Maybenot is a framework for traffic analysis defenses that hide patterns in encrypted communication. Its goal is to increase the uncertainty of network attackers, hence its logo 🤔 - the thinking face emoji (U+1F914).
Consider encrypted communication protocols such as TLS, QUIC, WireGuard, or Tor. While the connections are encrypted, patterns in the encrypted communication may still leak information about the communicated plaintext. Maybenot is a framework for running defenses that hide such patterns.
The Maybenot workspace consists of the following crates:
- maybenot: The core framework for running defenses.
- maybenot-ffi: A wrapper library around maybenot with a C FFI.
- maybenot-simulator: A simulator for testing defenses.
- maybenot-machines: A library of maybenot machines for defenses.
- maybenot-gen: A library for generating maybenot defenses.
- maybenot-cli: A binary CLI for creating maybenot defenses.
The maybenot framework is integrated with some encrypted protocol, either
directly or using something like maybenot-ffi. State machines are run within
the framework, triggering cover traffic and delays to hide patterns. Machines
can be rapidly evaluated using maybenot-sim. We have implemented a bunch of
machines by hand, available in maybenot-machines. Many are based on related
work in the academic literature around website
fingerprinting. It
is also possible to generate (many) machines using maybenot-gen, either used
directly as a library, or using a binary CLI like maybenot-cli.
See the README-files of each respective crate and their docs.rs.
Papers related to Maybenot:
- Defense generation a PETS 2026 (camera-ready available during fall).
- Version 2 of the framework on arXiv.
- Version 1 of the framework at WPES 2023.
Maybenot is used by Mullvad VPN in DAITA. Their WireGuard Go integration.
We aim to follow the MSRV of Arti, currently at 1.85.
Unless you explicitly state otherwise, any contribution intentionally submitted for inclusion in the work by you, as defined in the Apache-2.0 license, shall be dual licensed as MIT or Apache-2.0, without any additional terms or conditions.
Maybenot is based on the Circuit Padding Framework of Tor by Perry and Kadianakis from 2019, which is a generalization of the WTF-PAD Website Fingerprinting Defense design by Juarez et al. from 2016, which in turn is based on the concept of Adaptive Padding by Shmatikov and Wang from 2006.
Made possible with support from Mullvad VPN, the Swedish Internet Foundation, and the Knowledge Foundation of Sweden.