Assuming that jitter will hide the signal seems optimistic to me - "attacks always get better", and e.g. Figure 5 seems to suggest that just throwing more measu

Assuming that jitter will hide the signal seems optimistic to me - "attacks always get better", and e.g. Figure 5 seems to suggest that just throwing more measurements at the problem is fairly effective. Of course, more measurements means that the attack takes longer, but note that the bruteforcing of the initial two bytes dominates the time the attack takes. If those bytes are partially or fully known, e.g. because you know some headers and can manipulate the length of certain fields, the attack becomes comparatively fast. Of course, you do need a victim which automatically reconnects or uses DTLS, both of which are somewhat questionable.