116-two-hop-paths-from-guard.txt 5.3 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120
  1. Filename: 116-two-hop-paths-from-guard.txt
  2. Title: Two hop paths from entry guards
  3. Version: $Revision$
  4. Last-Modified: $Date$
  5. Author: Michael Lieberman
  6. Created: 26-Jun-2007
  7. Status: Dead
  8. This proposal is related to (but different from) Mike Perry's proposal 115
  9. "Two Hop Paths."
  10. Overview:
  11. Volunteers who run entry guards should have the option of using only 2
  12. additional tor nodes when constructing their own tor circuits.
  13. While the option of two hop paths should perhaps be extended to every client
  14. (as discussed in Mike Perry's thread), I believe the anonymity properties of
  15. two hop paths are particularly well-suited to client computers that are also
  16. serving as entry guards.
  17. First I will describe the details of the strategy, as well as possible
  18. avenues of attack. Then I will list advantages and disadvantages. Then, I
  19. will discuss some possibly safer variations of the strategy, and finally
  20. some implementation issues.
  21. Details:
  22. Suppose Alice is an entry guard, and wants to construct a two hop circuit.
  23. Alice chooses a middle node at random (not using the entry guard strategy),
  24. and gains anonymity by having her traffic look just like traffic from
  25. someone else using her as an entry guard.
  26. Can Alice's middle node figure out that she is initiator of the traffic? I
  27. can think of four possible approaches for distinguishing traffic from Alice
  28. with traffic through Alice:
  29. 1) Notice that communication from Alice comes too fast: Experimentation is
  30. needed to determine if traffic from Alice can be distinguished from traffic
  31. from a computer with a decent link to Alice.
  32. 2) Monitor Alice's network traffic to discover the lack of incoming packets
  33. at the appropriate times. If an adversary has this ability, then Alice
  34. already has problems in the current system, because the adversary can run a
  35. standard timing attack on Alice's traffic.
  36. 3) Notice that traffic from Alice is unique in some way such that if Alice
  37. was just one of 3 entry guards for this traffic, then the traffic should be
  38. coming from two other entry guards as well. An example of "unique traffic"
  39. could be always sending 117 packets every 3 minutes to an exit node that
  40. exits to port 4661. However, if such patterns existed with sufficient
  41. precision, then it seems to me that Tor already has a problem. (This "unique
  42. traffic" may not be a problem if clients often end up choosing a single
  43. entry guard because their other two are down. Does anyone know if this is
  44. the case?)
  45. 4) First, control the middle node *and* some other part of the traffic,
  46. using standard attacks on a two hop circuit without entry nodes (my recent
  47. paper on Browser-Based Attacks would work well for this
  48. http://petworkshop.org/2007/papers/PET2007_preproc_Browser_based.pdf). With
  49. control of the circuit, we can now cause "unique traffic" as in 3).
  50. Alternatively, if we know something about Alice independently, and we can
  51. see what websites are being visited, we might be able to guess that she is
  52. the kind of person that would visit those websites.
  53. Anonymity Advantages:
  54. -Alice never has the problem of choosing a malicious entry guard. In some
  55. sense, Alice acts as her own entry guard.
  56. Anonymity Disadvantages:
  57. -If Alice's traffic is identified as originating from herself (see above for
  58. how hard that might be), then she has the anonymity of a 2 hop circuit
  59. without entry guards.
  60. Additional advantages:
  61. -A discussion of the latency advantages of two hop circuits is going on in
  62. Mike Perry's thread already.
  63. -Also, we can advertise this change as "Run an entry guard and decrease your
  64. own Tor latency." This incentive has the potential to add nodes to the
  65. network, improving the network as a whole.
  66. Safer variations:
  67. To solve the "unique traffic" problem, Alice could use two hop paths only
  68. 1/3 of the time, and choose 2 other entry guards for the other 2/3 of the
  69. time. All the advantages are now 1/3 as useful (possibly more, if the other
  70. 2 entry guards are not always up).
  71. To solve the problem that Alice's responses are too fast, Alice could delay
  72. her responses (ideally based on some real data of response time when Alice
  73. is used an entry guard). This loses most of the speed advantages of the two
  74. hop path, but if Alice is a fast entry guard, it doesn't lose everything. It
  75. also still has the (arguable) anonymity advantage that Alice doesn't have to
  76. worry about having a malicious entry guard.
  77. Implementation details:
  78. For Alice to remain anonymous using this strategy, she has to actually be
  79. acting as an entry guard for other nodes. This means the two hop option can
  80. only be available to whatever high-performance threshold is currently set on
  81. entry guards. Alice may need to somehow check her own current status as an
  82. entry guard before choosing this two hop strategy.
  83. Another thing to consider: suppose Alice is also an exit node. If the
  84. fraction of exit nodes in existence is too small, she may rarely or never be
  85. chosen as an entry guard. It would be sad if we offered an incentive to run
  86. an entry guard that didn't extend to exit nodes. I suppose clients of Exit
  87. nodes could pull the same trick, and bypass using Tor altogether (zero hop
  88. paths), though that has additional issues.*
  89. Mike Lieberman
  90. MIT
  91. *Why we shouldn't recommend Exit nodes pull the same trick:
  92. 1) Exit nodes would suffer heavily from the problem of "unique traffic"
  93. mentioned above.
  94. 2) It would give governments an incentive to confiscate exit nodes to see if
  95. they are pulling this trick.