blocking.tex 96 KB

1234567891011121314151617181920212223242526272829303132333435363738394041424344454647484950515253545556575859606162636465666768697071727374757677787980818283848586878889909192939495969798991001011021031041051061071081091101111121131141151161171181191201211221231241251261271281291301311321331341351361371381391401411421431441451461471481491501511521531541551561571581591601611621631641651661671681691701711721731741751761771781791801811821831841851861871881891901911921931941951961971981992002012022032042052062072082092102112122132142152162172182192202212222232242252262272282292302312322332342352362372382392402412422432442452462472482492502512522532542552562572582592602612622632642652662672682692702712722732742752762772782792802812822832842852862872882892902912922932942952962972982993003013023033043053063073083093103113123133143153163173183193203213223233243253263273283293303313323333343353363373383393403413423433443453463473483493503513523533543553563573583593603613623633643653663673683693703713723733743753763773783793803813823833843853863873883893903913923933943953963973983994004014024034044054064074084094104114124134144154164174184194204214224234244254264274284294304314324334344354364374384394404414424434444454464474484494504514524534544554564574584594604614624634644654664674684694704714724734744754764774784794804814824834844854864874884894904914924934944954964974984995005015025035045055065075085095105115125135145155165175185195205215225235245255265275285295305315325335345355365375385395405415425435445455465475485495505515525535545555565575585595605615625635645655665675685695705715725735745755765775785795805815825835845855865875885895905915925935945955965975985996006016026036046056066076086096106116126136146156166176186196206216226236246256266276286296306316326336346356366376386396406416426436446456466476486496506516526536546556566576586596606616626636646656666676686696706716726736746756766776786796806816826836846856866876886896906916926936946956966976986997007017027037047057067077087097107117127137147157167177187197207217227237247257267277287297307317327337347357367377387397407417427437447457467477487497507517527537547557567577587597607617627637647657667677687697707717727737747757767777787797807817827837847857867877887897907917927937947957967977987998008018028038048058068078088098108118128138148158168178188198208218228238248258268278288298308318328338348358368378388398408418428438448458468478488498508518528538548558568578588598608618628638648658668678688698708718728738748758768778788798808818828838848858868878888898908918928938948958968978988999009019029039049059069079089099109119129139149159169179189199209219229239249259269279289299309319329339349359369379389399409419429439449459469479489499509519529539549559569579589599609619629639649659669679689699709719729739749759769779789799809819829839849859869879889899909919929939949959969979989991000100110021003100410051006100710081009101010111012101310141015101610171018101910201021102210231024102510261027102810291030103110321033103410351036103710381039104010411042104310441045104610471048104910501051105210531054105510561057105810591060106110621063106410651066106710681069107010711072107310741075107610771078107910801081108210831084108510861087108810891090109110921093109410951096109710981099110011011102110311041105110611071108110911101111111211131114111511161117111811191120112111221123112411251126112711281129113011311132113311341135113611371138113911401141114211431144114511461147114811491150115111521153115411551156115711581159116011611162116311641165116611671168116911701171117211731174117511761177117811791180118111821183118411851186118711881189119011911192119311941195119611971198119912001201120212031204120512061207120812091210121112121213121412151216121712181219122012211222122312241225122612271228122912301231123212331234123512361237123812391240124112421243124412451246124712481249125012511252125312541255125612571258125912601261126212631264126512661267126812691270127112721273127412751276127712781279128012811282128312841285128612871288128912901291129212931294129512961297129812991300130113021303130413051306130713081309131013111312131313141315131613171318131913201321132213231324132513261327132813291330133113321333133413351336133713381339134013411342134313441345134613471348134913501351135213531354135513561357135813591360136113621363136413651366136713681369137013711372137313741375137613771378137913801381138213831384138513861387138813891390139113921393139413951396139713981399140014011402140314041405140614071408140914101411141214131414141514161417141814191420142114221423142414251426142714281429143014311432143314341435143614371438143914401441144214431444144514461447144814491450145114521453145414551456145714581459146014611462146314641465146614671468146914701471147214731474147514761477147814791480148114821483148414851486148714881489149014911492149314941495149614971498149915001501150215031504150515061507150815091510151115121513151415151516151715181519152015211522152315241525152615271528152915301531153215331534153515361537153815391540154115421543154415451546154715481549155015511552155315541555155615571558155915601561156215631564156515661567156815691570157115721573157415751576157715781579158015811582158315841585158615871588158915901591159215931594159515961597159815991600160116021603160416051606160716081609161016111612161316141615161616171618161916201621162216231624162516261627162816291630163116321633163416351636163716381639164016411642164316441645164616471648164916501651165216531654165516561657165816591660166116621663166416651666166716681669167016711672167316741675167616771678167916801681168216831684168516861687168816891690169116921693169416951696169716981699170017011702170317041705170617071708170917101711171217131714171517161717171817191720172117221723172417251726172717281729173017311732173317341735173617371738173917401741174217431744174517461747174817491750175117521753175417551756175717581759176017611762176317641765176617671768176917701771177217731774177517761777177817791780178117821783178417851786178717881789179017911792179317941795179617971798179918001801180218031804180518061807180818091810181118121813181418151816181718181819182018211822182318241825182618271828182918301831183218331834183518361837183818391840184118421843184418451846184718481849185018511852185318541855185618571858185918601861186218631864186518661867186818691870187118721873187418751876187718781879188018811882188318841885188618871888188918901891189218931894
  1. %\documentclass{llncs}
  2. \documentclass{usenixsubmit}
  3. %\documentclass[twocolumn]{article}
  4. %usepackage{usenix}
  5. \usepackage{url}
  6. \usepackage{amsmath}
  7. \usepackage{epsfig}
  8. \setlength{\textwidth}{6.0in}
  9. \setlength{\textheight}{8.5in}
  10. \setlength{\topmargin}{.5cm}
  11. \setlength{\oddsidemargin}{1cm}
  12. \setlength{\evensidemargin}{1cm}
  13. \newenvironment{tightlist}{\begin{list}{$\bullet$}{
  14. \setlength{\itemsep}{0mm}
  15. \setlength{\parsep}{0mm}
  16. % \setlength{\labelsep}{0mm}
  17. % \setlength{\labelwidth}{0mm}
  18. % \setlength{\topsep}{0mm}
  19. }}{\end{list}}
  20. \newcommand{\workingnote}[1]{} % The version that hides the note.
  21. %\newcommand{\workingnote}[1]{(**#1)} % makes the note visible.
  22. \date{}
  23. \title{Design of a blocking-resistant anonymity system\\DRAFT}
  24. %\author{Roger Dingledine\inst{1} \and Nick Mathewson\inst{1}}
  25. \author{Roger Dingledine \\ The Tor Project \\ arma@torproject.org \and
  26. Nick Mathewson \\ The Tor Project \\ nickm@torproject.org}
  27. \begin{document}
  28. \maketitle
  29. \pagestyle{plain}
  30. \begin{abstract}
  31. Internet censorship is on the rise as websites around the world are
  32. increasingly blocked by government-level firewalls. Although popular
  33. anonymizing networks like Tor were originally designed to keep attackers from
  34. tracing people's activities, many people are also using them to evade local
  35. censorship. But if the censor simply denies access to the Tor network
  36. itself, blocked users can no longer benefit from the security Tor offers.
  37. Here we describe a design that builds upon the current Tor network
  38. to provide an anonymizing network that resists blocking
  39. by government-level attackers. We have implemented and deployed this
  40. design, and talk briefly about early use.
  41. \end{abstract}
  42. \section{Introduction}
  43. Anonymizing networks like Tor~\cite{tor-design} bounce traffic around a
  44. network of encrypting relays. Unlike encryption, which hides only {\it what}
  45. is said, these networks also aim to hide who is communicating with whom, which
  46. users are using which websites, and so on. These systems have a
  47. broad range of users, including ordinary citizens who want to avoid being
  48. profiled for targeted advertisements, corporations who don't want to reveal
  49. information to their competitors, and law enforcement and government
  50. intelligence agencies who need to do operations on the Internet without being
  51. noticed.
  52. Historical anonymity research has focused on an
  53. attacker who monitors the user (call her Alice) and tries to discover her
  54. activities, yet lets her reach any piece of the network. In more modern
  55. threat models such as Tor's, the adversary is allowed to perform active
  56. attacks such as modifying communications to trick Alice
  57. into revealing her destination, or intercepting some connections
  58. to run a man-in-the-middle attack. But these systems still assume that
  59. Alice can eventually reach the anonymizing network.
  60. An increasing number of users are using the Tor software
  61. less for its anonymity properties than for its censorship
  62. resistance properties---if they use Tor to access Internet sites like
  63. Wikipedia
  64. and Blogspot, they are no longer affected by local censorship
  65. and firewall rules. In fact, an informal user study
  66. %(described in Appendix~\ref{app:geoip})
  67. showed that a few hundred thousand users people access the Tor network
  68. each day, with about 20\% of them coming from China~\cite{something}.
  69. The current Tor design is easy to block if the attacker controls Alice's
  70. connection to the Tor network---by blocking the directory authorities,
  71. by blocking all the relay IP addresses in the directory, or by filtering
  72. based on the network fingerprint of the Tor TLS handshake. Here we
  73. describe an
  74. extended design that builds upon the current Tor network to provide an
  75. anonymizing
  76. network that resists censorship as well as anonymity-breaking attacks.
  77. In section~\ref{sec:adversary} we discuss our threat model---that is,
  78. the assumptions we make about our adversary. Section~\ref{sec:current-tor}
  79. describes the components of the current Tor design and how they can be
  80. leveraged for a new blocking-resistant design. Section~\ref{sec:related}
  81. explains the features and drawbacks of the currently deployed solutions.
  82. In sections~\ref{sec:bridges} through~\ref{sec:discovery}, we explore the
  83. components of our designs in detail. Section~\ref{sec:security} considers
  84. security implications and Section~\ref{sec:reachability} presents other
  85. issues with maintaining connectivity and sustainability for the design.
  86. %Section~\ref{sec:future} speculates about future more complex designs,
  87. Finally section~\ref{sec:conclusion} summarizes our next steps and
  88. recommendations.
  89. % The other motivation is for places where we're concerned they will
  90. % try to enumerate a list of Tor users. So even if they're not blocking
  91. % the Tor network, it may be smart to not be visible as connecting to it.
  92. %And adding more different classes of users and goals to the Tor network
  93. %improves the anonymity for all Tor users~\cite{econymics,usability:weis2006}.
  94. % Adding use classes for countering blocking as well as anonymity has
  95. % benefits too. Should add something about how providing undetected
  96. % access to Tor would facilitate people talking to, e.g., govt. authorities
  97. % about threats to public safety etc. in an environment where Tor use
  98. % is not otherwise widespread and would make one stand out.
  99. \section{Adversary assumptions}
  100. \label{sec:adversary}
  101. To design an effective anti-censorship tool, we need a good model for the
  102. goals and resources of the censors we are evading. Otherwise, we risk
  103. spending our effort on keeping the adversaries from doing things they have no
  104. interest in doing, and thwarting techniques they do not use.
  105. The history of blocking-resistance designs is littered with conflicting
  106. assumptions about what adversaries to expect and what problems are
  107. in the critical path to a solution. Here we describe our best
  108. understanding of the current situation around the world.
  109. In the traditional security style, we aim to defeat a strong
  110. attacker---if we can defend against this attacker, we inherit protection
  111. against weaker attackers as well. After all, we want a general design
  112. that will work for citizens of China, Thailand, and other censored
  113. countries; for
  114. whistleblowers in firewalled corporate networks; and for people in
  115. unanticipated oppressive situations. In fact, by designing with
  116. a variety of adversaries in mind, we can take advantage of the fact that
  117. adversaries will be in different stages of the arms race at each location,
  118. so an address blocked in one locale can still be useful in others.
  119. We focus on an attacker with somewhat complex goals:
  120. \begin{tightlist}
  121. \item The attacker would like to restrict the flow of certain kinds of
  122. information, particularly when this information is seen as embarrassing to
  123. those in power (such as information about rights violations or corruption),
  124. or when it enables or encourages others to oppose them effectively (such as
  125. information about opposition movements or sites that are used to organize
  126. protests).
  127. \item As a second-order effect, censors aim to chill citizens' behavior by
  128. creating an impression that their online activities are monitored.
  129. \item In some cases, censors make a token attempt to block a few sites for
  130. obscenity, blasphemy, and so on, but their efforts here are mainly for
  131. show. In other cases, they really do try hard to block such content.
  132. \item Complete blocking (where nobody at all can ever download censored
  133. content) is not a
  134. goal. Attackers typically recognize that perfect censorship is not only
  135. impossible, it is unnecessary: if ``undesirable'' information is known only
  136. to a small few, further censoring efforts can be focused elsewhere.
  137. \item Similarly, the censors do not attempt to shut down or block {\it
  138. every} anti-censorship tool---merely the tools that are popular and
  139. effective (because these tools impede the censors' information restriction
  140. goals) and those tools that are highly visible (thus making the censors
  141. look ineffectual to their citizens and their bosses).
  142. \item Reprisal against {\it most} passive consumers of {\it most} kinds of
  143. blocked information is also not a goal, given the broadness of most
  144. censorship regimes. This seems borne out by fact.\footnote{So far in places
  145. like China, the authorities mainly go after people who publish materials
  146. and coordinate organized movements~\cite{mackinnon-personal}.
  147. If they find that a
  148. user happens to be reading a site that should be blocked, the typical
  149. response is simply to block the site. Of course, even with an encrypted
  150. connection, the adversary may be able to distinguish readers from
  151. publishers by observing whether Alice is mostly downloading bytes or mostly
  152. uploading them---we discuss this issue more in
  153. Section~\ref{subsec:upload-padding}.}
  154. \item Producers and distributors of targeted information are in much
  155. greater danger than consumers; the attacker would like to not only block
  156. their work, but identify them for reprisal.
  157. \item The censors (or their governments) would like to have a working, useful
  158. Internet. There are economic, political, and social factors that prevent
  159. them from ``censoring'' the Internet by outlawing it entirely, or by
  160. blocking access to all but a tiny list of sites.
  161. Nevertheless, the censors {\it are} willing to block innocuous content
  162. (like the bulk of a newspaper's reporting) in order to censor other content
  163. distributed through the same channels (like that newspaper's coverage of
  164. the censored country).
  165. \end{tightlist}
  166. We assume there are three main technical network attacks in use by censors
  167. currently~\cite{clayton:pet2006}:
  168. \begin{tightlist}
  169. \item Block a destination or type of traffic by automatically searching for
  170. certain strings or patterns in TCP packets. Offending packets can be
  171. dropped, or can trigger a response like closing the
  172. connection.
  173. \item Block certain IP addresses or destination ports at a
  174. firewall or other routing control point.
  175. \item Intercept DNS requests and give bogus responses for certain
  176. destination hostnames.
  177. \end{tightlist}
  178. We assume the network firewall has limited CPU and memory per
  179. connection~\cite{clayton:pet2006}. Against an adversary who could carefully
  180. examine the contents of every packet and correlate the packets in every
  181. stream on the network, we would need some stronger mechanism such as
  182. steganography, which introduces its own
  183. problems~\cite{active-wardens,tcpstego}. But we make a ``weak
  184. steganography'' assumption here: to remain unblocked, it is necessary to
  185. remain unobservable only by computational resources on par with a modern
  186. router, firewall, proxy, or IDS.
  187. We assume that while various different regimes can coordinate and share
  188. notes, there will be a time lag between one attacker learning how to overcome
  189. a facet of our design and other attackers picking it up. (The most common
  190. vector of transmission seems to be commercial providers of censorship tools:
  191. once a provider adds a feature to meet one country's needs or requests, the
  192. feature is available to all of the provider's customers.) Conversely, we
  193. assume that insider attacks become a higher risk only after the early stages
  194. of network development, once the system has reached a certain level of
  195. success and visibility.
  196. We do not assume that government-level attackers are always uniform
  197. across the country. For example, users of different ISPs in China
  198. experience different censorship policies and mechanisms~\cite{china-ccs07}.
  199. %there is no single centralized place in China
  200. %that coordinates its specific censorship decisions and steps.
  201. We assume that the attacker may be able to use political and economic
  202. resources to secure the cooperation of extraterritorial or multinational
  203. corporations and entities in investigating information sources.
  204. For example, the censors can threaten the service providers of
  205. troublesome blogs with economic reprisals if they do not reveal the
  206. authors' identities.
  207. We assume that our users have control over their hardware and
  208. software---they don't have any spyware installed, there are no
  209. cameras watching their screens, etc. Unfortunately, in many situations
  210. these threats are real~\cite{zuckerman-threatmodels}; yet
  211. software-based security systems like ours are poorly equipped to handle
  212. a user who is entirely observed and controlled by the adversary. See
  213. Section~\ref{subsec:cafes-and-livecds} for more discussion of what little
  214. we can do about this issue.
  215. Similarly, we assume that the user will be able to fetch a genuine
  216. version of Tor, rather than one supplied by the adversary; see
  217. Section~\ref{subsec:trust-chain} for discussion on helping the user
  218. confirm that he has a genuine version and that he can connect to the
  219. real Tor network.
  220. \section{Adapting the current Tor design to anti-censorship}
  221. \label{sec:current-tor}
  222. Tor is popular and sees a lot of use---it's the largest anonymity
  223. network of its kind, and has
  224. attracted more than 1500 volunteer-operated routers from around the
  225. world. Tor protects each user by routing their traffic through a multiply
  226. encrypted ``circuit'' built of a few randomly selected relay, each of which
  227. can remove only a single layer of encryption. Each relay sees only the step
  228. before it and the step after it in the circuit, and so no single relay can
  229. learn the connection between a user and her chosen communication partners.
  230. In this section, we examine some of the reasons why Tor has become popular,
  231. with particular emphasis to how we can take advantage of these properties
  232. for a blocking-resistance design.
  233. Tor aims to provide three security properties:
  234. \begin{tightlist}
  235. \item 1. A local network attacker can't learn, or influence, your
  236. destination.
  237. \item 2. No single router in the Tor network can link you to your
  238. destination.
  239. \item 3. The destination, or somebody watching the destination,
  240. can't learn your location.
  241. \end{tightlist}
  242. For blocking-resistance, we care most clearly about the first
  243. property. But as the arms race progresses, the second property
  244. will become important---for example, to discourage an adversary
  245. from volunteering a relay in order to learn that Alice is reading
  246. or posting to certain websites. The third property helps keep users safe from
  247. collaborating websites: consider websites and other Internet services
  248. that have been pressured
  249. recently into revealing the identity of bloggers
  250. %~\cite{arrested-bloggers}
  251. or treating clients differently depending on their network
  252. location~\cite{netauth}.
  253. %~\cite{google-geolocation}.
  254. The Tor design provides other features as well that are not typically
  255. present in manual or ad hoc circumvention techniques.
  256. First, Tor has a well-analyzed and well-understood way to distribute
  257. information about relay.
  258. Tor directory authorities automatically aggregate, test,
  259. and publish signed summaries of the available Tor routers. Tor clients
  260. can fetch these summaries to learn which routers are available and
  261. which routers are suitable for their needs. Directory information is cached
  262. throughout the Tor network, so once clients have bootstrapped they never
  263. need to interact with the authorities directly. (To tolerate a minority
  264. of compromised directory authorities, we use a threshold trust scheme---
  265. see Section~\ref{subsec:trust-chain} for details.)
  266. Second, the list of directory authorities is not hard-wired.
  267. Clients use the default authorities if no others are specified,
  268. but it's easy to start a separate (or even overlapping) Tor network just
  269. by running a different set of authorities and convincing users to prefer
  270. a modified client. For example, we could launch a distinct Tor network
  271. inside China; some users could even use an aggregate network made up of
  272. both the main network and the China network. (But we should not be too
  273. quick to create other Tor networks---part of Tor's anonymity comes from
  274. users behaving like other users, and there are many unsolved anonymity
  275. questions if different users know about different pieces of the network.)
  276. Third, in addition to automatically learning from the chosen directories
  277. which Tor routers are available and working, Tor takes care of building
  278. paths through the network and rebuilding them as needed. So the user
  279. never has to know how paths are chosen, never has to manually pick
  280. working proxies, and so on. More generally, at its core the Tor protocol
  281. is simply a tool that can build paths given a set of routers. Tor is
  282. quite flexible about how it learns about the routers and how it chooses
  283. the paths. Harvard's Blossom project~\cite{blossom-thesis} makes this
  284. flexibility more concrete: Blossom makes use of Tor not for its security
  285. properties but for its reachability properties. It runs a separate set
  286. of directory authorities, its own set of Tor routers (called the Blossom
  287. network), and uses Tor's flexible path-building to let users view Internet
  288. resources from any point in the Blossom network.
  289. Fourth, Tor separates the role of \emph{internal relay} from the
  290. role of \emph{exit relay}. That is, some volunteers choose just to relay
  291. traffic between Tor users and Tor routers, and others choose to also allow
  292. connections to external Internet resources. Because we don't force all
  293. volunteers to play both roles, we end up with more relays. This increased
  294. diversity in turn is what gives Tor its security: the more options the
  295. user has for her first hop, and the more options she has for her last hop,
  296. the less likely it is that a given attacker will be watching both ends
  297. of her circuit~\cite{tor-design}. As a bonus, because our design attracts
  298. more internal relays that want to help out but don't want to deal with
  299. being an exit relay, we end up providing more options for the first
  300. hop---the one most critical to being able to reach the Tor network.
  301. Fifth, Tor is sustainable. Zero-Knowledge Systems offered the commercial
  302. but now defunct Freedom Network~\cite{freedom21-security}, a design with
  303. security comparable to Tor's, but its funding model relied on collecting
  304. money from users to pay relay operators. Modern commercial proxy systems
  305. similarly
  306. need to keep collecting money to support their infrastructure. On the
  307. other hand, Tor has built a self-sustaining community of volunteers who
  308. donate their time and resources. This community trust is rooted in Tor's
  309. open design: we tell the world exactly how Tor works, and we provide all
  310. the source code. Users can decide for themselves, or pay any security
  311. expert to decide, whether it is safe to use. Further, Tor's modularity
  312. as described above, along with its open license, mean that its impact
  313. will continue to grow.
  314. Sixth, Tor has an established user base of hundreds of
  315. thousands of people from around the world. This diversity of
  316. users contributes to sustainability as above: Tor is used by
  317. ordinary citizens, activists, corporations, law enforcement, and
  318. even government and military users,
  319. %\footnote{\url{https://www.torproject.org/overview}}
  320. and they can
  321. only achieve their security goals by blending together in the same
  322. network~\cite{econymics,usability:weis2006}. This user base also provides
  323. something else: hundreds of thousands of different and often-changing
  324. addresses that we can leverage for our blocking-resistance design.
  325. Finally and perhaps most importantly, Tor provides anonymity and prevents any
  326. single relay from linking users to their communication partners. Despite
  327. initial appearances, {\it distributed-trust anonymity is critical for
  328. anti-censorship efforts}. If any single relay can expose dissident bloggers
  329. or compile a list of users' behavior, the censors can profitably compromise
  330. that relay's operator, perhaps by applying economic pressure to their
  331. employers,
  332. breaking into their computer, pressuring their family (if they have relatives
  333. in the censored area), or so on. Furthermore, in designs where any relay can
  334. expose its users, the censors can spread suspicion that they are running some
  335. of the relays and use this belief to chill use of the network.
  336. We discuss and adapt these components further in
  337. Section~\ref{sec:bridges}. But first we examine the strengths and
  338. weaknesses of other blocking-resistance approaches, so we can expand
  339. our repertoire of building blocks and ideas.
  340. \section{Current proxy solutions}
  341. \label{sec:related}
  342. Relay-based blocking-resistance schemes generally have two main
  343. components: a relay component and a discovery component. The relay part
  344. encompasses the process of establishing a connection, sending traffic
  345. back and forth, and so on---everything that's done once the user knows
  346. where she's going to connect. Discovery is the step before that: the
  347. process of finding one or more usable relays.
  348. For example, we can divide the pieces of Tor in the previous section
  349. into the process of building paths and sending
  350. traffic over them (relay) and the process of learning from the directory
  351. authorities about what routers are available (discovery). With this
  352. distinction
  353. in mind, we now examine several categories of relay-based schemes.
  354. \subsection{Centrally-controlled shared proxies}
  355. Existing commercial anonymity solutions (like Anonymizer.com) are based
  356. on a set of single-hop proxies. In these systems, each user connects to
  357. a single proxy, which then relays traffic between the user and her
  358. destination. These public proxy
  359. systems are typically characterized by two features: they control and
  360. operate the proxies centrally, and many different users get assigned
  361. to each proxy.
  362. In terms of the relay component, single proxies provide weak security
  363. compared to systems that distribute trust over multiple relays, since a
  364. compromised proxy can trivially observe all of its users' actions, and
  365. an eavesdropper only needs to watch a single proxy to perform timing
  366. correlation attacks against all its users' traffic and thus learn where
  367. everyone is connecting. Worse, all users
  368. need to trust the proxy company to have good security itself as well as
  369. to not reveal user activities.
  370. On the other hand, single-hop proxies are easier to deploy, and they
  371. can provide better performance than distributed-trust designs like Tor,
  372. since traffic only goes through one relay. They're also more convenient
  373. from the user's perspective---since users entirely trust the proxy,
  374. they can just use their web browser directly.
  375. Whether public proxy schemes are more or less scalable than Tor is
  376. still up for debate: commercial anonymity systems can use some of their
  377. revenue to provision more bandwidth as they grow, whereas volunteer-based
  378. anonymity systems can attract thousands of fast relays to spread the load.
  379. The discovery piece can take several forms. Most commercial anonymous
  380. proxies have one or a handful of commonly known websites, and their users
  381. log in to those websites and relay their traffic through them. When
  382. these websites get blocked (generally soon after the company becomes
  383. popular), if the company cares about users in the blocked areas, they
  384. start renting lots of disparate IP addresses and rotating through them
  385. as they get blocked. They notify their users of new addresses (by email,
  386. for example). It's an arms race, since attackers can sign up to receive the
  387. email too, but operators have one nice trick available to them: because they
  388. have a list of paying subscribers, they can notify certain subscribers
  389. about updates earlier than others.
  390. Access control systems on the proxy let them provide service only to
  391. users with certain characteristics, such as paying customers or people
  392. from certain IP address ranges.
  393. Discovery in the face of a government-level firewall is a complex and
  394. unsolved
  395. topic, and we're stuck in this same arms race ourselves; we explore it
  396. in more detail in Section~\ref{sec:discovery}. But first we examine the
  397. other end of the spectrum---getting volunteers to run the proxies,
  398. and telling only a few people about each proxy.
  399. \subsection{Independent personal proxies}
  400. Personal proxies such as Circumventor~\cite{circumventor} and
  401. CGIProxy~\cite{cgiproxy} use the same technology as the public ones as
  402. far as the relay component goes, but they use a different strategy for
  403. discovery. Rather than managing a few centralized proxies and constantly
  404. getting new addresses for them as the old addresses are blocked, they
  405. aim to have a large number of entirely independent proxies, each managing
  406. its own (much smaller) set of users.
  407. As the Circumventor site explains, ``You don't
  408. actually install the Circumventor \emph{on} the computer that is blocked
  409. from accessing Web sites. You, or a friend of yours, has to install the
  410. Circumventor on some \emph{other} machine which is not censored.''
  411. This tactic has great advantages in terms of blocking-resistance---recall
  412. our assumption in Section~\ref{sec:adversary} that the attention
  413. a system attracts from the attacker is proportional to its number of
  414. users and level of publicity. If each proxy only has a few users, and
  415. there is no central list of proxies, most of them will never get noticed by
  416. the censors.
  417. On the other hand, there's a huge scalability question that so far has
  418. prevented these schemes from being widely useful: how does the fellow
  419. in China find a person in Ohio who will run a Circumventor for him? In
  420. some cases he may know and trust some people on the outside, but in many
  421. cases he's just out of luck. Just as hard, how does a new volunteer in
  422. Ohio find a person in China who needs it?
  423. % another key feature of a proxy run by your uncle is that you
  424. % self-censor, so you're unlikely to bring abuse complaints onto
  425. % your uncle. self-censoring clearly has a downside too, though.
  426. This challenge leads to a hybrid design---centrally-distributed
  427. personal proxies---which we will investigate in more detail in
  428. Section~\ref{sec:discovery}.
  429. \subsection{Open proxies}
  430. Yet another currently used approach to bypassing firewalls is to locate
  431. open and misconfigured proxies on the Internet. A quick Google search
  432. for ``open proxy list'' yields a wide variety of freely available lists
  433. of HTTP, HTTPS, and SOCKS proxies. Many small companies have sprung up
  434. providing more refined lists to paying customers.
  435. There are some downsides to using these open proxies though. First,
  436. the proxies are of widely varying quality in terms of bandwidth and
  437. stability, and many of them are entirely unreachable. Second, unlike
  438. networks of volunteers like Tor, the legality of routing traffic through
  439. these proxies is questionable: it's widely believed that most of them
  440. don't realize what they're offering, and probably wouldn't allow it if
  441. they realized. Third, in many cases the connection to the proxy is
  442. unencrypted, so firewalls that filter based on keywords in IP packets
  443. will not be hindered. Fourth, in many countries (including China), the
  444. firewall authorities hunt for open proxies as well, to preemptively
  445. block them. And last, many users are suspicious that some
  446. open proxies are a little \emph{too} convenient: are they run by the
  447. adversary, in which case they get to monitor all the user's requests
  448. just as single-hop proxies can?
  449. A distributed-trust design like Tor resolves each of these issues for
  450. the relay component, but a constantly changing set of thousands of open
  451. relays is clearly a useful idea for a discovery component. For example,
  452. users might be able to make use of these proxies to bootstrap their
  453. first introduction into the Tor network.
  454. \subsection{Blocking resistance and JAP}
  455. K\"{o}psell and Hilling's Blocking Resistance
  456. design~\cite{koepsell:wpes2004} is probably
  457. the closest related work, and is the starting point for the design in this
  458. paper. In this design, the JAP anonymity system~\cite{web-mix} is used
  459. as a base instead of Tor. Volunteers operate a large number of access
  460. points that relay traffic to the core JAP
  461. network, which in turn anonymizes users' traffic. The software to run these
  462. relays is, as in our design, included in the JAP client software and enabled
  463. only when the user decides to enable it. Discovery is handled with a
  464. CAPTCHA-based mechanism; users prove that they aren't an automated process,
  465. and are given the address of an access point. (The problem of a determined
  466. attacker with enough manpower to launch many requests and enumerate all the
  467. access points is not considered in depth.) There is also some suggestion
  468. that information about access points could spread through existing social
  469. networks.
  470. \subsection{Infranet}
  471. The Infranet design~\cite{infranet} uses one-hop relays to deliver web
  472. content, but disguises its communications as ordinary HTTP traffic. Requests
  473. are split into multiple requests for URLs on the relay, which then encodes
  474. its responses in the content it returns. The relay needs to be an actual
  475. website with plausible content and a number of URLs which the user might want
  476. to access---if the Infranet software produced its own cover content, it would
  477. be far easier for censors to identify. To keep the censors from noticing
  478. that cover content changes depending on what data is embedded, Infranet needs
  479. the cover content to have an innocuous reason for changing frequently: the
  480. paper recommends watermarked images and webcams.
  481. The attacker and relay operators in Infranet's threat model are significantly
  482. different than in ours. Unlike our attacker, Infranet's censor can't be
  483. bypassed with encrypted traffic (presumably because the censor blocks
  484. encrypted traffic, or at least considers it suspicious), and has more
  485. computational resources to devote to each connection than ours (so it can
  486. notice subtle patterns over time). Unlike our bridge operators, Infranet's
  487. operators (and users) have more bandwidth to spare; the overhead in typical
  488. steganography schemes is far higher than Tor's.
  489. The Infranet design does not include a discovery element. Discovery,
  490. however, is a critical point: if whatever mechanism allows users to learn
  491. about relays also allows the censor to do so, he can trivially discover and
  492. block their addresses, even if the steganography would prevent mere traffic
  493. observation from revealing the relays' addresses.
  494. \subsection{RST-evasion and other packet-level tricks}
  495. In their analysis of China's firewall's content-based blocking, Clayton,
  496. Murdoch and Watson discovered that rather than blocking all packets in a TCP
  497. streams once a forbidden word was noticed, the firewall was simply forging
  498. RST packets to make the communicating parties believe that the connection was
  499. closed~\cite{clayton:pet2006}. They proposed altering operating systems
  500. to ignore forged RST packets. This approach might work in some cases, but
  501. in practice it appears that many firewalls start filtering by IP address
  502. once a sufficient number of RST packets have been sent.
  503. Other packet-level responses to filtering include splitting
  504. sensitive words across multiple TCP packets, so that the censors'
  505. firewalls can't notice them without performing expensive stream
  506. reconstruction~\cite{ptacek98insertion}. This technique relies on the
  507. same insight as our weak steganography assumption.
  508. %\subsection{Internal caching networks}
  509. %Freenet~\cite{freenet-pets00} is an anonymous peer-to-peer data store.
  510. %Analyzing Freenet's security can be difficult, as its design is in flux as
  511. %new discovery and routing mechanisms are proposed, and no complete
  512. %specification has (to our knowledge) been written. Freenet servers relay
  513. %requests for specific content (indexed by a digest of the content)
  514. %``toward'' the server that hosts it, and then cache the content as it
  515. %follows the same path back to
  516. %the requesting user. If Freenet's routing mechanism is successful in
  517. %allowing nodes to learn about each other and route correctly even as some
  518. %node-to-node links are blocked by firewalls, then users inside censored areas
  519. %can ask a local Freenet server for a piece of content, and get an answer
  520. %without having to connect out of the country at all. Of course, operators of
  521. %servers inside the censored area can still be targeted, and the addresses of
  522. %external servers can still be blocked.
  523. %\subsection{Skype}
  524. %The popular Skype voice-over-IP software uses multiple techniques to tolerate
  525. %restrictive networks, some of which allow it to continue operating in the
  526. %presence of censorship. By switching ports and using encryption, Skype
  527. %attempts to resist trivial blocking and content filtering. Even if no
  528. %encryption were used, it would still be expensive to scan all voice
  529. %traffic for sensitive words. Also, most current keyloggers are unable to
  530. %store voice traffic. Nevertheless, Skype can still be blocked, especially at
  531. %its central login server.
  532. %*sjmurdoch* "we consider the login server to be the only central component in
  533. %the Skype p2p network."
  534. %*sjmurdoch* http://www1.cs.columbia.edu/~salman/publications/skype1_4.pdf
  535. %-> *sjmurdoch* ok. what is the login server's role?
  536. %-> *sjmurdoch* and do you need to reach it directly to use skype?
  537. %*sjmurdoch* It checks the username and password
  538. %*sjmurdoch* It is necessary in the current implementation, but I don't know if
  539. %it is a fundemental limitation of the architecture
  540. \subsection{Tor itself}
  541. And last, we include Tor itself in the list of current solutions
  542. to firewalls. Tens of thousands of people use Tor from countries that
  543. routinely filter their Internet. Tor's website has been blocked in most
  544. of them. But why hasn't the Tor network been blocked yet?
  545. We have several theories. The first is the most straightforward: tens of
  546. thousands of people are simply too few to matter. It may help that Tor is
  547. perceived to be for experts only, and thus not worth attention yet. The
  548. more subtle variant on this theory is that we've positioned Tor in the
  549. public eye as a tool for retaining civil liberties in more free countries,
  550. so perhaps blocking authorities don't view it as a threat. (We revisit
  551. this idea when we consider whether and how to publicize a Tor variant
  552. that improves blocking-resistance---see Section~\ref{subsec:publicity}
  553. for more discussion.)
  554. The broader explanation is that the maintenance of most government-level
  555. filters is aimed at stopping widespread information flow and appearing to be
  556. in control, not by the impossible goal of blocking all possible ways to bypass
  557. censorship. Censors realize that there will always
  558. be ways for a few people to get around the firewall, and as long as Tor
  559. has not publically threatened their control, they see no urgent need to
  560. block it yet.
  561. We should recognize that we're \emph{already} in the arms race. These
  562. constraints can give us insight into the priorities and capabilities of
  563. our various attackers.
  564. \section{The relay component of our blocking-resistant design}
  565. \label{sec:bridges}
  566. Section~\ref{sec:current-tor} describes many reasons why Tor is
  567. well-suited as a building block in our context, but several changes will
  568. allow the design to resist blocking better. The most critical changes are
  569. to get more relay addresses, and to distribute them to users differently.
  570. %We need to address three problems:
  571. %- adapting the relay component of Tor so it resists blocking better.
  572. %- Discovery.
  573. %- Tor's network fingerprint.
  574. %Here we describe the new pieces we need to add to the current Tor design.
  575. \subsection{Bridge relays}
  576. Today, Tor relays operate on a few thousand distinct IP addresses;
  577. an adversary
  578. could enumerate and block them all with little trouble. To provide a
  579. means of ingress to the network, we need a larger set of entry points, most
  580. of which an adversary won't be able to enumerate easily. Fortunately, we
  581. have such a set: the Tor users.
  582. Hundreds of thousands of people around the world use Tor. We can leverage
  583. our already self-selected user base to produce a list of thousands of
  584. frequently-changing IP addresses. Specifically, we can give them a little
  585. button in the GUI that says ``Tor for Freedom'', and users who click
  586. the button will turn into \emph{bridge relays} (or just \emph{bridges}
  587. for short). They can rate limit relayed connections to 10 KB/s (almost
  588. nothing for a broadband user in a free country, but plenty for a user
  589. who otherwise has no access at all), and since they are just relaying
  590. bytes back and forth between blocked users and the main Tor network, they
  591. won't need to make any external connections to Internet sites. Because
  592. of this separation of roles, and because we're making use of software
  593. that the volunteers have already installed for their own use, we expect
  594. our scheme to attract and maintain more volunteers than previous schemes.
  595. As usual, there are new anonymity and security implications from running a
  596. bridge relay, particularly from letting people relay traffic through your
  597. Tor client; but we leave this discussion for Section~\ref{sec:security}.
  598. %...need to outline instructions for a Tor config that will publish
  599. %to an alternate directory authority, and for controller commands
  600. %that will do this cleanly.
  601. \subsection{The bridge directory authority}
  602. How do the bridge relays advertise their existence to the world? We
  603. introduce a second new component of the design: a specialized directory
  604. authority that aggregates and tracks bridges. Bridge relays periodically
  605. publish relay descriptors (summaries of their keys, locations, etc,
  606. signed by their long-term identity key), just like the relays in the
  607. ``main'' Tor network, but in this case they publish them only to the
  608. bridge directory authorities.
  609. The main difference between bridge authorities and the directory
  610. authorities for the main Tor network is that the main authorities provide
  611. a list of every known relay, but the bridge authorities only give
  612. out a relay descriptor if you already know its identity key. That is,
  613. you can keep up-to-date on a bridge's location and other information
  614. once you know about it, but you can't just grab a list of all the bridges.
  615. The identity key, IP address, and directory port for each bridge
  616. authority ship by default with the Tor software, so the bridge relays
  617. can be confident they're publishing to the right location, and the
  618. blocked users can establish an encrypted authenticated channel. See
  619. Section~\ref{subsec:trust-chain} for more discussion of the public key
  620. infrastructure and trust chain.
  621. Bridges use Tor to publish their descriptors privately and securely,
  622. so even an attacker monitoring the bridge directory authority's network
  623. can't make a list of all the addresses contacting the authority.
  624. Bridges may publish to only a subset of the
  625. authorities, to limit the potential impact of an authority compromise.
  626. %\subsection{A simple matter of engineering}
  627. %
  628. %Although we've described bridges and bridge authorities in simple terms
  629. %above, some design modifications and features are needed in the Tor
  630. %codebase to add them. We describe the four main changes here.
  631. %
  632. %Firstly, we need to get smarter about rate limiting:
  633. %Bandwidth classes
  634. %
  635. %Secondly, while users can in fact configure which directory authorities
  636. %they use, we need to add a new type of directory authority and teach
  637. %bridges to fetch directory information from the main authorities while
  638. %publishing relay descriptors to the bridge authorities. We're most of
  639. %the way there, since we can already specify attributes for directory
  640. %authorities:
  641. %add a separate flag named ``blocking''.
  642. %
  643. %Thirdly, need to build paths using bridges as the first
  644. %hop. One more hole in the non-clique assumption.
  645. %
  646. %Lastly, since bridge authorities don't answer full network statuses,
  647. %we need to add a new way for users to learn the current status for a
  648. %single relay or a small set of relays---to answer such questions as
  649. %``is it running?'' or ``is it behaving correctly?'' We describe in
  650. %Section~\ref{subsec:enclave-dirs} a way for the bridge authority to
  651. %publish this information without resorting to signing each answer
  652. %individually.
  653. \subsection{Putting them together}
  654. \label{subsec:relay-together}
  655. If a blocked user knows the identity keys of a set of bridge relays, and
  656. he has correct address information for at least one of them, he can use
  657. that one to make a secure connection to the bridge authority and update
  658. his knowledge about the other bridge relays. He can also use it to make
  659. secure connections to the main Tor network and directory authorities, so he
  660. can build circuits and connect to the rest of the Internet. All of these
  661. updates happen in the background: from the blocked user's perspective,
  662. he just accesses the Internet via his Tor client like always.
  663. So now we've reduced the problem from how to circumvent the firewall
  664. for all transactions (and how to know that the pages you get have not
  665. been modified by the local attacker) to how to learn about a working
  666. bridge relay.
  667. There's another catch though. We need to make sure that the network
  668. traffic we generate by simply connecting to a bridge relay doesn't stand
  669. out too much.
  670. %The following section describes ways to bootstrap knowledge of your first
  671. %bridge relay, and ways to maintain connectivity once you know a few
  672. %bridge relays.
  673. % (See Section~\ref{subsec:first-bridge} for a discussion
  674. %of exactly what information is sufficient to characterize a bridge relay.)
  675. \section{Hiding Tor's network fingerprint}
  676. \label{sec:network-fingerprint}
  677. \label{subsec:enclave-dirs}
  678. Currently, Tor uses two protocols for its network communications. The
  679. main protocol uses TLS for encrypted and authenticated communication
  680. between Tor instances. The second protocol is standard HTTP, used for
  681. fetching directory information. All Tor relays listen on their ``ORPort''
  682. for TLS connections, and some of them opt to listen on their ``DirPort''
  683. as well, to serve directory information. Tor relays choose whatever port
  684. numbers they like; the relay descriptor they publish to the directory
  685. tells users where to connect.
  686. One format for communicating address information about a bridge relay is
  687. its IP address and DirPort. From there, the user can ask the bridge's
  688. directory cache for an up-to-date copy of its relay descriptor, and
  689. learn its current circuit keys, its ORPort, and so on.
  690. However, connecting directly to the directory cache involves a plaintext
  691. HTTP request. A censor could create a network fingerprint (known as a
  692. \emph{signature} in the intrusion detection field) for the request
  693. and/or its response, thus preventing these connections. To resolve this
  694. vulnerability, we've modified the Tor protocol so that users can connect
  695. to the directory cache via the main Tor port---they establish a TLS
  696. connection with the bridge as normal, and then send a special ``begindir''
  697. relay command to establish an internal connection to its directory cache.
  698. Therefore a better way to summarize a bridge's address is by its IP
  699. address and ORPort, so all communications between the client and the
  700. bridge will use ordinary TLS. But there are other details that need
  701. more investigation.
  702. What port should bridges pick for their ORPort? We currently recommend
  703. that they listen on port 443 (the default HTTPS port) if they want to
  704. be most useful, because clients behind standard firewalls will have
  705. the best chance to reach them. Is this the best choice in all cases,
  706. or should we encourage some fraction of them pick random ports, or other
  707. ports commonly permitted through firewalls like 53 (DNS) or 110
  708. (POP)? Or perhaps we should use other ports where TLS traffic is
  709. expected, like 993 (IMAPS) or 995 (POP3S). We need more research on our
  710. potential users, and their current and anticipated firewall restrictions.
  711. Furthermore, we need to look at the specifics of Tor's TLS handshake.
  712. Right now Tor uses some predictable strings in its TLS handshakes. For
  713. example, it sets the X.509 organizationName field to ``Tor'', and it puts
  714. the Tor relay's nickname in the certificate's commonName field. We
  715. should tweak the handshake protocol so it doesn't rely on any unusual details
  716. in the certificate, yet it remains secure; the certificate itself
  717. should be made to resemble an ordinary HTTPS certificate. We should also try
  718. to make our advertised cipher-suites closer to what an ordinary web server
  719. would support.
  720. Tor's TLS handshake uses two-certificate chains: one certificate
  721. contains the self-signed identity key for
  722. the router, and the second contains a current TLS key, signed by the
  723. identity key. We use these to authenticate that we're talking to the right
  724. router, and to limit the impact of TLS-key exposure. Most (though far from
  725. all) consumer-oriented HTTPS services provide only a single certificate.
  726. These extra certificates may help identify Tor's TLS handshake; instead,
  727. bridges should consider using only a single TLS key certificate signed by
  728. their identity key, and providing the full value of the identity key in an
  729. early handshake cell. More significantly, Tor currently has all clients
  730. present certificates, so that clients are harder to distinguish from relays.
  731. But in a blocking-resistance environment, clients should not present
  732. certificates at all.
  733. Last, what if the adversary starts observing the network traffic even
  734. more closely? Even if our TLS handshake looks innocent, our traffic timing
  735. and volume still look different than a user making a secure web connection
  736. to his bank. The same techniques used in the growing trend to build tools
  737. to recognize encrypted Bittorrent traffic
  738. %~\cite{bt-traffic-shaping}
  739. could be used to identify Tor communication and recognize bridge
  740. relays. Rather than trying to look like encrypted web traffic, we may be
  741. better off trying to blend with some other encrypted network protocol. The
  742. first step is to compare typical network behavior for a Tor client to
  743. typical network behavior for various other protocols. This statistical
  744. cat-and-mouse game is made more complex by the fact that Tor transports a
  745. variety of protocols, and we'll want to automatically handle web browsing
  746. differently from, say, instant messaging.
  747. % Tor cells are 512 bytes each. So TLS records will be roughly
  748. % multiples of this size? How bad is this? -RD
  749. % Look at ``Inferring the Source of Encrypted HTTP Connections''
  750. % by Marc Liberatore and Brian Neil Levine (CCS 2006)
  751. % They substantially flesh out the numbers for the web fingerprinting
  752. % attack. -PS
  753. % Yes, but I meant detecting the fingerprint of Tor traffic itself, not
  754. % learning what websites we're going to. I wouldn't be surprised to
  755. % learn that these are related problems, but it's not obvious to me. -RD
  756. \subsection{Identity keys as part of addressing information}
  757. \label{subsec:id-address}
  758. We have described a way for the blocked user to bootstrap into the
  759. network once he knows the IP address and ORPort of a bridge. What about
  760. local spoofing attacks? That is, since we never learned an identity
  761. key fingerprint for the bridge, a local attacker could intercept our
  762. connection and pretend to be the bridge we had in mind. It turns out
  763. that giving false information isn't that bad---since the Tor client
  764. ships with trusted keys for the bridge directory authority and the Tor
  765. network directory authorities, the user can learn whether he's being
  766. given a real connection to the bridge authorities or not. (After all,
  767. if the adversary intercepts every connection the user makes and gives
  768. him a bad connection each time, there's nothing we can do.)
  769. What about anonymity-breaking attacks from observing traffic, if the
  770. blocked user doesn't start out knowing the identity key of his intended
  771. bridge? The vulnerabilities aren't so bad in this case either---the
  772. adversary could do similar attacks just by monitoring the network
  773. traffic.
  774. % cue paper by steven and george
  775. Once the Tor client has fetched the bridge's relay descriptor, it should
  776. remember the identity key fingerprint for that bridge relay. Thus if
  777. the bridge relay moves to a new IP address, the client can query the
  778. bridge directory authority to look up a fresh relay descriptor using
  779. this fingerprint.
  780. So we've shown that it's \emph{possible} to bootstrap into the network
  781. just by learning the IP address and ORPort of a bridge, but are there
  782. situations where it's more convenient or more secure to learn the bridge's
  783. identity fingerprint as well as instead, while bootstrapping? We keep
  784. that question in mind as we next investigate bootstrapping and discovery.
  785. \section{Discovering working bridge relays}
  786. \label{sec:discovery}
  787. Tor's modular design means that we can develop a better relay component
  788. independently of developing the discovery component. This modularity's
  789. great promise is that we can pick any discovery approach we like; but the
  790. unfortunate fact is that we have no magic bullet for discovery. We're
  791. in the same arms race as all the other designs we described in
  792. Section~\ref{sec:related}.
  793. In this section we describe a variety of approaches to adding discovery
  794. components for our design.
  795. \subsection{Bootstrapping: finding your first bridge.}
  796. \label{subsec:first-bridge}
  797. In Section~\ref{subsec:relay-together}, we showed that a user who knows
  798. a working bridge address can use it to reach the bridge authority and
  799. to stay connected to the Tor network. But how do new users reach the
  800. bridge authority in the first place? After all, the bridge authority
  801. will be one of the first addresses that a censor blocks.
  802. First, we should recognize that most government firewalls are not
  803. perfect. That is, they may allow connections to Google cache or some
  804. open proxy servers, or they let file-sharing traffic, Skype, instant
  805. messaging, or World-of-Warcraft connections through. Different users will
  806. have different mechanisms for bypassing the firewall initially. Second,
  807. we should remember that most people don't operate in a vacuum; users will
  808. hopefully know other people who are in other situations or have other
  809. resources available. In the rest of this section we develop a toolkit
  810. of different options and mechanisms, so that we can enable users in a
  811. diverse set of contexts to bootstrap into the system.
  812. (For users who can't use any of these techniques, hopefully they know
  813. a friend who can---for example, perhaps the friend already knows some
  814. bridge relay addresses. If they can't get around it at all, then we
  815. can't help them---they should go meet more people or learn more about
  816. the technology running the firewall in their area.)
  817. By deploying all the schemes in the toolkit at once, we let bridges and
  818. blocked users employ the discovery approach that is most appropriate
  819. for their situation.
  820. \subsection{Independent bridges, no central discovery}
  821. The first design is simply to have no centralized discovery component at
  822. all. Volunteers run bridges, and we assume they have some blocked users
  823. in mind and communicate their address information to them out-of-band
  824. (for example, through Gmail). This design allows for small personal
  825. bridges that have only one or a handful of users in mind, but it can
  826. also support an entire community of users. For example, Citizen Lab's
  827. upcoming Psiphon single-hop proxy tool~\cite{psiphon} plans to use this
  828. \emph{social network} approach as its discovery component.
  829. There are several ways to do bootstrapping in this design. In the simple
  830. case, the operator of the bridge informs each chosen user about his
  831. bridge's address information and/or keys. A different approach involves
  832. blocked users introducing new blocked users to the bridges they know.
  833. That is, somebody in the blocked area can pass along a bridge's address to
  834. somebody else they trust. This scheme brings in appealing but complex game
  835. theoretic properties: the blocked user making the decision has an incentive
  836. only to delegate to trustworthy people, since an adversary who learns
  837. the bridge's address and filters it makes it unavailable for both of them.
  838. Also, delegating known bridges to members of your social network can be
  839. dangerous: an the adversary who can learn who knows which bridges may
  840. be able to reconstruct the social network.
  841. Note that a central set of bridge directory authorities can still be
  842. compatible with a decentralized discovery process. That is, how users
  843. first learn about bridges is entirely up to the bridges, but the process
  844. of fetching up-to-date descriptors for them can still proceed as described
  845. in Section~\ref{sec:bridges}. Of course, creating a central place that
  846. knows about all the bridges may not be smart, especially if every other
  847. piece of the system is decentralized. Further, if a user only knows
  848. about one bridge and he loses track of it, it may be quite a hassle to
  849. reach the bridge authority. We address these concerns next.
  850. \subsection{Families of bridges, no central discovery}
  851. Because the blocked users are running our software too, we have many
  852. opportunities to improve usability or robustness. Our second design builds
  853. on the first by encouraging volunteers to run several bridges at once
  854. (or coordinate with other bridge volunteers), such that some
  855. of the bridges are likely to be available at any given time.
  856. The blocked user's Tor client would periodically fetch an updated set of
  857. recommended bridges from any of the working bridges. Now the client can
  858. learn new additions to the bridge pool, and can expire abandoned bridges
  859. or bridges that the adversary has blocked, without the user ever needing
  860. to care. To simplify maintenance of the community's bridge pool, each
  861. community could run its own bridge directory authority---reachable via
  862. the available bridges, and also mirrored at each bridge.
  863. \subsection{Public bridges with central discovery}
  864. What about people who want to volunteer as bridges but don't know any
  865. suitable blocked users? What about people who are blocked but don't
  866. know anybody on the outside? Here we describe how to make use of these
  867. \emph{public bridges} in a way that still makes it hard for the attacker
  868. to learn all of them.
  869. The basic idea is to divide public bridges into a set of pools based on
  870. identity key. Each pool corresponds to a \emph{distribution strategy}:
  871. an approach to distributing its bridge addresses to users. Each strategy
  872. is designed to exercise a different scarce resource or property of
  873. the user.
  874. How do we divide bridges between these strategy pools such that they're
  875. evenly distributed and the allocation is hard to influence or predict,
  876. but also in a way that's amenable to creating more strategies later
  877. on without reshuffling all the pools? We assign a given bridge
  878. to a strategy pool by hashing the bridge's identity key along with a
  879. secret that only the bridge authority knows: the first $n$ bits of this
  880. hash dictate the strategy pool number, where $n$ is a parameter that
  881. describes how many strategy pools we want at this point. We choose $n=3$
  882. to start, so we divide bridges between 8 pools; but as we later invent
  883. new distribution strategies, we can increment $n$ to split the 8 into
  884. 16. Since a bridge can't predict the next bit in its hash, it can't
  885. anticipate which identity key will correspond to a certain new pool
  886. when the pools are split. Further, since the bridge authority doesn't
  887. provide any feedback to the bridge about which strategy pool it's in,
  888. an adversary who signs up bridges with the goal of filling a certain
  889. pool~\cite{casc-rep} will be hindered.
  890. % This algorithm is not ideal. When we split pools, each existing
  891. % pool is cut in half, where half the bridges remain with the
  892. % old distribution policy, and half will be under what the new one
  893. % is. So the new distribution policy inherits a bunch of blocked
  894. % bridges if the old policy was too loose, or a bunch of unblocked
  895. % bridges if its policy was still secure. -RD
  896. %
  897. % I think it should be more chordlike.
  898. % Bridges are allocated to wherever on the ring which is divided
  899. % into arcs (buckets).
  900. % If a bucket gets too full, you can just split it.
  901. % More on this below. -PFS
  902. The first distribution strategy (used for the first pool) publishes bridge
  903. addresses in a time-release fashion. The bridge authority divides the
  904. available bridges into partitions, and each partition is deterministically
  905. available only in certain time windows. That is, over the course of a
  906. given time slot (say, an hour), each requester is given a random bridge
  907. from within that partition. When the next time slot arrives, a new set
  908. of bridges from the pool are available for discovery. Thus some bridge
  909. address is always available when a new
  910. user arrives, but to learn about all bridges the attacker needs to fetch
  911. all new addresses at every new time slot. By varying the length of the
  912. time slots, we can make it harder for the attacker to guess when to check
  913. back. We expect these bridges will be the first to be blocked, but they'll
  914. help the system bootstrap until they \emph{do} get blocked. Further,
  915. remember that we're dealing with different blocking regimes around the
  916. world that will progress at different rates---so this pool will still
  917. be useful to some users even as the arms races progress.
  918. The second distribution strategy publishes bridge addresses based on the IP
  919. address of the requesting user. Specifically, the bridge authority will
  920. divide the available bridges in the pool into a bunch of partitions
  921. (as in the first distribution scheme), hash the requester's IP address
  922. with a secret of its own (as in the above allocation scheme for creating
  923. pools), and give the requester a random bridge from the appropriate
  924. partition. To raise the bar, we should discard the last octet of the
  925. IP address before inputting it to the hash function, so an attacker
  926. who only controls a single ``/24'' network only counts as one user. A
  927. large attacker like China will still be able to control many addresses,
  928. but the hassle of establishing connections from each network (or spoofing
  929. TCP connections) may still slow them down. Similarly, as a special case,
  930. we should treat IP addresses that are Tor exit nodes as all being on
  931. the same network.
  932. The third strategy combines the time-based and location-based
  933. strategies to further constrain and rate-limit the available bridge
  934. addresses. Specifically, the bridge address provided in a given time
  935. slot to a given network location is deterministic within the partition,
  936. rather than chosen randomly each time from the partition. Thus, repeated
  937. requests during that time slot from a given network are given the same
  938. bridge address as the first request.
  939. The fourth strategy is based on Circumventor's discovery strategy.
  940. The Circumventor project, realizing that its adoption will remain limited
  941. if it has no central coordination mechanism, has started a mailing list to
  942. distribute new proxy addresses every few days. From experimentation it
  943. seems they have concluded that sending updates every three or four days
  944. is sufficient to stay ahead of the current attackers.
  945. The fifth strategy provides an alternative approach to a mailing list:
  946. users provide an email address and receive an automated response
  947. listing an available bridge address. We could limit one response per
  948. email address. To further rate limit queries, we could require a CAPTCHA
  949. solution
  950. %~\cite{captcha}
  951. in each case too. In fact, we wouldn't need to
  952. implement the CAPTCHA on our side: if we only deliver bridge addresses
  953. to Yahoo or GMail addresses, we can leverage the rate-limiting schemes
  954. that other parties already impose for account creation.
  955. The sixth strategy ties in the social network design with public
  956. bridges and a reputation system. We pick some seeds---trusted people in
  957. blocked areas---and give them each a few dozen bridge addresses and a few
  958. \emph{delegation tokens}. We run a website next to the bridge authority,
  959. where users can log in (they connect via Tor, and they don't need to
  960. provide actual identities, just persistent pseudonyms). Users can delegate
  961. trust to other people they know by giving them a token, which can be
  962. exchanged for a new account on the website. Accounts in ``good standing''
  963. then accrue new bridge addresses and new tokens. As usual, reputation
  964. schemes bring in a host of new complexities~\cite{rep-anon}: how do we
  965. decide that an account is in good standing? We could tie reputation
  966. to whether the bridges they're told about have been blocked---see
  967. Section~\ref{subsec:geoip} below for initial thoughts on how to discover
  968. whether bridges have been blocked. We could track reputation between
  969. accounts (if you delegate to somebody who screws up, it impacts you too),
  970. or we could use blinded delegation tokens~\cite{chaum-blind} to prevent
  971. the website from mapping the seeds' social network. We put off deeper
  972. discussion of the social network reputation strategy for future work.
  973. Pools seven and eight are held in reserve, in case our currently deployed
  974. tricks all fail at once and the adversary blocks all those bridges---so
  975. we can adapt and move to new approaches quickly, and have some bridges
  976. immediately available for the new schemes. New strategies might be based
  977. on some other scarce resource, such as relaying traffic for others or
  978. other proof of energy spent. (We might also worry about the incentives
  979. for bridges that sign up and get allocated to the reserve pools: will they
  980. be unhappy that they're not being used? But this is a transient problem:
  981. if Tor users are bridges by default, nobody will mind not being used yet.
  982. See also Section~\ref{subsec:incentives}.)
  983. %Is it useful to load balance which bridges are handed out? The above
  984. %pool concept makes some bridges wildly popular and others less so.
  985. %But I guess that's the point.
  986. \subsection{Public bridges with coordinated discovery}
  987. We presented the above discovery strategies in the context of a single
  988. bridge directory authority, but in practice we will want to distribute the
  989. operations over several bridge authorities---a single point of failure
  990. or attack is a bad move. The first answer is to run several independent
  991. bridge directory authorities, and bridges gravitate to one based on
  992. their identity key. The better answer would be some federation of bridge
  993. authorities that work together to provide redundancy but don't introduce
  994. new security issues. We could even imagine designs where the bridge
  995. authorities have encrypted versions of the bridge's relay descriptors,
  996. and the users learn a decryption key that they keep private when they
  997. first hear about the bridge---this way the bridge authorities would not
  998. be able to learn the IP address of the bridges.
  999. We leave this design question for future work.
  1000. \subsection{Assessing whether bridges are useful}
  1001. Learning whether a bridge is useful is important in the bridge authority's
  1002. decision to include it in responses to blocked users. For example, if
  1003. we end up with a list of thousands of bridges and only a few dozen of
  1004. them are reachable right now, most blocked users will not end up knowing
  1005. about working bridges.
  1006. There are three components for assessing how useful a bridge is. First,
  1007. is it reachable from the public Internet? Second, what proportion of
  1008. the time is it available? Third, is it blocked in certain jurisdictions?
  1009. The first component can be tested just as we test reachability of
  1010. ordinary Tor relays. Specifically, the bridges do a self-test---connect
  1011. to themselves via the Tor network---before they are willing to
  1012. publish their descriptor, to make sure they're not obviously broken or
  1013. misconfigured. Once the bridges publish, the bridge authority also tests
  1014. reachability to make sure they're not confused or outright lying.
  1015. The second component can be measured and tracked by the bridge authority.
  1016. By doing periodic reachability tests, we can get a sense of how often the
  1017. bridge is available. More complex tests will involve bandwidth-intensive
  1018. checks to force the bridge to commit resources in order to be counted as
  1019. available. We need to evaluate how the relationship of uptime percentage
  1020. should weigh into our choice of which bridges to advertise. We leave
  1021. this to future work.
  1022. The third component is perhaps the trickiest: with many different
  1023. adversaries out there, how do we keep track of which adversaries have
  1024. blocked which bridges, and how do we learn about new blocks as they
  1025. occur? We examine this problem next.
  1026. \subsection{How do we know if a bridge relay has been blocked?}
  1027. \label{subsec:geoip}
  1028. There are two main mechanisms for testing whether bridges are reachable
  1029. from inside each blocked area: active testing via users, and passive
  1030. testing via bridges.
  1031. In the case of active testing, certain users inside each area
  1032. sign up as testing relays. The bridge authorities can then use a
  1033. Blossom-like~\cite{blossom-thesis} system to build circuits through them
  1034. to each bridge and see if it can establish the connection. But how do
  1035. we pick the users? If we ask random users to do the testing (or if we
  1036. solicit volunteers from the users), the adversary should sign up so he
  1037. can enumerate the bridges we test. Indeed, even if we hand-select our
  1038. testers, the adversary might still discover their location and monitor
  1039. their network activity to learn bridge addresses.
  1040. Another answer is not to measure directly, but rather let the bridges
  1041. report whether they're being used.
  1042. %If they periodically report to their
  1043. %bridge directory authority how much use they're seeing, perhaps the
  1044. %authority can make smart decisions from there.
  1045. Specifically, bridges should install a GeoIP database such as the public
  1046. IP-To-Country list~\cite{ip-to-country}, and then periodically report to the
  1047. bridge authorities which countries they're seeing use from. This data
  1048. would help us track which countries are making use of the bridge design,
  1049. and can also let us learn about new steps the adversary has taken in
  1050. the arms race. (The compressed GeoIP database is only several hundred
  1051. kilobytes, and we could even automate the update process by serving it
  1052. from the bridge authorities.)
  1053. More analysis of this passive reachability
  1054. testing design is needed to resolve its many edge cases: for example,
  1055. if a bridge stops seeing use from a certain area, does that mean the
  1056. bridge is blocked or does that mean those users are asleep?
  1057. There are many more problems with the general concept of detecting whether
  1058. bridges are blocked. First, different zones of the Internet are blocked
  1059. in different ways, and the actual firewall jurisdictions do not match
  1060. country borders. Our bridge scheme could help us map out the topology
  1061. of the censored Internet, but this is a huge task. More generally,
  1062. if a bridge relay isn't reachable, is that because of a network block
  1063. somewhere, because of a problem at the bridge relay, or just a temporary
  1064. outage somewhere in between? And last, an attacker could poison our
  1065. bridge database by signing up already-blocked bridges. In this case,
  1066. if we're stingy giving out bridge addresses, users in that country won't
  1067. learn working bridges.
  1068. All of these issues are made more complex when we try to integrate this
  1069. testing into our social network reputation system above.
  1070. Since in that case we punish or reward users based on whether bridges
  1071. get blocked, the adversary has new attacks to trick or bog down the
  1072. reputation tracking. Indeed, the bridge authority doesn't even know
  1073. what zone the blocked user is in, so do we blame him for any possible
  1074. censored zone, or what?
  1075. Clearly more analysis is required. The eventual solution will probably
  1076. involve a combination of passive measurement via GeoIP and active
  1077. measurement from trusted testers. More generally, we can use the passive
  1078. feedback mechanism to track usage of the bridge network as a whole---which
  1079. would let us respond to attacks and adapt the design, and it would also
  1080. let the general public track the progress of the project.
  1081. %Worry: the adversary could choose not to block bridges but just record
  1082. %connections to them. So be it, I guess.
  1083. \subsection{Advantages of deploying all solutions at once}
  1084. For once, we're not in the position of the defender: we don't have to
  1085. defend against every possible filtering scheme; we just have to defend
  1086. against at least one. On the flip side, the attacker is forced to guess
  1087. how to allocate his resources to defend against each of these discovery
  1088. strategies. So by deploying all of our strategies at once, we not only
  1089. increase our chances of finding one that the adversary has difficulty
  1090. blocking, but we actually make \emph{all} of the strategies more robust
  1091. in the face of an adversary with limited resources.
  1092. %\subsection{Remaining unsorted notes}
  1093. %In the first subsection we describe how to find a first bridge.
  1094. %Going to be an arms race. Need a bag of tricks. Hard to say
  1095. %which ones will work. Don't spend them all at once.
  1096. %Some techniques are sufficient to get us an IP address and a port,
  1097. %and others can get us IP:port:key. Lay out some plausible options
  1098. %for how users can bootstrap into learning their first bridge.
  1099. %\section{The account / reputation system}
  1100. %\section{Social networks with directory-side support}
  1101. %\label{sec:accounts}
  1102. %One answer is to measure based on whether the bridge addresses
  1103. %we give it end up blocked. But how do we decide if they get blocked?
  1104. %Perhaps each bridge should be known by a single bridge directory
  1105. %authority. This makes it easier to trace which users have learned about
  1106. %it, so easier to blame or reward. It also makes things more brittle,
  1107. %since loss of that authority means its bridges aren't advertised until
  1108. %they switch, and means its bridge users are sad too.
  1109. %(Need a slick hash algorithm that will map our identity key to a
  1110. %bridge authority, in a way that's sticky even when we add bridge
  1111. %directory authorities, but isn't sticky when our authority goes
  1112. %away. Does this exist?)
  1113. % [[Ian says: What about just using something like hash table chaining?
  1114. % This should work, so long as the client knows which authorities currently
  1115. % exist.]]
  1116. %\subsection{Discovery based on social networks}
  1117. %A token that can be exchanged at the bridge authority (assuming you
  1118. %can reach it) for a new bridge address.
  1119. %The account server runs as a Tor controller for the bridge authority.
  1120. %Users can establish reputations, perhaps based on social network
  1121. %connectivity, perhaps based on not getting their bridge relays blocked,
  1122. %Probably the most critical lesson learned in past work on reputation
  1123. %systems in privacy-oriented environments~\cite{rep-anon} is the need for
  1124. %verifiable transactions. That is, the entity computing and advertising
  1125. %reputations for participants needs to actually learn in a convincing
  1126. %way that a given transaction was successful or unsuccessful.
  1127. %(Lesson from designing reputation systems~\cite{rep-anon}: easy to
  1128. %reward good behavior, hard to punish bad behavior.
  1129. \section{Security considerations}
  1130. \label{sec:security}
  1131. \subsection{Possession of Tor in oppressed areas}
  1132. Many people speculate that installing and using a Tor client in areas with
  1133. particularly extreme firewalls is a high risk---and the risk increases
  1134. as the firewall gets more restrictive. This notion certain has merit, but
  1135. there's
  1136. a counter pressure as well: as the firewall gets more restrictive, more
  1137. ordinary people behind it end up using Tor for more mainstream activities,
  1138. such as learning
  1139. about Wall Street prices or looking at pictures of women's ankles. So
  1140. as the restrictive firewall pushes up the number of Tor users, the
  1141. ``typical'' Tor user becomes more mainstream, and therefore mere
  1142. use or possession of the Tor software is not so surprising.
  1143. It's hard to say which of these pressures will ultimately win out,
  1144. but we should keep both sides of the issue in mind.
  1145. %Nick, want to rewrite/elaborate on this section?
  1146. %Ian suggests:
  1147. % Possession of Tor: this is totally of-the-cuff, and there are lots of
  1148. % security issues to think about, but what about an ActiveX version of
  1149. % Tor? The magic you learn (as opposed to a bridge address) is a plain
  1150. % old HTTPS server, which feeds you an ActiveX applet pre-configured with
  1151. % some bridge address (possibly on the same machine). For bonus points,
  1152. % somehow arrange that (a) the applet is signed in some way the user can
  1153. % reliably check, but (b) don't end up with anything like an incriminating
  1154. % long-term cert stored on the user's computer. This may be marginally
  1155. % useful in some Internet-cafe situations as well, though (a) is even
  1156. % harder to get right there.
  1157. \subsection{Observers can tell who is publishing and who is reading}
  1158. \label{subsec:upload-padding}
  1159. Tor encrypts traffic on the local network, and it obscures the eventual
  1160. destination of the communication, but it doesn't do much to obscure the
  1161. traffic volume. In particular, a user publishing a home video will have a
  1162. different network fingerprint than a user reading an online news article.
  1163. Based on our assumption in Section~\ref{sec:adversary} that users who
  1164. publish material are in more danger, should we work to improve Tor's
  1165. security in this situation?
  1166. In the general case this is an extremely challenging task:
  1167. effective \emph{end-to-end traffic confirmation attacks}
  1168. are known where the adversary observes the origin and the
  1169. destination of traffic and confirms that they are part of the
  1170. same communication~\cite{danezis:pet2004,e2e-traffic}. Related are
  1171. \emph{website fingerprinting attacks}, where the adversary downloads
  1172. a few hundred popular websites, makes a set of "fingerprints" for each
  1173. site, and then observes the target Tor client's traffic to look for
  1174. a match~\cite{pet05-bissias,defensive-dropping}. But can we do better
  1175. against a limited adversary who just does coarse-grained sweeps looking
  1176. for unusually prolific publishers?
  1177. One answer is for bridge users to automatically send bursts of padding
  1178. traffic periodically. (This traffic can be implemented in terms of
  1179. long-range drop cells, which are already part of the Tor specification.)
  1180. Of course, convincingly simulating an actual human publishing interesting
  1181. content is a difficult arms race, but it may be worthwhile to at least
  1182. start the race. More research remains.
  1183. \subsection{Anonymity effects from acting as a bridge relay}
  1184. Against some attacks, relaying traffic for others can improve
  1185. anonymity. The simplest example is an attacker who owns a small number
  1186. of Tor relays. He will see a connection from the bridge, but he won't
  1187. be able to know whether the connection originated there or was relayed
  1188. from somebody else. More generally, the mere uncertainty of whether the
  1189. traffic originated from that user may be helpful.
  1190. There are some cases where it doesn't seem to help: if an attacker can
  1191. watch all of the bridge's incoming and outgoing traffic, then it's easy
  1192. to learn which connections were relayed and which started there. (In this
  1193. case he still doesn't know the final destinations unless he is watching
  1194. them too, but in this case bridges are no better off than if they were
  1195. an ordinary client.)
  1196. There are also some potential downsides to running a bridge. First, while
  1197. we try to make it hard to enumerate all bridges, it's still possible to
  1198. learn about some of them, and for some people just the fact that they're
  1199. running one might signal to an attacker that they place a higher value
  1200. on their anonymity. Second, there are some more esoteric attacks on Tor
  1201. relays that are not as well-understood or well-tested---for example, an
  1202. attacker may be able to ``observe'' whether the bridge is sending traffic
  1203. even if he can't actually watch its network, by relaying traffic through
  1204. it and noticing changes in traffic timing~\cite{attack-tor-oak05}. On
  1205. the other hand, it may be that limiting the bandwidth the bridge is
  1206. willing to relay will allow this sort of attacker to determine if it's
  1207. being used as a bridge but not easily learn whether it is adding traffic
  1208. of its own.
  1209. We also need to examine how entry guards fit in. Entry guards
  1210. (a small set of nodes that are always used for the first
  1211. step in a circuit) help protect against certain attacks
  1212. where the attacker runs a few Tor relays and waits for
  1213. the user to choose these relays as the beginning and end of her
  1214. circuit\footnote{\url{http://wiki.noreply.org/noreply/TheOnionRouter/TorFAQ#EntryGuards}}.
  1215. If the blocked user doesn't use the bridge's entry guards, then the bridge
  1216. doesn't gain as much cover benefit. On the other hand, what design changes
  1217. are needed for the blocked user to use the bridge's entry guards without
  1218. learning what they are (this seems hard), and even if we solve that,
  1219. do they then need to use the guards' guards and so on down the line?
  1220. It is an open research question whether the benefits of running a bridge
  1221. outweigh the risks. A lot of the decision rests on which attacks the
  1222. users are most worried about. For most users, we don't think running a
  1223. bridge relay will be that damaging, and it could help quite a bit.
  1224. \subsection{Trusting local hardware: Internet cafes and LiveCDs}
  1225. \label{subsec:cafes-and-livecds}
  1226. Assuming that users have their own trusted hardware is not
  1227. always reasonable.
  1228. For Internet cafe Windows computers that let you attach your own USB key,
  1229. a USB-based Tor image would be smart. There's Torpark, and hopefully
  1230. there will be more thoroughly analyzed and trustworthy options down the
  1231. road. Worries remain about hardware or software keyloggers and other
  1232. spyware, as well as physical surveillance.
  1233. If the system lets you boot from a CD or from a USB key, you can gain
  1234. a bit more security by bringing a privacy LiveCD with you. (This
  1235. approach isn't foolproof either of course, since hardware
  1236. keyloggers and physical surveillance are still a worry).
  1237. In fact, LiveCDs are also useful if it's your own hardware, since it's
  1238. easier to avoid leaving private data and logs scattered around the
  1239. system.
  1240. %\subsection{Forward compatibility and retiring bridge authorities}
  1241. %
  1242. %Eventually we'll want to change the identity key and/or location
  1243. %of a bridge authority. How do we do this mostly cleanly?
  1244. \subsection{The trust chain}
  1245. \label{subsec:trust-chain}
  1246. Tor's ``public key infrastructure'' provides a chain of trust to
  1247. let users verify that they're actually talking to the right relays.
  1248. There are four pieces to this trust chain.
  1249. First, when Tor clients are establishing circuits, at each step
  1250. they demand that the next Tor relay in the path prove knowledge of
  1251. its private key~\cite{tor-design}. This step prevents the first node
  1252. in the path from just spoofing the rest of the path. Second, the
  1253. Tor directory authorities provide a signed list of relays along with
  1254. their public keys---so unless the adversary can control a threshold
  1255. of directory authorities, he can't trick the Tor client into using other
  1256. Tor relays. Third, the location and keys of the directory authorities,
  1257. in turn, is hard-coded in the Tor source code---so as long as the user
  1258. got a genuine version of Tor, he can know that he is using the genuine
  1259. Tor network. And last, the source code and other packages are signed
  1260. with the GPG keys of the Tor developers, so users can confirm that they
  1261. did in fact download a genuine version of Tor.
  1262. In the case of blocked users contacting bridges and bridge directory
  1263. authorities, the same logic applies in parallel: the blocked users fetch
  1264. information from both the bridge authorities and the directory authorities
  1265. for the `main' Tor network, and they combine this information locally.
  1266. How can a user in an oppressed country know that he has the correct
  1267. key fingerprints for the developers? As with other security systems, it
  1268. ultimately comes down to human interaction. The keys are signed by dozens
  1269. of people around the world, and we have to hope that our users have met
  1270. enough people in the PGP web of trust
  1271. %~\cite{pgp-wot}
  1272. that they can learn
  1273. the correct keys. For users that aren't connected to the global security
  1274. community, though, this question remains a critical weakness.
  1275. %\subsection{Security through obscurity: publishing our design}
  1276. %Many other schemes like dynaweb use the typical arms race strategy of
  1277. %not publishing their plans. Our goal here is to produce a design---a
  1278. %framework---that can be public and still secure. Where's the tradeoff?
  1279. %\section{Performance improvements}
  1280. %\label{sec:performance}
  1281. %
  1282. %\subsection{Fetch relay descriptors just-in-time}
  1283. %
  1284. %I guess we should encourage most places to do this, so blocked
  1285. %users don't stand out.
  1286. %
  1287. %
  1288. %network-status and directory optimizations. caching better. partitioning
  1289. %issues?
  1290. \section{Maintaining reachability}
  1291. \label{sec:reachability}
  1292. \subsection{How many bridge relays should you know about?}
  1293. The strategies described in Section~\ref{sec:discovery} talked about
  1294. learning one bridge address at a time. But if most bridges are ordinary
  1295. Tor users on cable modem or DSL connection, many of them will disappear
  1296. and/or move periodically. How many bridge relays should a blocked user
  1297. know about so that she is likely to have at least one reachable at any
  1298. given point? This is already a challenging problem if we only consider
  1299. natural churn: the best approach is to see what bridges we attract in
  1300. reality and measure their churn. We may also need to factor in a parameter
  1301. for how quickly bridges get discovered and blocked by the attacker;
  1302. we leave this for future work after we have more deployment experience.
  1303. A related question is: if the bridge relays change IP addresses
  1304. periodically, how often does the blocked user need to fetch updates in
  1305. order to keep from being cut out of the loop?
  1306. Once we have more experience and intuition, we should explore technical
  1307. solutions to this problem too. For example, if the discovery strategies
  1308. give out $k$ bridge addresses rather than a single bridge address, perhaps
  1309. we can improve robustness from the user perspective without significantly
  1310. aiding the adversary. Rather than giving out a new random subset of $k$
  1311. addresses at each point, we could bind them together into \emph{bridge
  1312. families}, so all users that learn about one member of the bridge family
  1313. are told about the rest as well.
  1314. This scheme may also help defend against attacks to map the set of
  1315. bridges. That is, if all blocked users learn a random subset of bridges,
  1316. the attacker should learn about a few bridges, monitor the country-level
  1317. firewall for connections to them, then watch those users to see what
  1318. other bridges they use, and repeat. By segmenting the bridge address
  1319. space, we can limit the exposure of other users.
  1320. \subsection{Cablemodem users don't usually provide important websites}
  1321. \label{subsec:block-cable}
  1322. Another attacker we might be concerned about is that the attacker could
  1323. just block all DSL and cablemodem network addresses, on the theory that
  1324. they don't run any important services anyway. If most of our bridges
  1325. are on these networks, this attack could really hurt.
  1326. The first answer is to aim to get volunteers both from traditionally
  1327. ``consumer'' networks and also from traditionally ``producer'' networks.
  1328. Since bridges don't need to be Tor exit nodes, as we improve our usability
  1329. it seems quite feasible to get a lot of websites helping out.
  1330. The second answer (not as practical) would be to encourage more use of
  1331. consumer networks for popular and useful Internet services.
  1332. %(But P2P exists;
  1333. %minor websites exist; gaming exists; IM exists; ...)
  1334. A related attack we might worry about is based on large countries putting
  1335. economic pressure on companies that want to expand their business. For
  1336. example, what happens if Verizon wants to sell services in China, and
  1337. China pressures Verizon to discourage its users in the free world from
  1338. running bridges?
  1339. \subsection{Scanning resistance: making bridges more subtle}
  1340. If it's trivial to verify that a given address is operating as a bridge,
  1341. and most bridges run on a predictable port, then it's conceivable our
  1342. attacker could scan the whole Internet looking for bridges. (In fact,
  1343. he can just concentrate on scanning likely networks like cablemodem
  1344. and DSL services---see Section~\ref{subsec:block-cable} above for
  1345. related attacks.) It would be nice to slow down this attack. It would
  1346. be even nicer to make it hard to learn whether we're a bridge without
  1347. first knowing some secret. We call this general property \emph{scanning
  1348. resistance}, and it goes along with normalizing Tor's TLS handshake and
  1349. network fingerprint.
  1350. We could provide a password to the blocked user, and she (or her Tor
  1351. client) provides a nonced hash of this password when she connects. We'd
  1352. need to give her an ID key for the bridge too (in addition to the IP
  1353. address and port---see Section~\ref{subsec:id-address}), and wait to
  1354. present the password until we've finished the TLS handshake, else it
  1355. would look unusual. If Alice can authenticate the bridge before she
  1356. tries to send her password, we can resist an adversary who pretends
  1357. to be the bridge and launches a man-in-the-middle attack to learn the
  1358. password. But even if she can't, we still resist against widespread
  1359. scanning.
  1360. How should the bridge behave if accessed without the correct
  1361. authorization? Perhaps it should act like an unconfigured HTTPS server
  1362. (``welcome to the default Apache page''), or maybe it should mirror
  1363. and act like common websites, or websites randomly chosen from Google.
  1364. We might assume that the attacker can recognize HTTPS connections that
  1365. use self-signed certificates. (This process would be resource-intensive
  1366. but not out of the realm of possibility.) But even in this case, many
  1367. popular websites around the Internet use self-signed or just plain broken
  1368. SSL certificates.
  1369. %to unknown servers. It can then attempt to connect to them and block
  1370. %connections to servers that seem suspicious. It may be that password
  1371. %protected web sites will not be suspicious in general, in which case
  1372. %that may be the easiest way to give controlled access to the bridge.
  1373. %If such sites that have no other overt features are automatically
  1374. %blocked when detected, then we may need to be more subtle.
  1375. %Possibilities include serving an innocuous web page if a TLS encrypted
  1376. %request is received without the authorization needed to access the Tor
  1377. %network and only responding to a requested access to the Tor network
  1378. %of proper authentication is given. If an unauthenticated request to
  1379. %access the Tor network is sent, the bridge should respond as if
  1380. %it has received a message it does not understand (as would be the
  1381. %case were it not a bridge).
  1382. % Ian suggests a ``socialist millionaires'' protocol here, for something.
  1383. % Did we once mention knocking here? it's a good idea, but we should clarify
  1384. % what we mean. Ian also notes that knocking itself is very fingerprintable,
  1385. % and we should beware.
  1386. \subsection{How to motivate people to run bridge relays}
  1387. \label{subsec:incentives}
  1388. One of the traditional ways to get people to run software that benefits
  1389. others is to give them motivation to install it themselves. An often
  1390. suggested approach is to install it as a stunning screensaver so everybody
  1391. will be pleased to run it. We take a similar approach here, by leveraging
  1392. the fact that these users are already interested in protecting their
  1393. own Internet traffic, so they will install and run the software.
  1394. Eventually, we may be able to make all Tor users become bridges if they
  1395. pass their self-reachability tests---the software and installers need
  1396. more work on usability first, but we're making progress.
  1397. In the mean time, we can make a snazzy network graph with
  1398. Vidalia\footnote{\url{http://vidalia-project.net/}} that
  1399. emphasizes the connections the bridge user is currently relaying.
  1400. %(Minor
  1401. %anonymity implications, but hey.) (In many cases there won't be much
  1402. %activity, so this may backfire. Or it may be better suited to full-fledged
  1403. %Tor relay.)
  1404. % Also consider everybody-a-relay. Many of the scalability questions
  1405. % are easier when you're talking about making everybody a bridge.
  1406. %\subsection{What if the clients can't install software?}
  1407. %[this section should probably move to the related work section,
  1408. %or just disappear entirely.]
  1409. %Bridge users without Tor software
  1410. %Bridge relays could always open their socks proxy. This is bad though,
  1411. %first
  1412. %because bridges learn the bridge users' destinations, and second because
  1413. %we've learned that open socks proxies tend to attract abusive users who
  1414. %have no idea they're using Tor.
  1415. %Bridges could require passwords in the socks handshake (not supported
  1416. %by most software including Firefox). Or they could run web proxies
  1417. %that require authentication and then pass the requests into Tor. This
  1418. %approach is probably a good way to help bootstrap the Psiphon network,
  1419. %if one of its barriers to deployment is a lack of volunteers willing
  1420. %to exit directly to websites. But it clearly drops some of the nice
  1421. %anonymity and security features Tor provides.
  1422. %A hybrid approach where the user gets his anonymity from Tor but his
  1423. %software-less use from a web proxy running on a trusted machine on the
  1424. %free side.
  1425. \subsection{Publicity attracts attention}
  1426. \label{subsec:publicity}
  1427. Many people working on this field want to publicize the existence
  1428. and extent of censorship concurrently with the deployment of their
  1429. circumvention software. The easy reason for this two-pronged push is
  1430. to attract volunteers for running proxies in their systems; but in many
  1431. cases their main goal is not to focus on getting more users signed up,
  1432. but rather to educate the rest of the world about the
  1433. censorship. The media also tries to do its part by broadcasting the
  1434. existence of each new circumvention system.
  1435. But at the same time, this publicity attracts the attention of the
  1436. censors. We can slow down the arms race by not attracting as much
  1437. attention, and just spreading by word of mouth. If our goal is to
  1438. establish a solid social network of bridges and bridge users before
  1439. the adversary gets involved, does this extra attention work to our
  1440. disadvantage?
  1441. \subsection{The Tor website: how to get the software}
  1442. One of the first censoring attacks against a system like ours is to
  1443. block the website and make the software itself hard to find. Our system
  1444. should work well once the user is running an authentic
  1445. copy of Tor and has found a working bridge, but to get to that point
  1446. we rely on their individual skills and ingenuity.
  1447. Right now, most countries that block access to Tor block only the main
  1448. website and leave mirrors and the network itself untouched.
  1449. Falling back on word-of-mouth is always a good last resort, but we should
  1450. also take steps to make sure it's relatively easy for users to get a copy,
  1451. such as publicizing the mirrors more and making copies available through
  1452. other media. We might also mirror the latest version of the software on
  1453. each bridge, so users who hear about an honest bridge can get a good
  1454. copy.
  1455. See Section~\ref{subsec:first-bridge} for more discussion.
  1456. % Ian suggests that we have every tor relay distribute a signed copy of the
  1457. % software.
  1458. \section{Next Steps}
  1459. \label{sec:conclusion}
  1460. Technical solutions won't solve the whole censorship problem. After all,
  1461. the firewalls in places like China are \emph{socially} very
  1462. successful, even if technologies and tricks exist to get around them.
  1463. However, having a strong technical solution is still necessary as one
  1464. important piece of the puzzle.
  1465. In this paper, we have shown that Tor provides a great set of building
  1466. blocks to start from. The next steps are to deploy prototype bridges and
  1467. bridge authorities, implement some of the proposed discovery strategies,
  1468. and then observe the system in operation and get more intuition about
  1469. the actual requirements and adversaries we're up against.
  1470. \bibliographystyle{plain} \bibliography{tor-design}
  1471. %\appendix
  1472. %\section{Counting Tor users by country}
  1473. %\label{app:geoip}
  1474. \end{document}
  1475. \section{Future designs}
  1476. \label{sec:future}
  1477. \subsection{Bridges inside the blocked network too}
  1478. Assuming actually crossing the firewall is the risky part of the
  1479. operation, can we have some bridge relays inside the blocked area too,
  1480. and more established users can use them as relays so they don't need to
  1481. communicate over the firewall directly at all? A simple example here is
  1482. to make new blocked users into internal bridges also---so they sign up
  1483. on the bridge authority as part of doing their query, and we give out
  1484. their addresses
  1485. rather than (or along with) the external bridge addresses. This design
  1486. is a lot trickier because it brings in the complexity of whether the
  1487. internal bridges will remain available, can maintain reachability with
  1488. the outside world, etc.
  1489. More complex future designs involve operating a separate Tor network
  1490. inside the blocked area, and using \emph{hidden service bridges}---bridges
  1491. that can be accessed by users of the internal Tor network but whose
  1492. addresses are not published or findable, even by these users---to get
  1493. from inside the firewall to the rest of the Internet. But this design
  1494. requires directory authorities to run inside the blocked area too,
  1495. and they would be a fine target to take down the network.
  1496. % Hidden services as bridge directory authorities.
  1497. ------------------------------------------
  1498. ship geoip db to bridges. they look up users who tls to them in the db,
  1499. and upload a signed list of countries and number-of-users each day. the
  1500. bridge authority aggregates them and publishes stats.
  1501. bridge relays have buddies
  1502. they ask a user to test the reachability of their buddy.
  1503. leaks O(1) bridges, but not O(n).
  1504. we should not be blockable by ordinary cisco censorship features.
  1505. that is, if they want to block our new design, they will need to
  1506. add a feature to block exactly this.
  1507. strategically speaking, this may come in handy.
  1508. Bridges come in clumps of 4 or 8 or whatever. If you know one bridge
  1509. in a clump, the authority will tell you the rest. Now bridges can
  1510. ask users to test reachability of their buddies.
  1511. Giving out clumps helps with dynamic IP addresses too. Whether it
  1512. should be 4 or 8 depends on our churn.
  1513. the account server. let's call it a database, it doesn't have to
  1514. be a thing that human interacts with.
  1515. so how do we reward people for being good?
  1516. \subsubsection{Public Bridges with Coordinated Discovery}
  1517. ****Pretty much this whole subsubsection will probably need to be
  1518. deferred until ``later'' and moved to after end document, but I'm leaving
  1519. it here for now in case useful.******
  1520. Rather than be entirely centralized, we can have a coordinated
  1521. collection of bridge authorities, analogous to how Tor network
  1522. directory authorities now work.
  1523. Key components
  1524. ``Authorities'' will distribute caches of what they know to overlapping
  1525. collections of nodes so that no one node is owned by one authority.
  1526. Also so that it is impossible to DoS info maintained by one authority
  1527. simply by making requests to it.
  1528. Where a bridge gets assigned is not predictable by the bridge?
  1529. If authorities don't know the IP addresses of the bridges they
  1530. are responsible for, they can't abuse that info (or be attacked for
  1531. having it). But, they also can't, e.g., control being sent massive
  1532. lists of nodes that were never good. This raises another question.
  1533. We generally decry use of IP address for location, etc. but we
  1534. need to do that to limit the introduction of functional but useless
  1535. IP addresses because, e.g., they are in China and the adversary
  1536. owns massive chunks of the IP space there.
  1537. We don't want an arbitrary someone to be able to contact the
  1538. authorities and say an IP address is bad because it would be easy
  1539. for an adversary to take down all the suspicious bridges
  1540. even if they provide good cover websites, etc. Only the bridge
  1541. itself and/or the directory authority can declare a bridge blocked
  1542. from somewhere.
  1543. 9. Bridge directories must not simply be a handful of nodes that
  1544. provide the list of bridges. They must flood or otherwise distribute
  1545. information out to other Tor nodes as mirrors. That way it becomes
  1546. difficult for censors to flood the bridge directory authorities with
  1547. requests, effectively denying access for others. But, there's lots of
  1548. churn and a much larger size than Tor directories. We are forced to
  1549. handle the directory scaling problem here much sooner than for the
  1550. network in general. Authorities can pass their bridge directories
  1551. (and policy info) to some moderate number of unidentified Tor nodes.
  1552. Anyone contacting one of those nodes can get bridge info. the nodes
  1553. must remain somewhat synched to prevent the adversary from abusing,
  1554. e.g., a timed release policy or the distribution to those nodes must
  1555. be resilient even if they are not coordinating.
  1556. I think some kind of DHT like scheme would work here. A Tor node is
  1557. assigned a chunk of the directory. Lookups in the directory should be
  1558. via hashes of keys (fingerprints) and that should determine the Tor
  1559. nodes responsible. Ordinary directories can publish lists of Tor nodes
  1560. responsible for fingerprint ranges. Clients looking to update info on
  1561. some bridge will make a Tor connection to one of the nodes responsible
  1562. for that address. Instead of shutting down a circuit after getting
  1563. info on one address, extend it to another that is responsible for that
  1564. address (the node from which you are extending knows you are doing so
  1565. anyway). Keep going. This way you can amortize the Tor connection.
  1566. 10. We need some way to give new identity keys out to those who need
  1567. them without letting those get immediately blocked by authorities. One
  1568. way is to give a fingerprint that gets you more fingerprints, as
  1569. already described. These are meted out/updated periodically but allow
  1570. us to keep track of which sources are compromised: if a distribution
  1571. fingerprint repeatedly leads to quickly blocked bridges, it should be
  1572. suspect, dropped, etc. Since we're using hashes, there shouldn't be a
  1573. correlation with bridge directory mirrors, bridges, portions of the
  1574. network observed, etc. It should just be that the authorities know
  1575. about that key that leads to new addresses.
  1576. This last point is very much like the issues in the valet nodes paper,
  1577. which is essentially about blocking resistance wrt exiting the Tor network,
  1578. while this paper is concerned with blocking the entering to the Tor network.
  1579. In fact the tickets used to connect to the IPo (Introduction Point),
  1580. could serve as an example, except that instead of authorizing
  1581. a connection to the Hidden Service, it's authorizing the downloading
  1582. of more fingerprints.
  1583. Also, the fingerprints can follow the hash(q + '1' + cookie) scheme of
  1584. that paper (where q = hash(PK + salt) gave the q.onion address). This
  1585. allows us to control and track which fingerprint was causing problems.
  1586. Note that, unlike many settings, the reputation problem should not be
  1587. hard here. If a bridge says it is blocked, then it might as well be.
  1588. If an adversary can say that the bridge is blocked wrt
  1589. $\mathit{censor}_i$, then it might as well be, since
  1590. $\mathit{censor}_i$ can presumably then block that bridge if it so
  1591. chooses.
  1592. 11. How much damage can the adversary do by running nodes in the Tor
  1593. network and watching for bridge nodes connecting to it? (This is
  1594. analogous to an Introduction Point watching for Valet Nodes connecting
  1595. to it.) What percentage of the network do you need to own to do how
  1596. much damage. Here the entry-guard design comes in helpfully. So we
  1597. need to have bridges use entry-guards, but (cf. 3 above) not use
  1598. bridges as entry-guards. Here's a serious tradeoff (again akin to the
  1599. ratio of valets to IPos) the more bridges/client the worse the
  1600. anonymity of that client. The fewer bridges/client the worse the
  1601. blocking resistance of that client.