Why are entry nodes allowed to know that they are entry nodes?

Question

Right now, a user can be deanonymized if an attacker controls the entry node and the exit node in a Tor circuit. The attacker can discover the IP of the originator, and the site they are accessing. It gets even worse if it was not secured with https.

It is possible, if a user is willing to deal with latency, that they may construct a circuit larger than the regular 3 hops. Even given this, the above attack is still perfectly possible.

But what if the entry did not KNOW they were an entry node? Then the entire scenario changes. Imagine the same attack, but the entry node doesn't know for certain that it is being used as an entry node. As far as they know, they could be in the middle of a circuit OR an entry node. They could not conclude with certainty, one way or the other, whether or not the user that they have 'deanonymized' is truly the originator of the data being sent!

For all they know, it could have been part of a circuit longer than the standard 3, and the node that sent it the data was actually an entry node or another middle node just relaying data.

Why do entry nodes have their own listing and know that they are entry nodes? What might be the downsides of 'merging' entry nodes and middle nodes so they cannot tell which role they are fulfilling?

Answer 1

The network doesn't make the distinction of entry relays. Any Tor client is allowed to use any relay for any hop of the circuit (except with restrictions on the exit relay). To limit the types of attacks you describe, Tor clients use a set of guard relays. Any relay that is stable, fast, and has a good uptime is given the "Guard" flag by the directory authorities. This means that clients will add them to their guard sets, therefore using them as entry relays. These relays with the "Guard" flag are still used as middle relays (and sometimes exit relays), meaning they can still be used anywhere in the circuit.

Unfortunately the first relay of a circuit (the entry relay, usually a guard relay) will always know if it's the entry relay based on the incoming TCP connection. There are a few reasons for this. The simplest is that the relay can see the IP address that is connecting to it. If that IP address is not a relay's IP, then it is most likely a client's IP. Also, clients don't have long-term identities like relays do. This means that relays know during the link handshake if a client is connecting.