1

How does tor handles nodes designed just to screw it.

The way i understand it entry node connects to node 2. which connects to node 3.(exit nodes) now all the traffic is encrypted and encryption i understand. But what if node is designed to attack tor network and make it unreliable and just pass on the wrong traffic. For example if node was supposed to pass encrypted string 'aaaa' instead it passes 'bbbb' just to screw up tor in general and a random tor user. Would tor network be able to isolate the node that is messing up the network, if so how?

How does tor handle it and are there any mechanisms to prevent that? I rly don't understand what guarantees entry node that it will get data it requested (data integrity) ?

Improve this question
1

2 Answers 2

Reset to default
1

You probably want to have a look at the Report Bad Relays wiki entry. As you can see in the wiki entry you can report bad relays and there are also automated tools to detect tempering (bottom of the wiki entry.)

The great thing about an anonymity network is that relays can't distinguish between the different users including scanners that test for tempering. Of course if HTTPS is used you might never know if anyone tempered with your traffic just like in the regular Internet.

Improve this answer
0

It's clear that you don't understand encryption, despite your claim.

"if node was supposed to pass encrypted string 'aaaa' instead it passes 'bbbb'"

No node knows what encrypted strings it is passing. It can only read those encrypted to itself, not those encrypted to other relays and since it is encrypted it could not reliably change "aaaa" to "bbbb". It could change some plaintext it doesn't know to some random value that it couldn't predict but the change would be detectable and make the cell it was passing invalid. This would result in the client or relay dropping the cell as invalid.

This would result in an error, a user investigating this error may discover that a relay was misbehaving and report it to bad-relays, who would try to see if the relay was being malicious, if it was it would be removed from the consensus and users would no longer user it.

Improve this answer
3
  • I am guessing that part was poorly written from my behalf. I am aware node 3 cannot control content of string, But what i meant to write is it can screw node 1 and node 2 by giving them nothing or by giving them faulty string. Is that change somehow automatically detectable?
    – Vjeran Magister Ludi
    Apr 26, 2017 at 16:22
  • If HTTPS is used, any change between browser and web server is detected because of the SSL connection, it checks data integrity. In case of HTTP or any other transmission without proper data integrity verification, only the exit node or someone between the exit and the web server can manipulate the payload unnoticed. This because of onion routing. In short, only the exit node has the private key to encrypt the payload destined for the web server and it also checks the integrity.
    – Peter Gerber
    Apr 26, 2017 at 16:32
  • Yes, it can be detected because the cells would be dropped, hashes wouldn't match or signatures wouldn't work. Your connections wouldn't work, so you'd know a node wasn't playing fair and you could detect which one was doing it.
    – cacahuatl
    Apr 26, 2017 at 19:29

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .