1

I am reading this article: https://blog.torproject.org/blog/hidden-services-need-some-love

And there is a paragraph states that:

Defense against Denial of Service of Introduction Points

The adversarial version of the previous section involves attackers intentionally hammering the Introduction Points of a Hidden Service to make it unreachable by honest clients. This means that an attacker can temporarily bring down a Hidden Service by DoSing a small number of Tor relays.

To defend against such attacks, Syverson and Øverlier introduced Valet nodes in their PETS 2006 paper: "Valet Services: Improving Hidden Servers with a Personal Touch". Valet nodes stand in front of Introduction Points and act as a protection layer. This allows Hidden Services to maintain a limited number of Introduction Points, but many more contact points, without clients learning the actual addresses of the Introduction Points.

Valet nodes are not implemented yet, mainly because of the big implementation and deployment effort they require.

So is the use of Valet Node already implemented in current Tor, or is Tor still vulnerable to this type of DOS attack against introduction points?

Improve this question

1 Answer 1

Reset to default
1

Not yet, to my knowledge. The concept is rather useless, by the way - at least with present Tor architecture: yes, it makes DoS a bit more difficult to perform, and no, DoS is an avalanche-like process, so DoSing 2,4,6,8,10,1,14,16,20 nodes - actually, it's no difference at all

Improve this answer
2
  • I see, if not yet implemented. Do you think those attack techniques stated in this paper: ieee-security.org/TC/SP2013/papers/4977a080.pdf are still real to attack hidden services?
    – 2523fewqf23f
    Commented Sep 24, 2016 at 20:25
  • @匿名柴棍 partially, yes. The problem of Tor - like other Darknets - is number of peers. When it rises - these attacks are losing their effect. And - about - deanonymisation attacks: remember that Tor HS STunnel-like tunnel is just a tunnel to a hos you're controlling(most cases to localhost) - it is not a requirement to locate a service physically there ;)
    – Alexey Vesnin ♦
    Commented Sep 24, 2016 at 22:38

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .