I'm sure there are mechanisms in place to prevent this, but what stops someone from making a circuit that is extremely long or cyclic, as to cause a DOS in the network? If possible, this would allow an advisory to amplify their bandwidth significantly and cause a DOS.

1 Answer 1


As covered in Proposal 110: Avoiding infinite length circuits that was implemented in July 2008, Tor hinders the creation of arbitrarily long circuits through the use of relay_early cells. Only relay_early cells may contain requests to extend circuits, and no more than eight relay_early cells may be sent over a given circuit. Intermediate relays pass on the same type of cell (relay or relay_early) that they receive, as long as those cells are legitimate. But they tear down circuits when they receive a normal relay cell that contains an extend request, or when they receive more than eight relay_early cells.

While adversaries can still create arbitrarily long circuits, using relay_early cells increases the cost of doing so. They would need to specify a malicious relay at every eighth hop. Given that, adversaries might as well just use each of those malicious relays to create an eight-hop circuit.

However, as discussed in Ticket 1038, using relay_early cells introduced a problem with accessing hidden services. Hidden services were receiving relay_early cells, and then tearing down circuits. To prevent that, an exception was created, which allowed hidden services (and clients) to receive inbound relay_early cells without tearing down circuits.

As discussed in Tor security advisory: "relay early" traffic confirmation attack..., a malicious-relay attack on hidden services began in January 2014 that exploited the relay_early exception. In response, Tor was released, which removed the relay_early exception for hidden services and clients. Both now follow the relay_early policy: they drop circuits when they receive an inbound relay_early cell, and log the errors.

  • OK, so my question then is how exactly does the relay early cell prevent infinite circuits? I've read that blog, but it doesn't answer my question.
    – fuzion24
    Aug 15, 2014 at 3:32
  • @fuzion24 Thanks. I've created a real answer. Please comment if I've misstated anything.
    – mirimir
    Aug 16, 2014 at 23:26

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .