See also this page on russian.
There are three modes of operation and two modes of data confidentiality protection.
Three modes of operation provide various trade-off between resource-consumption and effectiveness.
Data packets are encrypted and authenticated and sent immediately. This is the most effective mode with minimal overhead and delays.
+-----------+ +-----+ +---------+ +------+ | DATA | |DATA | | DATA | | DATA | +-----------+ +-----+ +---------+ +------+ ---------------------------------------------------------------------------------------> t
This mode hides packet’s lengths. It consumes more traffic as a rule.
+------const------+ +------const------+ +------const------+ / \ / \ / \ +------+------------+ +---------+---------+ +-------------+-----+ | DATA | NOISE | | DATA | NOISE | | DATA |NOISE| +------+------------+ +---------+---------+ +-------------+-----+ ---------------------------------------------------------------------------------------> t
This mode also hides packets timestamps. It can increase delays and insert dummy noised packets.
+------const------+ +------const------+ +------const------+ / \ / \ / \ +------+------------+ +---------+---------+ +-------------------+ | DATA | NOISE |<--const-->| DATA | NOISE |<--const-->| NOISE | +------+------------+ +---------+---------+ +-------------------+ ---------------------------------------------------------------------------------------> t
Confidentiality protection modes are also trade-off between effectiveness and resource-consumption.
Encryption and authentication is done using well-known algorithms. This is very effective mode. It generates packets undistinguishable from the noise.
+---------------------------------------------------------+ | PACKET | | | | +-----+ +---------------------------+ +-------+ | | | TAG |/ CIPHERTEXT \ / NONCE \ | | +-----+|-----------------------------||-----------| | | | || | | +---------------------------------------------------------+ | || | |-----------------------------||-----------| | ENCRYPTION || MAC | +------------+---+------------++-----------+ | DATA |PAD| ZEROS || SERIAL | +------------+---+------------++-----------+
This mode does not use any encryption function. Chaffing-and-Winnowing encoding is used over AONT (all-or-nothing) package instead. This mode consumes much more traffic and resources. It also generated undistinguishable from the noise packets.
+----------------------------------------------------+ | PACKET | | | | +---------------------------+ +---------+ | | / CIPHERTEXT \/ NONCE \ | | |-----------------------------||-----------| | | | || | | +----------------------------------------------------+ | || | |--------+--------------------||-----------| |Chaffing| AONT || MAC | +--------+---+---+------------++-----------+ | DATA |PAD| ZEROS || SERIAL | +------------+---+------------++-----------+