1

As it is said in the Tor FAQ: "each Tor client selects a few relays at random to use as entry points, and uses only those relays for her first hop." These relays are known as "entry guards".

I have read many things about this: For example, that "every client picks 3 guard nodes and keeps them for 2 to 3 months". But I've also read that Tor is currently thinking of setting up a single entry guard node (Proposal 236: https://gitweb.torproject.org/torspec.git/tree/proposals/236-single-guard-node.txt).

Then, CURRENTLY, in the version 0.2.9.10, how many 'entry guards' are chosen and for how long are they maintained? And another question: does the "NumEntryGuards" option affect this list of nodes?

Improve this question

2 Answers 2

Reset to default
1

From what I can see from reading the code, it picks one guard if NumEntryGuards is not defined in the consensus. It is currently defined in the consensus but it is also set to one guard.

That guard is kept, by default, for 2 months (there is some random variance since it obscures the time the guard was initially picked), if GuardLifetime were defined in the consensus this would be the value used but it currently isn't defined.

Tor picks and tracks 3 potential entry guards, but when it comes to using the entry guards, it will prefer to use the same entry guard but there may be cases where this might not be safe (e.g. a user has specified an exit to use and the exit is your guard or is in your guard's family). You can see them defined in your state file in Tor's DataDirectory.

I think you're correct though, regarding the manuals. Since #17688 was merged, it should state 1.

Improve this answer
9
  • 1/2 I have been doing some tests with my Tor Browser and I have seen some interesting thing: by default, my Tor Browser ALWAYS picks 3 entry guards (except, evidently, if I use the option "NumEntryGuards NUM" and I specify a concrete number of nodes). I have deleted the content of the file "state" several times and after iniciating Tor Browser, always 3 entry guards appears in that file. In the Tor directory protocol, version 3 it is said (line #1837) this: NumEntryGuards: | Min: 1. Max: 10. Default: 3 |. Additionaly, there's a new entrynodes.c file (release 0.3.0) and in the line #430
    – NewUser
    Commented Mar 12, 2017 at 18:10
  • 2/2 it is said: * How many guards do we try to keep on our primary guard list? and then, the code sais: return networkstatus_get_param(NULL, "guard-n-primary-guards", DFLT_N_PRIMARY_GUARDS, 1, INT32_MAX); I'm doing a university research about Tor, and in the section about "entry guards" I do not exactly what to say, because the source code establish only 1 entry guard, and the consensus parameters also establish 1 entry guard, but then my Tor Browsers picks 3 entry guards. So, if I say that "Tor picks 3 potential entry guards, but then the client uses only 1 entry guards", would it be right?
    – NewUser
    Commented Mar 12, 2017 at 18:11
  • Wow! Right now I have re-deleted the contents of the "state" file, I have started Tor and I see that the file only shows an 'entry guard'. This time Tor has only selected one and not three as before. Why?
    – NewUser
    Commented Mar 12, 2017 at 18:59
  • 1
    0.3.x has the new prop-271 guard selection algorithm, which obsoletes most of the work done for prop-236, so your question is about 0.2.9.10 which is where I've cited code for, but 0.3.x will change it entirely (for the better).
    – cacahuatl
    Commented Mar 12, 2017 at 22:23
  • And canonizing ironize, do you know why sometimes my Tor Browser picks three entry guards, but sometimes my Tor Browser picks only an entry guard? (according to I can see in the state file). Additionaly, why the 0.2.9.10 source code establish by default an entry guard, but the directory protocol, version 3, establish by default three entry guards?
    – NewUser
    Commented Mar 13, 2017 at 0:13
0

There is a lot of information about guard relays on the torproject site. Perhaps the first blog post to read is the one called Research problem: better guard rotation parameters. It was written a few years ago so it's now a bit dated. However, it's still worth reading because it raises questions that are partly answered in arma's two later blog entries titled The lifecycle of a new relay and Improving Tor's anonymity by changing guard parameters. In the last mentioned blog entry, you'll read that "we need to extend the guard rotation period to many months" (!). It's better for you to read the blogs than to have the information repeated here. As a side issue, you might have noticed that there has been discussion on the Tails project about keeping guard relay information across independent Tails sessions so as to overcome some of the threats that materialize by having a rapid rotation of guard relays.

Unfortunately I was unable to find the answer to how question about how many guard entry relays are (randomly) chosen.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .