Outer-Inner TLS (OI-TLS)

Outer-Inner TLS (OI-TLS) hides TLS ClientHello metadata (SNI, ALPN, cipher list, JA3) from on-path DPI by splitting a TLS session into two layers. The client first establishes an outer TLS 1.3 tunnel to an entry node with no SNI, then tunnels an ordinary TLS handshake for the backend inside that encrypted channel. This document describes the architecture, signaling, deployment considerations, and security trade-offs, together with laboratory evidence demonstrating the technique.