Block-A-Mole: The Sustainability Frontier of Moving-Target Censorship Resistance

summary

Video file (mp4)

The gist

The gist Internet censorship resistance systems can achieve sustainability by keeping the domain economy ahead of the censor, which requires minting fresh domains at a rate greater than or equal to

In short

This research models moving-target censorship resistance as a timing game between address rotation and domain name management. It finds that raw rotation speed is less important than the ratio of how fast a censor burns domains versus how fast defenders can mint new ones. Sustainability requires keeping the domain burn rate below a specific threshold, $\beta\star$, which dictates the necessary domain introduction rate.

Key concepts

Domain Burn Rate ($\beta$)
This is a key metric representing the ratio of how quickly a censor blocks existing domains ($\lambda_{disc}$) to how quickly defenders can introduce new ones ($\lambda_{intro}$). If this ratio is greater than one, availability cannot be sustained regardless of rotation speed.
Address Layer vs. Domain Layer
The analysis separates the system into two layers: the fast address layer where endpoints race discovery against rotation, and the slow domain layer where the defender's domain economy races minting against burning. The scarcity lies in the domain pool, not just addresses.
Sustainability Frontier ($\beta\star$)
This is a critical threshold derived from the analysis that defines the maximum acceptable domain burn rate for sustained high availability. To stay above this frontier, defenders must ensure their domain introduction rate ($\lambda_{intro}$) meets a specific requirement relative to the censor's burning rate.
Resource Dichotomy
The paper posits that while address rotation is relatively free (address blocking decays geometrically), the domain pool is the scarce resource. Therefore, system design should focus on managing and increasing the domain economy rather than solely optimizing IP address rotation speed.

Terminology used across episodes

This episode discusses

The paper

Block-A-Mole: The Sustainability Frontier of Moving-Target Censorship Resistance · Read on arXiv

Anindya Maiti

University of Oklahoma

Many censorship circumvention systems keep moving their servers to new cloud addresses, so that whatever the censor discovers soon goes stale. But clients often reach these servers through a name the censor can see and block, such as a hostname or a front domain, and moving a server to a new address does not give it a new name. Existing models treat each proxy as a single unit and leave open when such a system keeps working. We model addresses and names as two coupled layers and ask which one limits availability. Enough servers, rotated fast enough relative to how quickly the censor finds them one at a time, keep some address reachable, and we compute how fast is fast enough. Past that point, faster rotation buys almost nothing, and the names become the limit. If the censor burns names, blocking them for good, β times as fast as the system mints new ones, clients can connect less than a 1/β share of the time, however fast the servers move. For an illustrative system with eight servers and room for eight names, sessions lasting five mean mint intervals stay connected with probability at least 0.95 only while β at most 0.66, the system's sustainability frontier, which a censor that times its blocks can cut about tenfold. Public data show that China and Iran block platform names one tenant at a time or a whole suffix at once, that Russia orders such blocks, and that even Snowflake clients need names to obtain proxies. Our solver, simulator and data pipelines are openly available. Once rotation is fast enough, the race that matters is between minting and burning names, not between rotation and discovery.

Transcript

Introduction to the show: ident: Security Radio. Generated commentary on the latest security and cryptography papers.

Nadia: I'm Nadia.

Elias: And I'm Elias, here with Priya.

Nadia: We're looking at the paper: "Block-A-Mole: The Sustainability Frontier of Moving-Target Censorship Resistance".

Elias: Here's the gist of the paper. The gist Internet censorship resistance systems can achieve sustainability by keeping the domain economy ahead of the censor, which requires minting fresh domains at a rate greater than or equal to one divided by a threshold determined by the domain burn rate, and this theory provides an open instrument for testing.

Nadia: How it works The paper formalizes moving-target censorship resistance as a continuous-time timing game on a combinatorial (address, domain) space, generalizing FlipIt to a collateral-bounded adversary The central finding is that under the Great Firewall’s 2024 shift to blocking QUIC and TLS by domain, raw rotation speed is not the binding constraint Whether rotation wins is governed by a single dimensionless quantity, the domain burn rate β = λdisc/λintro, the ratio of how fast the censor blocks the defender’s domains to how fast the defender mints fresh ones We derive a closed-form availability law, prove that address rotation alone (β > 1) cannot sustain high availability regardless of how fast endpoints rotate, and characterize the sustainability frontier β⋆ The Resource Dichotomy The analysis decomposes the game into a fast address layer and a slow domain layer On the fast layer, each endpoint’s address races discovery (λa) against rotation (µ), while on the slow layer, the defender’s registrable-domain economy races minting (λintro) against burning (λdisc) The scarce resource is modeled as the domain pool, which is a birth–death process Key Theoretical Results The paper establishes several critical theoretical results that define the sustainability frontier 1.

Elias: The address resource is free, meaning address blocking incurs a denial probability that decays geometrically in the number of endpoints (Lemma 1) This implies that address rotation defeats an address-only censor 2.

Nadia: The scarce resource is the domain pool, and availability is governed by β = λdisc/λintro A closed-form availability law is derived, and it is proven that whenever the domain burn rate β = λdisc/λintro > 1, availability is bounded away from one regardless of rotation speed 3.

Paper summary: Nadia: So we’ve touched on how this timing game is actually about more than just IP addresses; "Block-A-Mole" formalizes moving-target censorship resistance as a continuous-time timing game on a combinatorial space involving addresses and domains >

Elias: They generalize the FlipIt model to include a collateral-bounded adversary, which is important because it acknowledges that the censor has limitations on how many things they can block at once >

Priya: But what's the main thesis here? What exactly are they trying to prove about this moving target approach?

Nadia: The main thing is proving a sustainability frontier that separates configurations where you can defeat a censor from those where you can't, and that address rotation alone isn't enough when the domain layer is active >

Elias: They show that the address resource itself is free; blocking an address only incurs a denial probability that decays geometrically in the number of endpoints you have >

Priya: So if addresses aren't scarce, where does the real constraint come from in their model? Is it just about how hard it is to keep rotating things?

Nadia: The domain resource is what’s binding; availability becomes governed by beta equals lambda disc over lambda intro, which is the domain burn rate >

Elias: And they derive a closed-form availability law showing that whenever that beta is greater than one, your availability is bounded away from one regardless of how fast you rotate endpoints >

Priya: That means if the censor burns domains faster than you can introduce new ones, your system will eventually fail no matter how aggressive your rotation schedule is >

Nadia: Precisely; they characterize this sustainability frontier by showing it’s the unique root of a certain equation involving alpha ca, which implies sustained availability requires beta to be less than or equal to that frontier value >

Elias: The paper also gives an operational recipe that translates this theory into concrete actions for defenders, suggesting you need your minting rate lambda intro to be greater than or equal to lambda disc divided by that frontier value >

Priya: That’s really practical information; it tells us we shouldn't just focus on the rotation interval, but actually control how fast we introduce new domains >

Nadia: It reframes system design by saying the right lever isn't necessarily rotating IPs faster, but making sure your domain economy is ahead of the censor’s burn rate >

Conclusion: Elias: So looking at "Block-A-Mole," the authors are providing the first formal theory for moving target censorship resistance, moving it from just a set of intuitive choices to a mathematical framework >

Nadia: They’ve shown that the whole point isn't about outrunning detection on one resource, but about managing the competition between two different resources—the address layer and the domain layer >

Elias: The key implication is that for systems facing domain-blocking censors, you need to tune your minting rate based on how fast those domains are being burned by the adversary >

Priya: So if we’re designing a new resistance system, the advice would be to measure that domain burn rate beta and aim to keep it below this calculated sustainability frontier value >

Nadia: Exactly; they provide an open instrument for testing this theory through a simulator, so researchers can check if their deployment strategy actually stays within the sustainable zone >

Elias: And they highlight that diversification across independent providers is a quantitative lever that can actually push that frontier past one, even when the domain burn rate is high >

Priya: It suggests that instead of just worrying about one type of censorship mechanism, we need to design systems with redundancy and spread across different registrars and authorities >

Nadia: So ultimately, it’s about moving from guessing when rotation wins to knowing exactly what inputs—the minting rate and the domain burn rate—determine success or failure >

More episodes

← Home