https: //eprint.iacr.org/2023/1362 [32] F. Günther, D. Stebila, and S. Veitch, “Obfuscated key exchange,” in Proceedings of the 2024 on ACM SIGSAC Conference on Computer and Communications Security, ser. CCS ’24. New York, NY, USA: Association for Computing Machinery, 2024, p. 2385–2399. [Online]. Available: https://doi.org/10.1145/3658644.3690220 [33] F. Günther, M. Rosenberg, D. Stebila, and S. Veitch, “Hybrid obfuscated key exchange and kems,” in Annual International Cryptology Conference. Springer, 2025, pp. 575–609. [34] V. Shmatikov and M.-H. Wang, “Timing analysis in low-latency mix networks: Attacks and defenses,” in European Symposium on Research in Computer Security. Springer, 2006, pp. 18–33. [35] X. Cai, R. Nithyanand, T. Wang, R. Johnson, and I. Goldberg, “A systematic approach to developing and evaluating website fingerprinting defenses,” in Proceedings of the 2014 ACM SIGSAC conference on computer and communications security, 2014, pp. 227–238. [36] N. Mathews, J. K. Holland, S. E. Oh, M. S. Rahman, N. Hopper, and M. Wright, “Sok: A critical evaluation of efficient website fingerprinting defenses,” in 2023 IEEE Symposium on Security and Privacy (SP). IEEE, 2023, pp. 969–986. [37] E. Rescorla, K. Oku, N. Sullivan, and C. A. Wood, “TLS Encrypted Client Hello,” RFC 9849, Mar. 2026. [Online]. Available: https://www.rfc-editor.org/info/rfc9849 [38] B. M. Schwartz, M. Bishop, and E. Nygren, “Bootstrapping TLS Encrypted ClientHello with DNS Service Bindings,” RFC 9848, Mar. 2026. [Online]. Available: https://www.rfc-editor.org/info/rfc9848

This work aims to protect network-session metadata against surveillance. Our evaluation used only synthetic traffic and systems under our control; it involved no human subjects, user data, or third-party networks. We acknowledge that there is the potential for harms as a result of the deployment of our protocols due to the dual-use nature of private communication technologies. However, under the principal of beneficience, we believe that the potential benefits of increased privacy and greater access to information, freedom of expression, and freedom of association outweigh these harms. R EFERENCES [1] E. Rescorla, “The Transport Layer Security (TLS) Protocol Version 1.3,” RFC 8446, Aug. 2018. [Online]. Available: https://www.rfc-editor. org/info/rfc8446 [2] J. Iyengar and M. Thomson, “QUIC: A UDP-Based Multiplexed and Secure Transport,” RFC 9000, May 2021. [Online]. Available: https://www.rfc-editor.org/info/rfc9000 [3] M. Kühlewind and B. Trammell, “Manageability of the QUIC Transport Protocol,” RFC 9312, Sep. 2022. [Online]. Available: https://www.rfc-editor.org/info/rfc9312 [4] Y. Angel, “obfs4 – The obfourscator,” accessed: Aug. 16, 2026. [Online]. Available: https://github.com/Yawning/obfs4 [5] Shadowsocks Contributors, “SIP022: AEAD-2022 Ciphers,” accessed: Aug. 16, 2026. [Online]. Available: https://shadowsocks.org/doc/sip022. html [6] M. Wu, J. Sippe, D. Sivakumar, J. Burg, P. Anderson, X. Wang, K. Bock, A. Houmansadr, D. Levin, and E. Wustrow, “How the great firewall of china detects and blocks fully encrypted traffic,” in 32nd USENIX Security Symposium (USENIX Security 23), 2023, pp. 2653–2670. [7] L. Wang, K. P. Dyer, A. Akella, T. Ristenpart, and T. Shrimpton, “Seeing through network-protocol obfuscation,” in Proceedings of the 22nd ACM SIGSAC Conference on Computer and Communications Security, 2015, pp. 57–69. [8] A. Houmansadr, C. Brubaker, and V. Shmatikov, “The parrot is dead: Observing unobservable network communications,” in 2013 IEEE Symposium on Security and Privacy. IEEE, 2013, pp. 65–79. [9] E. Fenske and A. Johnson, “Bytes to schlep? use a fep: Hiding protocol metadata with fully encrypted protocols,” in Proceedings of the 2024 on ACM SIGSAC Conference on Computer and Communications Security, 2024, pp. 1982–1996. [10] C. Boyd and B. Hale, “Secure channels and termination: The last word on tls,” in International Conference on Cryptology and Information Security in Latin America. Springer, 2017, pp. 44–65. [11] J. Postel, “Rfc0768: User datagram protocol,” 1980. [12] M. Thomson and S. Turner, “Rfc 9001: Using tls to secure quic,” 2021. [13] J. A. Donenfeld, “Wireguard: next generation kernel network tunnel.” in NDSS, 2017, pp. 1–12. [14] The Tor Project, “Tor specifications,” accessed 2026-07-29. [Online]. Available: https://spec.torproject.org/ [15] M. Fischlin, F. Günther, G. A. Marson, and K. G. Paterson, “Data is a stream: Security of stream-based channels,” in Annual Cryptology Conference. Springer, 2015, pp. 545–564. [16] A. Boldyreva, J. P. Degabriele, K. G. Paterson, and M. Stam, “Security of symmetric encryption in the presence of ciphertext fragmentation,” in Annual International Conference on the Theory and Applications of Cryptographic Techniques. Springer, 2012, pp. 682–699. [17] G. A. Marson and B. Poettering, “Security notions for bidirectional channels,” IACR Transactions on Symmetric Cryptology, pp. 405–426, 2017. [18] S. Li, H. Guo, and N. Hopper, “Measuring information leakage in website fingerprinting attacks and defenses,” in Proceedings of the 2018 ACM SIGSAC Conference on Computer and Communications Security, 2018, pp. 1977–1992. [19] J. K. Holland and N. Hopper, “Regulator: A straightforward website fingerprinting defense,” Proceedings on Privacy Enhancing Technologies, vol. 2, pp. 344–362, 2022.

G ENERATIVE AI A SSISTANCE D ISCLOSURE Large language model assistants (OpenAI Codex and Anthropic Claude) assisted with paper polishing, implementation, and evaluation. The authors reviewed and are responsible for every claim, proof, and artifact.

b Algorithm 7 Passive epoch oracle OEpoch (t, µA , µB )

Algorithm 8 Active datastream experiment ActStrbΠ,A

1: for X ∈ {A, B} do 2: (c0X , clS X ) ← SendX (t, stX , µX ) 3: (·, clR ) ← RecvB (t, stB , c0A ) B 0 4: (·, clR ) ← Recv A (t, stA , cB ) A 5: for X ∈ {A, B} do R 6: apply clS X ∨ clX absorbingly 7: if b = 0 then cbX ← c0X 8: if b = 1 ∧ livetX then cbX ← Rand(ΓX (t)) 9: if b = 1 ∧ ¬livetX then cbX ← ϵ 10: return (cbA , cbB )

1: (ΓA , ΓB , Ecl , σ) ← A(1λ ) 2: (stA , stB ) ← Init(1λ , ΓA , ΓB , Ecl ) 3: Bad ← 0; initialize the integrity monitor below 4: for d ∈ {A → B, B → A} do 5: Cd0,S , CdS , CdR ← ϵ; syncd ← 1 b b 6: run AOS ,OR (σ) until finalization 7: disclose (e⋆A , e⋆B ); obtain A’s guess b′ 8: return 1[b′ = b]

Algorithm 9 Active datastream send oracle OSb (X, t, µ) 1: Y ← X 2: (c0 , clS X ) ← SendX (t, stX , µ) 3: if b = 0 then c ← c0 else c ← Rand(pX (t)) 0,S 0,S 4: CX→Y ← CX→Y ∥c0 S S 5: CX→Y ← CX→Y ∥c 6: return (c, clS X)

O PEN S CIENCE The source code and artifacts required to reproduce our evaluation are available in an anonymous repository at https: //anonymous.4open.science/r/biFep-C235/README.md. A PPENDIX A F ORMAL S ECURITY G AMES AND C ONCRETE B OUNDS

obtaining its guess. Since livetX = 1 exactly through e⋆X , the random branch is a function of LBD alone and gives exactly V1 of Definition 1. In particular, it does not mirror a secretdependent real-output length.

A. Correctness Correctness has four parts. Datastream preservation requires the concatenated delivered chunks in each direction to equal the concatenated admitted DATA. Eventual delivery is conditioned on reliable in-order delivery and continued live schedule invocations. Half-close correctness requires exactly one authenticated FIN after prior DATA and no later DATA in that direction. Close correctness permits visible close only after local and peer half-close readiness and only in Ecl . For a datagram protocol, one send produces one atomic datagram and one receive consumes one. Loss, duplication, and reordering are allowed. An intact, honestly emitted DATA datagram first accepted before authenticated peer FIN returns its exact payload atomically; honest control advances only its encoded bits, and detected replays return null. Loss, duplication, or reordering across FIN may suppress delivery but cannot change accepted semantics. Every sender output respects the UDP payload bound. Close liveness is conditioned on acceptance of the required FIN/ACK evidence while both endpoints remain live and semantic sequence space remains (§VIII-F). The linger phase of Eq. (12) widens this live window: a ready endpoint remains live, retransmitting FIN/ACK, through L further public close buckets (Proposition 4).

C. Active datastream challenge For a direction d = X → Y , the active challenger stores the real shadow sent stream Cd0,S , the stream CdS shown to A, the stream CdR submitted for receipt, and a monotone synchronization bit syncd . Algorithm 8 defines the experiment. Legal queries follow the epoch order of Algorithm 3: one send per live endpoint, followed by one receive per endpoint (where ϵ models no delivery), after which the challenger applies the combined close bits absorbingly. Arbitrary fragmentation, coalescing, delay, insertion, and deletion are expressed by the receive strings across epochs. With pX (t) = ΓX (t) for an endpoint live at the start of t, and pX (t) = 0 otherwise, the send oracle is Algorithm 9. Thus |Cd0,S | = |CdS | at every point. If a synchronized fragment u occupies positions i, . . . , j in CdS , define Mapd (u) = b X (t) be the close bit computed from the Cd0,S [i..j]. Let cl shadow state at the point of return, after any preceding mapped-honest update. The receive oracle below sets d = Y → X, and u is the longest prefix of c for which CdR ∥u ⪯ CdS ; write c = u∥v. The receive oracle is Algorithm 10. All shadow sender and receiver calls in this experiment feed their instrumented generation and acceptance traces to the integrity monitor in the next subsection. Accordingly, synchronized plaintext is suppressed in both worlds. At the first deviation only its common prefix is mapped and processed in the random world; that direction then remains permanently out of sync. The real-world branch continues to process deviating bytes, while the random branch returns only the shadow close bit. The challenger also runs the semantic integrity monitor below; hence forged control state and early close set Bad even when L = [ ]. Active security requires both the distinguishing advantage and Pr[Bad = 1 | b = 0] to be negligible.

B. Passive challenge The following oracle realizes Definition 1 without choosing ideal lengths from secret real-world outputs. After fixing the public parameters, the challenger runs Init(1λ , ΓA , ΓB , Ecl ) and maintains the resulting real shadow execution. Calls below update the stored endpoint states in place; we omit those state outputs for readability. Queries use strictly increasing epochs; both sends run before both honest receives, and close is applied only after all four calls, as in Algorithm 3. Let livetX record whether X was live at the beginning of epoch t. For challenge bit b, the epoch oracle is given in Algorithm 7. When A requests finalization, the challenger discloses the two first absorbing close epochs (e⋆A , e⋆B ) (or ⊥) before

Algorithm 12 Per-frame wrapper-integrity monitor for accepted (s, F )

b Algorithm 10 Active datastream receive oracle OR (X, t, c)

1: Y ← X; d ← Y → X 2: if ¬syncd then 3: CdR ← CdR ∥c b X (t)) 4: if b = 1 then return ([ ], cl 5: (L, cl) ← RecvX (t, stX , c) 6: if L ̸= [ ] then Bad ← 1 7: return (L, cl) 8: compute u, v as above 9: if u ̸= ϵ then u0 ← Mapd (u); RecvX (t, stX , u0 ) 10: CdR ← CdR ∥c b X (t)) 11: if v = ϵ then return ([ ], cl 12: syncd ← 0 b X (t)) 13: if b = 1 then return ([ ], cl 14: (L, cl) ← RecvX (t, stX , v) 15: if L ̸= [ ] then Bad ← 1 16: return (L, cl)

Require: direction d, accepted (s, F ), semantic state before and after F 1: if Logd [s] ̸= F then Bad ← 1 2: if s ∈ Usedd then Bad ← 1 else Usedd ← Usedd ∪ {s} 3: if F delivers DATA after accepted peer FIN then Bad ← 1 4: if F changes FIN/ACK state without its logged flag then Bad ← 1 b,DG Algorithm 13 Active datagram receive oracle OR (X, t, c)

1: Y ← X; d ← Y → X 2: if ∃c0 ∈ Td [c] then 3: select any matching counterpart c0 ∈ Td [c] 4: (stX , ·, cl) ← RecvX (t, stX , c0 ) 5: return (⊥, cl) b X (t)) 6: if b = 1 then return (⊥, cl 7: (stX , x, cl) ← RecvX (t, stX , c) 8: return (x, cl)

-INT Algorithm 11 Wrapper-state integrity experiment ExpBD Π,A 1: (ΓA , ΓB , Ecl , σ) ← A(1λ ) 2: (stA , stB ) ← Init(1λ , ΓA , ΓB , Ecl ) 3: Bad ← 0 4: for all d, s: Logd [s] ← ⊥ 5: for all d: Usedd ← ∅ 6: AOS ,OR (σ) 7: return Bad

ing checks hold. Hence Pr[Bad] ≤ Pr[InnerBad] + Pr[AEADForge],

(13)

-INT for the resulting bad-event probability, Writing AdvBD Π,A FEP-CCFA Adv for the inner datastream FEP’s active-security advantage, and B1 , B2 for the reductions derived from A, guessing the attacked direction with real/random normalization gives the concrete (non-tight) bound

D. Wrapper-state integrity game

-INT ≤ 4AdvFEP-CCFA AdvBD Π,A ΠUD ,B1 + 2AdvINT-CTXT + negl(λ).

The integrity game makes the semantic monitor explicit. It instruments the honest implementation only to expose generated and accepted protected frames; this instrumentation is not part of the protocol interface. For every direction d and authenticated semantic sequence s, the send oracle stores the complete honestly generated frame in Logd [s]. Algorithm 11 gives the game. On OSend (X, t, µ), the challenger runs the honest sender and records every protected frame F created by the call as LogX→X [s] ← F at its authenticated sequence s. If the call reports a first visible close when the corresponding predicate in Eq. (7) or Eq. (12) is false, it sets Bad ← 1, then returns the ordinary ciphertext and close bit. On ORecv (X, t, c), let d = X → X. The challenger runs the honest receiver and examines its instrumented acceptance trace in order. For each accepted pair (s, F ), it applies Algorithm 12. After the trace, if the returned delivery list is not exactly the ordered payloads of the accepted logged DATA frames, the oracle sets Bad ← 1. Finally, if this call reports the endpoint’s first visible close while its deterministic close predicate is false or t ∈ / Ecl , the oracle sets Bad ← 1, and returns the ordinary delivery and close bit. Thus the monotone flag covers frame, DATA, FIN/ACK, replay, post-FIN-DATA, and earlyclose violations. In the datastream active game it is ORed with the non-null-after-deviation event shown above. For the datastream construction, let InnerBad be an unauthentic inner plaintext output and AEADForge a fresh accepted wrapper ciphertext. If neither occurs, every accepted (s, F ) equals the unique logged frame at that direction and sequence, after which the deterministic state machine makes all remain-

AEAD,B2

(14)

For the datagram construction, an unlogged fresh accepted semantic frame is instead an atomic FEP-CCA forgery; Rn and Rs make a logged replay null. Its bad probability is therefore bounded by the sum of the two directional FEP-CCA forgery probabilities and the transmitted-nonce collision probability. E. Active datagram challenge Datagrams use atomic rather than prefix synchronization. The send oracle is the active send oracle above, except that for each direction it records an initially empty multimap Td from each shown c to its real shadow counterpart c0 . A lookup may select any matching counterpart. Multiple matches among short chaff are harmless because every counterpart decodes to null; a collision involving an authenticated datagram has negligible probability. Algorithm 13 defines the receive oracle. Thus an honestly shown datagram advances the shadow receiver but its semantic output is suppressed in both worlds. A new adversarial datagram is opened only in the real world; any accepted DATA/FIN/ACK or early close is recorded by the same integrity monitor. Independent queries allow recovery after a modified or lost datagram, unlike permanent datastream desynchronization. Short chaff and authenticated-null datagrams produce ⊥ in both worlds, and repeated honest outputs cannot redeliver DATA because of Rn and Rs . This is exactly the bidirectional product of the FEP-CCA experiment of [9], with independent direction keys and the two closebucket leakage values.

A PPENDIX B C ONSTRUCTION D ETAILS AND I NVARIANTS

fragments, seeded random fragments, one-epoch delay, coalescing after hold). The exact-length sweep covered selected idle/data boundary lengths between 1 and 8,192 bytes, asymmetric schedules, and a varying asymmetric sequence. Semantic probes checked wrapper tag failure, higher sequence after failure, unknown authenticated tags, post-FIN DATA, DATA/FIN tag substitution, inner fail-stop, and incomplete-length resource quarantine. The TCP Section-9-style suite used two directions, target emissions 1, 2, 3, 5, and 10, and beginning/middle/end bit positions: 30 paired trials. Separate insertion, deletion, and truncation runs kept API and proxy-collected bytes distinct from post-mutation delivered bytes. All reverse directions completed. Datagram exact-length tests cover every integer 0 ≤ p ≤ 1500 plus the 65,507-byte format maximum—dense coverage around realistic MTUs; the construction’s arithmetic enforces the remaining values. Active trials rotate bit flip, truncation, extension, and uniform replacement; each checks no target delivery, complete reverse delivery, later target recovery, and replay rejection. The parameter sweeps (§VIII-E–VIII-H) cover ten load points, symmetric schedules Γ ∈ {200, . . . , 12800} at 50% utilization, 19 deterministic FIN/ACK drop patterns each under linger depths L ∈ {0, . . . , 3}, and 5–100 ms timed batches (30 trials × 10 epochs each), all with oracle checks.

A. Datastream sender and FIN drain The sender maintains an inner plaintext queue buf, generated ciphertext queue obuf, inner record counter r, wrapper counter s, total released bytes out, and two optional FIN counters. finrem is the inner plaintext distance through the end of the FIN object; when record generation consumes that position the sender sets finlim = out + |obuf| + |dUD |, and FIN is drained exactly when out ≥ finlim. The two-counter distinction prevents FIN from being considered public merely because it was queued or encrypted; the entire containing inner ciphertext must have left the endpoint API. The receiver first runs the inner FEP, appends returned plaintext to its wrapper buffer, and repeatedly removes a complete declared object before authenticating it. On wrapper failure it sets private bad state, leaves the expected wrapper sequence unchanged, and stops the call. A valid DATA after peer FIN, a duplicate FIN, a non-empty FIN, or an unknown tag is a semantic failure and produces neither DATA nor close. B. Datagram close safety Lemma 1 (Datagram close safety). No network adversary can cause visible close before an honest endpoint has requested FIN, authenticated peer FIN and peer ACK, emitted ACK, completed its public linger window, and reached a public close epoch, except with the atomic channel’s forgery probability. Proof. The readiness predicate of Eq. (11) is a conjunction of four local monotone bits. ownFin is set only by the application interface. peerFin and ownFinAck are set only after an authenticated semantic frame under the incoming direction key; a novel such frame is a FEP-CCA/INT-CTXT forgery unless honestly emitted. peerAckSent is set only when the endpoint itself releases an ACK-bearing datagram. The close test additionally checks the public epoch. The remaining conjunct of Eq. (12) counts permitted epochs since the locally recorded readiness epoch, a value the adversary cannot manipulate except by delaying readiness itself, which only defers close. Dropping or replaying traffic cannot set a missing bit. Close liveness is conditional: readiness requires accepted evidence, and a visibly closed endpoint stops transmitting. The linger phase retains FIN/ACK transmission through L further public close buckets when eligible epochs and sequence space remain. A peer can be stranded if no such frame is accepted because of loss or modification, a schedule below 40 bytes, or semantic-sequence exhaustion (§VIII-F). This is the datagram analogue of TCP’s final-ACK problem and its TIME - WAIT remedy; §IX discusses the residual latency/liveness trade. A PPENDIX C D ETAILED E VALUATION M ATRICES The correctness sweep used application lengths 0, 1, 1023, 1024, 1025, 4011, 4012, 4013, 16507 under six delivery policies (direct, one-byte fragments, boundary

Record · ID 919238 · SHA-256 1d183ecc1ac62dcb
Retrieved via Conceptio — every document is proof-bundled with source, license, and retrieval metadata.