crypto

README

Crypto

TLS version

The version is actually set in three places:

1. record version
2. handshake version
3. supported versions

with regards to JA3, "handshake version" should always be used. "supported versions" cannot be used, as its an array not a single value. further, "record version" cannot be used, as its deprecated since TLS 1.3. More info:

https://datatracker.ietf.org/doc/html/rfc8446#appendix-D

In summary, the TLSVersion should never be higher than 0x0303 (771), as its locked at that value since TLS 1.3. That means that anyone reporting 772 or higher is wrong.

How to get Android JA3?

Check out the cmd/proxy folder.

Servers

• https://tlshello.agwa.name
• https://github.com/AGWA/tlshacks

also:

• https://github.com/wwhtrbbtt/TrackMe
• https://tls.peet.ws

What about Akamai fingerprint?

Paper says HTTP/2 only:

https://blackhat.com/docs/eu-17/materials/eu-17-Shuster-Passive-Fingerprinting-Of-HTTP2-Clients-wp.pdf

Confirmed:

> curl --http1.1 https://tls.peet.ws/api/clean
{
  "ja3": "771,4866-4867-4865-49196-49200-159-52393-52392-52394-49195-49199-158-49188-49192-107-49187-49191-103-49162-49172-57-49161-49171-51-157-156-61-60-53-47-255,0-11-10-13172-16-22-23-49-13-43-45-51,29-23-30-25-24,0-1-2",
  "ja3_hash": "ba730f97dcd1122e74e65411e68f1b40",
  "akamai": "-",
  "akamai_hash": "-"
}

I would need to add HTTP/2 support to my existing code:

https://github.com/refraction-networking/utls/blob/9d36ce36/examples/examples.go#L417-L427

So in that case, supporting JA3 is simpler than supporting Akamai.

Extensions

https://iana.org/assignments/tls-extensiontype-values/tls-extensiontype-values.xhtml

Documentation

Overview

TLS and JA3 parsers

Index

• Constants
• func Fingerprint(ja3 string) string
• func Format_JA3(spec *tls.ClientHelloSpec) (string, error)
• func Parse_JA3(str string) (*tls.ClientHelloSpec, error)
• func Parse_TLS(buf []byte) (*tls.ClientHelloSpec, error)
• func Transport(spec *tls.ClientHelloSpec) *http.Transport

Constants

const Android_API_24 = "771,49195-49196-52393-49199-49200-52392-158-159-49161-49162-49171-" +
	"49172-51-57-156-157-47-53,65281-0-23-35-13-16-11-10,23,0"

len 122, 8fcaa9e4a15f48af0a7d396e3fa5c5eb

const Android_API_25 = "771,49195-49196-52393-49199-49200-52392-158-159-49161-49162-49171-" +
	"49172-51-57-156-157-47-53,65281-0-23-35-13-16-11-10,23-24-25,0"

len 128, 9fc6ef6efc99b933c5e2d8fcf4f68955

const Android_API_26 = "771,49195-49196-52393-49199-49200-52392-49161-49162-49171-" +
	"49172-156-157-47-53,65281-0-23-35-13-5-16-11-10,29-23-24,0"

len 116, d8c87b9bfde38897979e41242626c2f3

const Android_API_29 = "771,4865-4866-4867-49195-49196-52393-49199-49200-52392-49161-49162-49171-" +
	"49172-156-157-47-53,0-23-65281-10-11-35-16-5-13-51-45-43-21,29-23-24,0"

len 143, 9b02ebd3a43b62d825e1ac605b621dc8

const Android_API_32 = Android_API_29

Functions

func Fingerprint

func Fingerprint(ja3 string) string

func Format_JA3

func Format_JA3(spec *tls.ClientHelloSpec) (string, error)

func Parse_JA3

func Parse_JA3(str string) (*tls.ClientHelloSpec, error)

func Parse_TLS

func Parse_TLS(buf []byte) (*tls.ClientHelloSpec, error)

func Transport

func Transport(spec *tls.ClientHelloSpec) *http.Transport

cannot call pointer method RoundTrip on http.Transport