What is the relationship between JA3 fingerprint and this type of TLS fingerprint

refraction-networking / utls

Fork of the Go standard TLS library, providing low-level access to the ClientHello for mimicry purposes.

BSD 3-Clause "New" or "Revised" License

1.67k stars 237 forks source link

What is the relationship between JA3 fingerprint and this type of TLS fingerprint #129

Closed ghost closed 1 year ago

ghost commented 1 year ago

I have noticed that JA3 fingerprint is MD5 hash, but on tlsfingerprint.io the fingerprint is exactly not MD5, so I doubt TLS fingerprint in this repo is a different one with JA3 fingerprint?

gaukas commented 1 year ago

Only my personal opinion and this doesn't speak for refraction-networking: JA3 fingerprint is just another concurrent work to Dr.Frolov's paper at NDSS'19 and I expect to see no relation between a JA3 hash and a tlsfingerprint.io hash.

gaukas commented 1 year ago

One noticeable difference is we capture compression method on tlsfingerprint.io while JA3 doesn't -- which indicates some difference in granularity. Of course I suspect there could be something that we do not capture while JA3 does.