A typical tor circuit has

Browser -> entryNode(A) -> relay(B) -> exitNode(C) -> Server

This is prone to timing related attacks if both entryNode and exitNode are controlled by the adversary. Let say a website has /index.html, /index.js, /home.png, tor browser is going to use the same circuit for each resource and the sizes of responses help the adversary to de-anonomyse. I understand we cannot change the exit node as the servers may have tied the session with the ip address of the exit node but why can't we use different entry nodes and relays?

This way even if one of the entry node is controlled by the attacker, it makes it difficult to use it to perform a timing attack. So the circuits will look like

For index.html: Browser -> A1 -> B1 -> C -> Server
For index.js:   Browser -> A2 -> B2 -> C -> Server
For home.png:   Browser -> A3 -> B3 -> C -> Server

Are there any downsides to this approach?

The new set A1, A2, A3 forms the guard node.

  • Check this : blog.torproject.org/announcing-vanguards-add-onion-services Designed for onion services,but easily configurable for a client too. Mar 10, 2020 at 15:55
  • Please post the relevant information from that here. Answers consisting just of links are not particularly helpful and are liable to be deleted.
    – Chenmunka
    Mar 11, 2020 at 10:30
  • can you please cherrypick the core from your link and post it here as an edit? Links are good, for sure - that's what has made the World-Wide Web, but they're used to die... So let we make a backup here!
    – Alexey Vesnin
    Mar 23, 2020 at 22:54


You must log in to answer this question.

Browse other questions tagged .