2

I'm sure there are mechanisms in place to prevent this, but what stops someone from making a circuit that is extremely long or cyclic, as to cause a DOS in the network? If possible, this would allow an advisory to amplify their bandwidth significantly and cause a DOS.

0

As covered in Proposal 110: Avoiding infinite length circuits that was implemented in July 2008, Tor hinders the creation of arbitrarily long circuits through the use of relay_early cells. Only relay_early cells may contain requests to extend circuits, and no more than eight relay_early cells may be sent over a given circuit. Intermediate relays pass on the same type of cell (relay or relay_early) that they receive, as long as those cells are legitimate. But they tear down circuits when they receive a normal relay cell that contains an extend request, or when they receive more than eight relay_early cells.

While adversaries can still create arbitrarily long circuits, using relay_early cells increases the cost of doing so. They would need to specify a malicious relay at every eighth hop. Given that, adversaries might as well just use each of those malicious relays to create an eight-hop circuit.

However, as discussed in Ticket 1038, using relay_early cells introduced a problem with accessing hidden services. Hidden services were receiving relay_early cells, and then tearing down circuits. To prevent that, an exception was created, which allowed hidden services (and clients) to receive inbound relay_early cells without tearing down circuits.

As discussed in Tor security advisory: "relay early" traffic confirmation attack..., a malicious-relay attack on hidden services began in January 2014 that exploited the relay_early exception. In response, Tor 0.2.4.23 was released, which removed the relay_early exception for hidden services and clients. Both now follow the relay_early policy: they drop circuits when they receive an inbound relay_early cell, and log the errors.

3
  • OK, so my question then is how exactly does the relay early cell prevent infinite circuits? I've read that blog, but it doesn't answer my question.
    – fuzion24
    Aug 15 '14 at 3:32
  • @fuzion24 Thanks. I've created a real answer. Please comment if I've misstated anything.
    – mirimir
    Aug 16 '14 at 23:26

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.