Block-A-Mole: The Sustainability Frontier of Moving-Target Censorship Resistance

Address blocking is a losing strategy for the censor: with n=8 endpoints and µ/λa = 1 (discovery as fast as rotation), address-denial probability falls below 10^-2, and even when the censor discovers twice as fast as the defender rotates (µ/λa = 0.5), 7 endpoints keep address denial below 10^-2 (Lemma 1, Figure 1). The collateral budget γ means the censor cannot even block all addresses it discovers, and Corollary 1 gives the explicit threshold: n ≥ ln(1/ε) / ln((λa+µ)/λa) endpoints suffice for any target ε.

§5, §8.1, §8.10, Lemma 1, Corollary 1, Figure 1 evaluation ip-blockingactive-probing cnruir

Correlated domain burns (e.g., registrar takedowns) collapse the sustainability frontier far more than mean burn rate alone: the interval frontier β* falls from 0.65 at burst size b=1 to 0.5 at b=2, 0.3 at b=4, and at b=8 no β in the tested range is sustainable. Conversely, diversifying the same total domain economy across P=8 independent providers (where each provider's pool can be emptied by a single takedown but providers fail independently) moves the frontier past β=1, and simulated P-provider availability matches the closed form A_P = 1 - q^P geometrically (Proposition 4, Figure 5d).

§8.7, §8.8, Proposition 4, Figure 5 defense ip-blocking cnruir

When the domain burn rate β = λdisc/λintro exceeds 1, time-average availability is bounded by A ≤ 1/β regardless of rotation speed µ, endpoint count n, or domain buffer kmax (Theorem 2). Rotation speed µ appears only in the address factor, which redundancy already saturates, and is entirely absent from the binding domain layer — proving that 'rotate faster' is categorically the wrong design lever under a domain-filtering censor.

§6, Theorem 2 evaluation http3-quic-blockdpiip-blocking cnruir

In April 2024 the GFW began decrypting QUIC Initial packets at scale and blocking connections by domain rather than by IP address, targeting the exact transport layer that modern moving-target circumvention systems rely on for session continuity. Because blocking a registrable domain costs the censor essentially zero collateral (unlike blocking a hyperscaler IP range), the censor's optimal Stackelberg budget split allocates f* = 0.97 of its discovery budget to the domain channel once the defender runs n ≥ 2 endpoints (§8.10, Figure 7). GFWatch measurements show hundreds of thousands of domains persistently blocked.

§1, §3, §6, §8.10, Figure 7 detection http3-quic-blockdpisni-blocking cn

Simulator validation shows a sharp phase transition in (α,T)-availability at the sustainability frontier β* ≤ 1. For a canonical configuration of n=8 endpoints and buffer kmax=8, the interval frontier is β* ≈ 0.65, while the time-average crossing is near β ≈ 0.8. Sweeping rotation speed µ/λa from 1 to >100 does not move the frontier — the availability contour over the (β, µ/λa) plane is entirely vertical (Figure 3). The closed-form availability law (Theorem 1) matches simulation to three significant figures across all tested β (Table 2). A rotation-only defender at beta = 1.5 stays below 0.25 availability even at the largest buffer and rotation speed tested, while a domain-aware defender at beta = 0.6 with the same n, mu and pool exceeds 0.95.

§8.2, §8.5, Figure 2, Figure 3, Table 2 evaluation ip-blockingdpi cnruir