Would distributed denial of service (DDoS) attacks on the directory authorities disrupt the Tor network?

Question

Assume someone wants to disrupt the Tor network or maybe bring it down. A powerful attacker could try to DDoS all the directory authorities. As there are only 10 worldwide this seems like an easy task.

What will happen if someone DDoS

1. a part of the directory authorities
2. all directory authorities

Will the DDoS have an immediate effect or can the network survive for some amount of time?

Answer 1

Let's start with a minor correction: there are only 9 directory authorities. You probably counted Tonga, but that's the bridge authority which is pretty much unrelated to the other 9 directory authorities. (Discussing what would happen if somebody took down the bridge authority would be, well, a separate discussion.)

Now let's distinguish three cases:

1. Somebody takes down a minority of directory authorities, so up to 4. The effect is that the remaining 5 or more can still produce a valid consensus, so the network wouldn't be affected much. The exception is if the attacker takes down the subset of directory authorities that are voting on specific flags, like the Named or BadExit flags. In that case, there would be no relays with those flags in the consensus, which would somewhat affect the network.

2. The attacker kills a majority of directory authorities, so 5 or more, but not all of them. The remaining directory authorities wouldn't be able to generate a fresh consensus anymore. A consensus is valid for 3 hours, and then clients still accept it for (I think) another 21 hours. If there's no new consensus after that, clients will be sad.

3. The bad guy manages to shut down all 9 directory authorities. This has the additional negative effect of new clients not being able to download their initial consensus during the bootstrap process, so they would be sad immediately. We may have a new design in place that ships a list of fallback directory mirrors with the sources which would soften the blow here.

So much about the bad news.

Here's the good news: we have a service that runs once per hour and informs directory authority operators as soon as a directory authority doesn't vote. The output of that service is publicly archived for everybody to watch: https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-consensus-health

Ah, and a quick note on what would happen if somebody attacked Tonga, the bridge authority. In that case, the bridge distribution service BridgeDB wouldn't learn about new bridges, and it might give out bridges that are not running anymore. Not the end of the world. We have an internal notification system for Tonga failing or not reporting fresh bridges, too.