JA4 is including signature hash algorithms outside of the signature hash extension

FoxIO-LLC / ja4

JA4+ is a suite of network fingerprinting standards

https://foxio.io

Other

775 stars 65 forks source link

JA4 is including signature hash algorithms outside of the signature hash extension #41

Closed john-althouse closed 5 months ago

john-althouse commented 6 months ago

If a TLS Client Hello contains the "Delegated Credentials" extension, for example, JA4 will include those Signature Hash Algorithms in JA4_c when it should only include the Signature Hash Algorithms from the "Signature Algorithms" extension.