Hello all,
I have some confusion regarding the characterization of Tor traffic using DPI.
As an improvement there are basically two handshakes that are done.
(i) "outer handshake" which is made to look as real as possible.
(ii) "inner handshake" which is actually used to authenticate and exchange "real" certificates.
I am just not able to understand as to why we need two handshakes, also why do we need "real" and "fake" certificates.
Or if i am missing something, can someone point me to the right resources where i can get the current tor TLS implementation details.