Could the number of hops picked in a given circuit be chosen randomly. For example randomly generate a number by random number generator between 3 and 7 inclusively [3,4,5,6,7], and each circuit created for an instance of Tor randomly choose number of hops it uses based on the output of random number generator for regular sites. For hidden services let's say generate a number between 6 and 7 inclusively [6,7] and each circuit randomly pick a number of hops based on the output of random number generator. Does Tor support such a scheme?

P.S. For sake of simplicity let's assume one choose a uniform distribution function for random number generator, which means equal chance of picking each number.

3 Answers 3


Think that it is a dirty solution. But I've tried to apply this code

routelen = (rand() % 6 + 1);
log_notice(LD_CIRC, "Now routelen equals %d", routelen);

to this function, before routelen variable returns, then compiled it.

And my output looks like it:

[notice] Opening Socks listener on
[notice] Parsing GEOIP IPv4 file ./misc/geoip.
[notice] Parsing GEOIP IPv6 file ./misc/geoip6.
[notice] We now have enough directory information to build circuits.
[notice] Bootstrapped 80%: Connecting to the Tor network.
[notice] Now routelen equals 5
[notice] Bootstrapped 85%: Finishing handshake with first hop.
[notice] Bootstrapped 90%: Establishing a Tor circuit.
[notice] Now routelen equals 5
[notice] Now routelen equals 6
[notice] Tor has successfully opened a circuit. Looks like client functionality is working.
[notice] Bootstrapped 100%: Done.
[notice] Now routelen equals 6
[notice] Now routelen equals 4
[notice] Now routelen equals 2
[notice] Now routelen equals 6

Think that it chooses randomly, can not confirm/refute this, but you can try.

  • 1
    Great! You have my upvote.
    – Roya
    Jul 11, 2014 at 14:26
  • 1
    Thanks! But I can not confirm this, not sure what is that with command output (my question without an answer at this time), and not programmer. :-(
    – hiprivet
    Jul 11, 2014 at 14:44

hiprivet provided a solution by changing the source code of Tor. The question, if it is possible to extent the circuit length, was asked before and this answer is still valid.

So take a minute before you implement this solution and consider the following issues:

  1. The main risk of a Tor circuit are the end points. First there is the entry into the Tor network. The paper 'Locating hidden services' described risks and provided the current guard design as a solution. However the question how long a guard should be used and how often they should be changed is discussed currently. The endpoint of a circuit can has also some well-discussed possibilities to weaken your anonymity while the middle node is safe. And it doesn't help you if there is only one or more in the middle.
  2. But more than one node in the middle will hurt your performance. The traffic is routed over more relays and will get slower than before.
  3. Besides your performance also other users performance is affected. Because it puts more load on the relays and so all users suffer.
  4. Last it can weaken your anonymity. Assume there is an adversary which can watch the network. Nearly all users use 3-hop-circuits and there is one user which behaves different. So the attacker might be able to deanonymize a user with a longer path just because it pops out of the user base. So using longer circuits will put you at risk. The FAQ also has an entry about choosing the path length which discusses this issue.

tl;dr: While you can change the length, don't do it, because it weakens the network as well as your anonymity.

  • Dear Jens, I agree with most of what you wrote. You have my upvote. However, there is a pending question regarding the item 4 you mentioned, in tor.stackexchange.com with no definite answer (tor.stackexchange.com/questions/3472/…). Do you know the answer to this question?
    – Roya
    Jul 12, 2014 at 11:59

Following is the quote from Tor FAQ:

There is a good argument for making the number of hops in a path unpredictable [Thus Random]. For example, somebody who happens to control the last two hops in your path still doesn't know who you are, but they know for sure which entry node you used. Choosing path length from, say, a geometric distribution will turn this into a statistical attack, which seems to be an improvement. On the other hand, a longer path length is bad for usability, and without further protections it seems likely that an adversary can estimate your path length anyway. We're not sure of the right trade-offs here. Please write a research paper that tells us what to do.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .