Abstract
The claim begins with a question, not a headline.
Research question / RQ-05
Can one bounded parser produce comparable transport evidence across TCP/TLS and HTTP/3 without turning a fingerprint into an identity claim?
HTTP headers can be forged after the transport is established. Hyx therefore extracts evidence from the handshake and carries it forward as attributable identity context, not absolute identity.
Method
Inspect raw handshake capture, parsing, GREASE normalization, JA3/JA4 construction, structural scoring, and reputation refinement; then execute the focused suite and ignored release benchmarks.
Finding
The system creates a shared evidence surface for TCP/TLS and QUIC, but retains uncertainty: transport shape contributes to a verdict rather than becoming the verdict.
Disclosure boundary
Published material covers protocol inputs, normalization, costs, and failure posture. Exact production thresholds and high-value adversarial combinations remain private.
System boundary
One handshake vocabulary across two transports.
S-01 / system topology
TCP/TLS + QUIC / local evidence
Raw ClientHello
TLS and the vendored QUIC path expose the original ClientHello bytes before HTTP request metadata exists.
Bounded parser
The parser extracts versions, ciphers, extensions, curves, signature algorithms, ALPN, and SNI while rejecting malformed or truncated structures safely.
Normalized fingerprints
GREASE values are removed before stable JA3 and JA4 representations are constructed; HTTP/3 receives its transport-aware prefix.
Evidence fusion
Structural irregularities, claimed user agent, protocol behavior, and local reputation refine a bounded bot score used by later policy.
Controlled measurement
Parsing costs more than classification but remains below one microsecond here.
M-01 / host-local evidence
release mode / scoped result
| Measurement | Observed | Scope |
|---|---|---|
| 01ClientHello parse + JA3 + MD5 | 828.2ns | 1.21M operations / second |
| 02Structural classification | 15.59ns | 64.2M operations / second |
| 03Reputation lookup + refine | 11.89ns | 84.1M operations / second |
| 04Focused fingerprint tests | 34 passed | malformed inputs + normalization + scoring |
Release mode, sample ClientHello, single-host microbenchmarks. The parse benchmark is explicitly labelled parse + JA3 + MD5.
Findings
A fingerprint is strongest when it is treated as evidence, not identity.
Earlier signal
Handshake shape exists before request headers and can expose contradictions that application-layer impersonation does not repair.
Cross-transport contract
A common representation lets HTTP/1.1, HTTP/2, and HTTP/3 feed the same downstream policy and attribution surfaces.
Normalization matters
GREASE is intentionally unstable. Removing it prevents designed protocol variation from becoming artificial identity churn.
Uncertainty remains explicit
Shared libraries, corporate proxies, privacy relays, and deliberate mimicry prevent a fingerprint from uniquely naming a person or program.
Correctness and safety
Untrusted bytes enter through narrow, fail-bounded surfaces.
Length-checked parsing
Truncated vectors and nested lengths terminate safely rather than reading beyond the handshake.
GREASE stripping
Reserved churn values are excluded from stable comparison.
Bounded score
Multiple weak indicators accumulate inside a finite structural score instead of producing an automatic identity verdict.
Attributable refinement
Reputation changes the score through an explicit later step that can be logged and audited.
The evidence supports a fast, shared transport-intelligence layer that handles malformed input. It does not support the scientifically unsound claim that JA3 or JA4 uniquely identifies an actor.
Interpretation
The evidence boundary is part of the result.
Sample microbenchmark
Handshake size and extension composition vary. The measured sample is not a distribution of production clients.
Benchmark scope
The 828.2ns result covers the benchmark’s JA3-labelled path; it should not be relabelled as a complete end-to-end JA4 decision.
Evasion is possible
Programmable stacks can mimic common fingerprints, while intermediaries can collapse many users into one transport signature.
Evidence register
Every public claim keeps its provenance attached.
Raw handshake access
The vendored QUIC integration exposes the Initial ClientHello so HTTP/3 can enter the same fingerprint pipeline.
Parser contract
Focused tests cover common handshakes, GREASE, truncation, malformed lengths, JA3, JA4, and protocol-aware output.
Release benchmarks
This host measured 828.2ns parse + JA3 + MD5, 15.59ns classification, and 11.89ns reputation refinement.
Decision boundary
Fingerprint features feed a bounded structural bot score and later reputation refinement rather than an unqualified identity assertion.
References / Harvard style
QUIC
Iyengar, J. and Thomson, M. (2021) QUIC: A UDP-Based Multiplexed and Secure Transport. RFC 9000. Internet Engineering Task Force.
Open source ↗Reference / 02TLS 1.3
Rescorla, E. (2018) The Transport Layer Security (TLS) Protocol Version 1.3. RFC 8446. Internet Engineering Task Force.
Open source ↗Reference / 03JA4+
FoxIO (n.d.) JA4+ Network Fingerprinting. Available at: github.com/FoxIO-LLC/ja4 (Accessed: 11 July 2026).
Open source ↗Research archive
Return to the systems studies.
Mechanisms, measurements, and the limits required to interpret both.