Which one of the relay nodes need to get compromised for client de-anonymization?

Question

Tor can't protect against traffic confirmation (also known as end-to-end correlation), where an attacker tries to confirm an hypothesis by monitoring the right locations in the network and then doing the math. The question is: Is it enough for the adversary to compromise any two of the three nodes to be able to de-anonymize the client? Specifically consider the following:

Guard (compromised) + Middle node (compromised) + Exit node (not compromised) = Result in Client de-anonymized

Guard (compromised) + Middle node (not compromised) + Exit node (compromised) = Result in Client de-anonymized

Guard (not compromised) + Middle node (compromised) + Exit node (compromised) = Result in Client de-anonymized

Do all three cases detailed above result in client de-anonymization?

Answer 1

First of all: As far as i know, if you do not compromise the Entry-Relay (Guard), you can not locate the client. So being said, the third case does not result in client de-anonymization.

For the other two cases, in which you have compromised the entry-relay, you will be able to locate the client. To be a little more specific:

Before there were Entry-Guard and as far as I can remember the paper Locating Hidden Servers I can tell, that you (as an adversary) don't even need to compromise two relays to locate (de-anonymize) the client or an Hidden Service. You just need ONE. That was, because you can figure out if you are the entry-node. If you figure, you found the location of the client.

Now, with using Entry-Guards, its a little different. You can still notice, if you are the entry-guard, that you have de-anonymized the client. But you can't get there that easy. What you can do, is getting to know the guard. For that you need to know or be the middle-relay, and if you are't there, you will have to start with the exit-relay. If you are not one of the relays on the circuit, but some powerful malicious attacker, you now just need to get the information from the links between the relays and already can figure which relay is being the entry relay. From there you'll find the client as well.

A lot from what I just wrote (out of memory) is being explained somewhere here. Hope it helped.