1

Is Tor use any steganography methods to hide connections inside onion routing?

I found this question on security SE: Tor traffic correlation attacks by global adversaries

adversaries (like the NSA) that can see large segments of the Internet can relatively easily de-anonymize most Tor traffic

Will Guard ( first node ) try to hide next hop from global adversaries ? E.g. by sending 3 or more similar messages to the next nodes, where only one of them is a real middle-node ( second node ) ?

Is Tor network making any noise to confuse global adversaries ?

I'm talking about timing-attack:

Say, delays on transmissions would help, but would increase latency and aren't currently supported by TOR.

Would noise traffic, say increase load of network in 3x, be helpful against timing attack? One in / Four Out.... One in / Fourteen out... One in / Forty out

ASCII graphic:

                  +-- noise traffic --> Middle --> noise traffic --> Exit#1
                 /
                /-- noise traffic --> Middle --> noise traffic --> Exit#2
Client --> Guard
                \-- True Connection --> Middle --> True Connection --> Exit#3
                 \
                  +-- noise traffic --> Middle --> noise traffic -> Exit#4

To prevent attack by correlation of size, e.g. noise traffic generated on the Guard side accordingly to True Connection with minimal distance by Shanon.

There might be continuation:

                                                 /+---> noise traffic -> Exit#1
                      +-- noise traffic --> Middle --> noise traffic --> Exit#2
                     /                            \---> noise traffic -> Exit#3
                    /                              +---> noise traffic -> Exit#4
                   /
                  /
                 /                         /+--> noise traffic -> Exit#5
                /-- noise traffic --> Middle --> noise traffic --> Exit#6
               /                          \---> noise traffic -> Exit#7
              /                            +---> noise traffic -> Exit#8
             /
Client --> Guard
             \\ 
              \\
               \\
                \\                            /+---> noise traffic -> Exit#9
                 \== True Connection ==> Middle -->  noise traffic --> Exit#10
                  \                          \\==> True Connection ==> Exit#11 ==>> True
                   \                          +--> noise traffic -> Exit#12
                    \
                     \
                      \
                       \                           /+---> noise traffic -> Exit#13
                        +-- noise traffic --> Middle --> noise traffic -> Exit#14     
                                                \---> noise traffic -> Exit#15
                                                 +---> noise traffic -> Exit#16
  • This sounds like it would put enormous strain on the Tor network by flooding it with extra traffic (exponentially in your second example). I don't think the network could handle that much extra bandwidth at this point. – Andrew Lott Jan 12 '14 at 12:30
2

Tor does not include any use of noise in any way. It also does not use any delays as those would not help much and would not be tolerated by applications and users.

The concern is end-to-end traffic correlation, where the adversary can see the traffic flowing into the Tor network and out of it. This has not to happen at the entry and exit node, just any way along the traffic's route.

The proposed solution would vastly increase the amount of bandwidth required for a Tor node and at best hide the path the traffic took; what's usually not what the adversary cares about.

  • I'm unable to find the paper about adding delays. It has this graphs that suggest to pad to something and show how much overhead that would be. Does anyone know the paper? – bastik Jan 12 '14 at 12:48
  • vastly increase the amount of bandwidth, There is already 3x more bandwidth than plain Internet browsing. Increase this to 6x or 9x not an expensive price. I'm really sure, that kind of such noise will bring proportional stealthing to Tor network. – ConcealmEnt Jan 20 '14 at 16:13
  • I'm not sure. Before this would turn into a discussion, could you send an email to the mailinglist presenting your idea. There are many smart people. I don't know if they are all here. – bastik Jan 20 '14 at 20:37
  • I'll better keep this question clean, without flooding. I'm sure that head of dev team read Tor SE, before it will become a flooding dustbin like stackoverflow now. – ConcealmEnt Jan 21 '14 at 22:25

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.