2

My understanding is that if I connect to an Onion Service the connection forms in the following way: My Computer -> My Entry Node (1) -> My Middle Node (2) -> My Exit Node (3) -> Rendezvous Point (4) <- OS's Exit Node (5) <- OS's Middle Node (6) <- OS's Entry Node (7) <- Onion Service's Server.

I feel like 7 connections is unnecessary in terms of security and just makes the connection slower. Once the two meet at the rendezvous point, why not form a connect with 3 nodes in between them? What security benefit is 7 nodes providing over 3?

Improve this question

2 Answers 2

Reset to default
1

Onion services require seven hops because it is important that nobody, not even the rendezvous point, is able to deanonymise either the client or service, even in the presence of adversaries controlling any one point. The three-hops-from-client-to-service design you hypothesise cannot, by currently-known methods, be made secure for both client and service if the other end turns out to be malicious. One end needs to provide too much information to the other to establish the circuit, and thus can be deanonymised.

If you think you have a design which could achieve the necessary feat, feel free to write it up and propose it. You'll either learn a lot by people poking holes in it, or else you'll make an extremely valuable contribution to the anonymity research community.

Improve this answer
-1

It is inevitable that there will be some adversarial hosts in a network like Tor. Nation state actors, security researchers and others are running hosts with a variety of motives, but often with the primary goal of de-anonymizing either specific persons or just anyone. In a network of N intermediaries where your connection goes through M hosts, there is a 1/N chance of a connection starting with a specific host, 1/N-1 that the next host is another specific one, etc, making for a product from n=0 to M-1 of 1/N-n. I'm afraid I don't have the time to do the maths now (and I'll probably fudge it anyway), but you can see how making the path length longer makes it exponentially harder to control the entire path from a user to a host.

The Tor FAQ has more on this.

Improve this answer
4
  • But tor connections to the clearnet are done with 3 nodes. Only OS connections are done with 7 nodes. Then why not makes those clearnet connections with 7 nodes?
    – Henry Gordon
    Commented Nov 24, 2019 at 11:07
  • This is not the reason why circuits to onion services typically use 6 hops.
    – Steve
    Commented Nov 25, 2019 at 18:21
  • @Steve Why then?
    – l0b0
    Commented Nov 25, 2019 at 18:50
  • @l0b0 The answer of womble above. Tor clients need to remain anonymous to the server and rendezvous point, but the server also needs to remain anonymous to the client and rendezvous point. If a three hop circuit is required for anonymity, then the rendezvous point must be three hops away from the client and three hops away from the onion service. You cannot rebuild a new three hop circuit since then the relay at the rendezvous point would be next to both the client and the server's guard, which are unchanging for long periods of time.
    – Steve
    Commented Nov 26, 2019 at 2:07

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .