If someone hosts a hidden-service, then the hidden-service obviously knows its guard-node. I would guess the guard-node knows that it is the guard-node of the tor-application which is used by the hidden-service. (Even if the guard-node may probably not definitely know that there is a hidden service running on, correct?)
Now my basic question is: Can anyone else determine which guard-node the hidden-service (currently) uses or not?
No one else should be able to know the guard node of an onion service, but in practice this is not always the case. This is known as a guard discovery attack, and a few of these are described in academic literature. One good example is "Dropping on the Edge: Flexibility and Traffic Confirmation in Onion Routing Protocols".
An answer made short: it depends! A long version here ;) Basically Tor is protecting from such kind of surveillance by it's multi-layer encryption and directory services, but - there can be a mitigation to this defense. The attacker tactics will be to obtain three vital steps to be done:
Well, a Great FireWall of China, Russian SORM and EU's traffic inspection hardware is actually doing/trying-to-do it. If the delays can be added - they will be re-propagated in the multi-layer encryption, so you will see it statistically correlating netflow-like logs. Then you can unwind the chain but not the data that are actually encrypted
There is a way to determine Guard Node of Hidden Services. It requires few controlled guard nodes (considerable number) and the list of Hidden services which you would like to test.
We can extract titles,favicons and compare at both ends!
Experiments resulted well in finding Guard IPs of those services!
