0

Even though circuit length is limited to 8, can an attacker create a circuit of length 8, and then get the exit node to create another circuit of length 8 (get the exit node to be a Tor client)? Then could he repeat this to get a really long chain of circuits and flood the network?

Update: I guess this is possible unless exit policies block connections to Tor ports on entry guards, or entry guards reject exit nodes.

Improve this question
13
  • It's possible, why do you imagine this would create any kind of denial of service condition though?
    – cacahuatl
    Feb 28, 2018 at 9:28
  • @cacahuatl, if someone creates a long circuit (perhaps 1000-1000000 nodes long) and then floods it with traffic, then the entire network will transfer data at many multiples of his bandwidth.
    – Victor
    Mar 2, 2018 at 2:40
  • There would be simpler attacks that would be more effective.
    – cacahuatl
    Mar 4, 2018 at 0:04
  • @cacahuatl, what kinds of attacks would be more effective than this simple amplification attack?
    – Victor
    Mar 7, 2018 at 4:32
  • There's no real "amplification" there.
    – cacahuatl
    Mar 7, 2018 at 21:04

3 Answers 3

Reset to default
0

Yes, but not as efficiently as a single arbitrarily long circuit. Ticket 2667 has never been fixed.

Improve this answer
2
  • Wouldn't this be impossible to fix as long as the attacker can make Tor traffic reenter Tor, possibly through other proxies?
    – Victor
    Aug 19, 2019 at 19:40
  • Yes. As arma already said it is not a very effective fix. On the other hand, as you need to reenter the network, the attack becomes less effective since each separate circuit has some overhead, which limits the amplification. For example, if you chain 3 circuits together, you have to send about 6 KiB to deliver a cell to the exit node in the last circuit. Thus the actual amplification is limited by the throughput of the first circuit.
    – nobody
    Aug 20, 2019 at 9:04
-1

It's possible but relays won't do it.

Tor uses "relay early" cell, which is used to prevent people from building very long paths in the Tor network. Very long paths can be used to induce congestion and aid in breaking anonymity.

It has been addressed in this proposal avoid-infinite-circuits

An attacker can add load to the Tor network by extending a circuit an arbitrary number of times. Every cell that goes down the circuit then adds N times that amount of load in overall bandwidth use. This vulnerability arises because servers don't know their position on the path, so they can't tell how many nodes there are before them on the path.

We propose a new set of relay cells that are distinguishable by intermediate hops as permitting extend cells. This approach will allow us to put an upper bound on circuit length relative to the number of colluding adversary nodes.

Only K (say, 10) Relay_early cells can be sent across a circuit, and only relay_early cells are allowed to contain extend requests. Each intermediate server would pass on the same type of cell that it received (either relay or relay_early), and the cell's destination will be able to learn whether it's allowed to contain an Extend request.

If an intermediate server receives more than K relay_early cells, or if it sees a relay cell that contains an extend request, then it tears down the circuit (protocol violation).

Improve this answer
4
  • I've already said this in the question ("circuit length is limited to 8"). I'm asking about getting the exit node to create another circuit. Tor lets you access HTTPS sites by having the exit node connect to TLS. Couldn't you use that to connect to TLS of another Tor entry guard?
    – Victor
    Mar 9, 2018 at 4:10
  • @Victor No. Exit node will refuse to do that. relay_early cells are designed to prevent this, so that you can't ask a circuit to create extended circuits.
    – defalt
    Mar 9, 2018 at 5:44
  • Again, I'm not talking about sending an EXTEND cell to the exit. I'm talking about sending an RELAY_BEGIN cell to the exit, and having the exit connect to another entry node.
    – Victor
    Mar 10, 2018 at 20:23
  • You can absolutely do Tor-over-Tor...
    – cacahuatl
    Mar 10, 2018 at 22:20
-1

Nodes know how long the circuit chain is and TOR will not expand your chain beyond 8 cells. IIRC there is some sort of crypto based way to verify this.

Improve this answer
2
  • As I asked in the question, couldn't you make a chain of 8 cells and then get the exit node to create a new circuit? The data for the new circuit should be invisible to the nodes before the exit node, as it should be encrypted.
    – Victor
    Apr 11, 2018 at 18:22
  • Oh, my apologies. Yes you could, you could proxy through tor then create a new connection to tor though that proxy and so on and so on.
    – Nick Mckenna
    Apr 11, 2018 at 18:54

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.