The most effective approach for an attacker would be to establish Tor routing and send packets to trigger a chain reaction across 3 or more relays.

Now, couldn’t these attacks potentially be an opportunity to introduce noise into the network to make it more challenging for an attacker attempting correlations? Given that these attacks will continue to exist in the future, why not make them beneficial to the network?

Certainly, this would require some adjustments in how relays handle or route packets to achieve the best possible anonymity and to prevent the attacker from varying their transmissions too abruptly, which could add metadata.

Another challenge might be that the attacker themselves would have access to the routing path. It could be useful to include at least one intermediate hop that the user doesn’t know, and that varies for each packet sent.

It’s a still highly theoretical idea I recently had, but I wanted to share it because I found it interesting.

1 Answer 1


It will help, partially - but the goal that you're pointing to must be achieved in protocol itself, not in DDoS-like tools. Because the network overload will make things a way more complicated for an analyzing adversary for sure - and not just time correlations, but also almost any correlations will be impossible if D from DDoS will be Distributed enough - but the price will be a heavy overhead for the network itself and - actually - DDoS must have a target - so multiple distributed targets are required for it - and a pretty tough ones to withstand the attack successfully... So -it will make things much worse than better if it will be done via DDoS as a method

  • 1
    Since DDoS attacks are inevitable, we could perhaps use this bandwidth wisely. This could also serve as a deterrent at the same time, and we can plan for a protocol solution to add noise when there isn't enough DDoS activity
    – setnit6
    Sep 2 at 0:37

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .