Why does Tor Browser sometimes choose one entry guard (most of the time), but sometimes it choose two or three entry guards?

Question

Some days ago I opened a thread asking how many entry guards Tor Browser currently picks. I found out, with help from forum volunteers, that the current source code of the stable version of Tor (0.2.9.10) stipulates that Tor has to choose, by default, 1 entry guard. For two reasons: firstly, because the entry guard is chosen by consensus, and consensus parameter NumEntryGuards=1 currently stipulates an entry guard. But, in addition, if the consensus did not stipulate the entry guard, Tor by default has to choose one (this appears in lines #79 to #85 of the source code).

I saw that, although the source code says that, the Tor directory protocol, version 3, says that Tor has to choose 3 entry guards by default (this appears in the line #1837 of the Tor directory protocol). The explanation is that, perhaps, the Tor directory protocol, version 3, is outdated. Or at least that line.

Here is the curious part: I have done several tests with my Tor Browser and I have discovered that normally the software chooses an entry guard (this is in line with the current consensus and with the source code), but sometimes in the state file I see that Tor Browser has chosen three or two entry guards, and I cannot find the reason. Why does Tor Browser choose three or two entry guards if the software is set to choose one?

To do the tests, I have reinstalled Tor Browser and I have not changed any settings. I performed the tests under Windows 10 Pro 64-bits and with version 6.5.1 of Tor Browser. I attached the torrc file here so that you can see the configuration.

Next, I attach screenshots of the state file, so you can check how Tor Browser sometimes chooses one, two or three entry guards. To change entry guard, I have deleted the contents of the state file and started the Tor Browser again. The question I want to solve is: Why does Tor Browser sometimes choose one entry guard (most of the time), but sometimes it chooses two or three entry guards? It is very important for me because I'm doing an universitary reserach about Tor and I do not find the reason of this.

The first time I started Tor Browser, it chose 3 entry guards. Screenshot.

The second time I started Tor Browser, it chose 1 entry guard. Screenshot.

The third time I started Tor Browser, it chose 1 entry guard. Screenshot.

The fourth time I started Tor Browser, it chose 1 entry guard. Screenshot.

The fifth time I started Tor Browser, it chose 2 entry guards. Screenshot.

The sixth time I started Tor Browser, it chose 1 entry gurad. Screenshot.

The seventh time I started Tor Browser, it chose 1 entry guard. Screenshot.

The eighth time I started Tor Browser, it chose 1 entry guard. Screenshot.

The ninth time I started Tor Browser, it chose 1 entry guard. Screenshot.

The tenth time I started Tor Browser, it chose 1 entry guard. Screenshot.

The eleventh time I started Tor Browser, it chose 1 entry guard. Screenshot.

The twelfth time I started Tor Borwser, it chose 1 entry guard. Screenshot.

The thirteenth time I started Tor Browser, it chose 1 entry guard. Screenshot.

The fourteenth time I started Tor Browser, it chose 1 entry guard. Screenshot.

The fifteenth time I started Tor Browser, it chose 2 entry guards. Screenshot.

The sixteenth time I started Tor Browser, it chose 1 entry guard. Screenshot.

The seventeenth time I started Tor Browser, it chose 1 entry guard. Screenshot.

The eighteenth time I started Tor Browser, it chose 1 entry guard. Screenshot.

The nineteenth time I started Tor Browser, it chose 1 entry guard. Screenshot.

The twentieth time I started Tor Browser, it chose 2 entry guards. Screenshot.

Answer 1

Proposal 236, which has been implemented by now, explains the behavior:

When this proposal becomes effective, clients will switch to using a single guard node.

That is, in its first startup, Tor picks one guard and stores its identity persistently to disk. Tor uses that guard node as the first hop of its circuits from thereafter.

If that Guard node ever becomes unusable, rather than replacing it, Tor picks a new guard and adds it to the end of the list. When choosing the first hop of a circuit, Tor tries all guard nodes from the top of the list sequentially till it finds a usable guard node.

---

Took a closer look at it and I noticed this option in the manpage:

UseEntryGuardsAsDirGuards 0|1

If this option is set to 1, and UseEntryGuards is also set to 1, we try to use our entry guards as directory guards, and failing that, pick more nodes to act as our directory guards. This helps prevent an adversary from enumerating clients. It’s only available for clients (non-relay, non-bridge) that aren’t configured to download any non-default directory material. It doesn’t currently do anything when we lack a live consensus. (Default: 1)

Take a look at src/or/entrynodes.c you'll find that choose_random_entry_impl() is shared for entry and directory guards. It is responsible for adding entry guards (via add_an_entry_guard()). The default number of directory guards is currently 3, I guess that this is why more EntryGuard entries appear in state after a while. As far as I can tell, the additional nodes are only used for directory fetches as long as the current entry guard doesn't fail.