2 fix mistaken use of high vs low
source | link

What you're talking about is a "Global Passive Adversary" (GPA): An adversary who can see everything all of the time (in your case, read all of the logs).

Tor cannot protect against a GPA, there aren't many (if any?) low-latency anonymity networks that could defeat a GPA. Although there are high latency anonymity networks that absolutely can.

First, you have to cosnider what information the logs contain, second where they are being logged and third who has access to the logs.

Onion routing derives from a form of high latency network called a Mix Network (for a well presented rundown of the history and evolution of mix networks, see this lecture by Tor developer Isis Lovecruft on anonymity networks). The idea is based on indistinguishability, each node has many messages coming in. It mixes them, and sends them off to other relays. An outside observer cannot determine how the mixing went, and thus which input message corresponds to which output message. Infact, in the case of high latency mix networks if only one relay in the chain isn't malicious then it will still be impossible to link sender to destination.

Tor is different, because it is a highlow latency network which means it's vulnerable to traffic analysis in ways that high latency networks aren't. If an adversary has sufficiently complete traffic logs for both your entry and exit from the network then they could determine who is talking to who.

However, if the adversary doesn't have access to sufficiently detailed logs or network traffic from both entry and exit, they will not be able to connect the input to output.

So, under many circumstances and many adversary models Tor can indeed provide anonymity as an application layer protocol.

Note also that while the Tor network is formed as an overlay network in the application layer, what it carries is transport layer traffic.

What you're talking about is a "Global Passive Adversary" (GPA): An adversary who can see everything all of the time (in your case, read all of the logs).

Tor cannot protect against a GPA, there aren't many (if any?) low-latency anonymity networks that could defeat a GPA. Although there are high latency anonymity networks that absolutely can.

First, you have to cosnider what information the logs contain, second where they are being logged and third who has access to the logs.

Onion routing derives from a form of high latency network called a Mix Network (for a well presented rundown of the history and evolution of mix networks, see this lecture by Tor developer Isis Lovecruft on anonymity networks). The idea is based on indistinguishability, each node has many messages coming in. It mixes them, and sends them off to other relays. An outside observer cannot determine how the mixing went, and thus which input message corresponds to which output message. Infact, in the case of high latency mix networks if only one relay in the chain isn't malicious then it will still be impossible to link sender to destination.

Tor is different, because it is a high latency network which means it's vulnerable to traffic analysis in ways that high latency networks aren't. If an adversary has sufficiently complete traffic logs for both your entry and exit from the network then they could determine who is talking to who.

However, if the adversary doesn't have access to sufficiently detailed logs or network traffic from both entry and exit, they will not be able to connect the input to output.

So, under many circumstances and many adversary models Tor can indeed provide anonymity as an application layer protocol.

Note also that while the Tor network is formed as an overlay network in the application layer, what it carries is transport layer traffic.

What you're talking about is a "Global Passive Adversary" (GPA): An adversary who can see everything all of the time (in your case, read all of the logs).

Tor cannot protect against a GPA, there aren't many (if any?) low-latency anonymity networks that could defeat a GPA. Although there are high latency anonymity networks that absolutely can.

First, you have to cosnider what information the logs contain, second where they are being logged and third who has access to the logs.

Onion routing derives from a form of high latency network called a Mix Network (for a well presented rundown of the history and evolution of mix networks, see this lecture by Tor developer Isis Lovecruft on anonymity networks). The idea is based on indistinguishability, each node has many messages coming in. It mixes them, and sends them off to other relays. An outside observer cannot determine how the mixing went, and thus which input message corresponds to which output message. Infact, in the case of high latency mix networks if only one relay in the chain isn't malicious then it will still be impossible to link sender to destination.

Tor is different, because it is a low latency network which means it's vulnerable to traffic analysis in ways that high latency networks aren't. If an adversary has sufficiently complete traffic logs for both your entry and exit from the network then they could determine who is talking to who.

However, if the adversary doesn't have access to sufficiently detailed logs or network traffic from both entry and exit, they will not be able to connect the input to output.

So, under many circumstances and many adversary models Tor can indeed provide anonymity as an application layer protocol.

Note also that while the Tor network is formed as an overlay network in the application layer, what it carries is transport layer traffic.

1
source | link

What you're talking about is a "Global Passive Adversary" (GPA): An adversary who can see everything all of the time (in your case, read all of the logs).

Tor cannot protect against a GPA, there aren't many (if any?) low-latency anonymity networks that could defeat a GPA. Although there are high latency anonymity networks that absolutely can.

First, you have to cosnider what information the logs contain, second where they are being logged and third who has access to the logs.

Onion routing derives from a form of high latency network called a Mix Network (for a well presented rundown of the history and evolution of mix networks, see this lecture by Tor developer Isis Lovecruft on anonymity networks). The idea is based on indistinguishability, each node has many messages coming in. It mixes them, and sends them off to other relays. An outside observer cannot determine how the mixing went, and thus which input message corresponds to which output message. Infact, in the case of high latency mix networks if only one relay in the chain isn't malicious then it will still be impossible to link sender to destination.

Tor is different, because it is a high latency network which means it's vulnerable to traffic analysis in ways that high latency networks aren't. If an adversary has sufficiently complete traffic logs for both your entry and exit from the network then they could determine who is talking to who.

However, if the adversary doesn't have access to sufficiently detailed logs or network traffic from both entry and exit, they will not be able to connect the input to output.

So, under many circumstances and many adversary models Tor can indeed provide anonymity as an application layer protocol.

Note also that while the Tor network is formed as an overlay network in the application layer, what it carries is transport layer traffic.