Gap - Counting number of packages to determine client?

Question

I read a lot about onion routing and I am confused about the following fact on Wikipedia: Only the final node, the "exit node", is able to determine its own location in the chain.

In my eyes this does not have to be true. See the following strategy (or ''attempt'') to determine at which position you are in the circuit:

Since most of the circuits have only three Tor-nodes + client-node, every node can assume there are four nodes (so our strategy should be possible in most of the cases). Let us consider the path 0->1->2->3, where 0 is the client, 1 the entry node, 2 middle node and 3 exit node (the nodes do not know which numbers they have a priori, except for 0 and 3 of course).

IDEA: Every node counts how many data packages are received from the previous ip-adress.

Now the client 0 has to build a connection with the first node 1 (which a priori does not know that the previous node 0 is the client). So the client 0 sends his encrypted key. Now the entry node 1 raises his counter by 1 (assuming the key is always encrypted into the same length of packages - is that true?? Without loss of generality this length is = 1). Then the client 0 sends his second encrypted key via the entry node 1 to the middle node 2. So the entry node has counter = 2 and middle node has counter = 1 (again assuming the same as above). Now the same for the exit node. We get the counters 3, 2 and 1 in this order. But now, we are sending our request for the webpage, which should be a stream of data packages, so the nodes can see there is some kind of big jump between the length of packages. At this point they should now: ok, the packages before were only for receiving the keys. Since my counter is n € {1,2,3}, I am node 4-n. So node 1 knows that the previous node is indeed the client!!

Is there any mistake in my algorithm to determine the position of the nodes??

PS: I am aware, that there are much more clients and every node may be another node in another circuit, but the above algorithm is should stay true, since they are counting the packages from one specific ip-adress (the previous one).

Answer 1

This page on wikipedia cites the original tor paper, and I don't remember the tor paper ever making that claim. So I would not trust this wikipedia article for accuracy.

To answer your question, yes, in the current Tor network any relay can determine it's position in the circuit since all client Tor circuits have only three relays. Your method above might work, but in practice it's even easier. If a relay is asked to open a stream to a server outside of the Tor network, the relay knows it's in the exit position of the circuit. If the relay receives a new connection from a client (clients are distinguishable during the connection handshake), the relay knows it's in the entry position of the circuit. Otherwise, the relay must be in the middle position of the circuit. If you're interested in this topic, it's also briefly mentioned in the last paragraph of section 5.4 in the walking onions paper.

If circuits were longer than 3 hops, then relays could try to use counting and timing information like in your post.