Does Tor insert random delays or perform packet re-ordering to make the discovery of the communication path harder?

Question

If an attacker can observe the Tor user, and the website being visited, it is possible to correlate the traffic by looking at time and size distributions of the communication.

Techniques such as random time delays, padding, fake cover traffic, and changing packet ordering may make this correlation harder.

Does Tor perform any of these techniques? Are there analyses if such techniques would considerably help in maintaining anonymity?

Answer 1

Tor uses fixed cell sizes. The design document states:

Traffic passes along these connections in fixed-size cells. Each cell is 512 bytes, and consists of a header and a payload.

Apart from that no further mixing or randomisation is used:

No mixing, padding, or traffic shaping (yet): Onion Routing originally called for batching and reordering cells as they arrived, assumed padding between ORs, and in later designs added padding between onion proxies (users) and ORs [27,41]. Tradeoffs between padding protection and cost were discussed, and traffic shaping algorithms were theorized [49] to provide good security without expensive padding, but no concrete padding scheme was suggested. Recent research 1 and deployment experience [4] suggest that this level of resource use is not practical or economical; and even full link padding is still vulnerable [33]. Thus, until we have a proven and convenient design for traffic shaping or low-latency mixing that improves anonymity against a realistic adversary, we leave these strategies out.

Answer 2

@Jens's answer has a great description of current Tor. The Tor-Browser adds some additional defenses, namely:

1. it enables HTTP pipelining, so that several requests can be sent on the same "batch"
2. it reorders the packets in that batch and randomly sets its size