JA4 didn't define SCSVs clearly which caused incompatible implementations

[secmobi]

(This is partially redundant with FoxIO-LLC/ja4-nginx-module#10 but I believe worth to create the issue here since the root cause is on the specs rather than in the nginx module implementation, and two repos appear to be maintained by different person. )

In JA4 Technical Details, when defining Number of Ciphers, the doc didn't clarify if Signalling Cipher-Suite Values (SCSVs) should be counted or excluded. At least two SCSVs are involved:

• TLS_EMPTY_RENEGOTIATION_INFO_SCSV in value of 0x00ff defined in RFC 5746, which is quite commonly seen in real world
• TLS_FALLBACK_SCSV in value of 0x5600 defined in RFC 7507

In a simple test using curl as client, the ja4 nignx module generated:

• JA4 string: t13i3012h2_002f,0033,0035,0039,003c,003d,0067,006b,009c,009d,009e,009f,1301,1302,1303,c009,c00a,c013,c014,c023,c024,c027,c028,c02b,c02c,c02f,c030,cca8,cca9,ccaa_000a,000b,000d,0015,0016,0017,002b,002d,0031,0033,3374_0403,0503,0603,0807,0808,0809,080a,080b,0804,0805,0806,0401,0501,0601,0303,0301,0302,0402,0502,0602
• JA4 hash: t13i3012h2_1d37bd780c83_ce5650b735ce`

While on the same TLS request, the ja4 plugin in Wireshark generated:

• JA4 string: t13i3112h2_002f,0033,0035,0039,003c,003d,0067,006b,009c,009d,009e,009f,00ff,1301,1302,1303,c009,c00a,c013,c014,c023,c024,c027,c028,c02b,c02c,c02f,c030,cca8,cca9,ccaa_000a,000b,000d,0015,0016,0017,002b,002d,0031,0033,3374_0403,0503,0603,0807,0808,0809,080a,080b,0804,0805,0806,0401,0501,0601,0303,0301,0302,0402,0502,0602
• JA4 hash: t13i3112h2_e8f1e7e78f70_ce5650b735ce

The differences between them are highlighted.

The ambiguous definition also potentially cause a third party implementation producing incompatible values (when using a different language or library, or even different functions in the same library for obtaining cipher suite), pretty like what happened on ja3er.

[tozh]

I encountered the same issue. I found some Golang JA4 implementation (https://github.com/wi1dcard/fingerproxy/blob/master/pkg/ja4/ja4.go) and Wireshark contain the cipher TLS_EMPTY_RENEGOTIATION_INFO_SCSV (0x00ff).

But Nginx implementation doesn't include it.

Please explicitly define the action, to prevent the community implementation inconsistency.

[john-althouse]

@secmobi @tozh Thanks for bringing this up! Do you have a pcap example?

My initial thought is to update the spec to include these in the count and hash when present as they help to identify specific TLS implementations. The downside being that this would increase the number of potential fingerprints a specific library could produce but that's outvalued by the fact that it would tell a better story of what is happening in the connection.