traffic-analysis

Question

I am (very) new to Tor.

As I understand it, each time a data-package passes a Tor-relay, it is encrypted/decrypted, thereby changing in size only marginally. It seems to me that if somebody monitors the Tor-relays, he could analyze the size of the data-packages entering/leaving the relays. Combine this with an analysis of the timing of each data-package entering/leaving a Tor-relay, and you should get a very clear picture of the entire path, revealing each individual Tor-user and his activity-profile.

To avoid this, all data-packages must be chopped/padded at every station after encryption/decryption, so that they all have the same size en-route. Also, to avoid time-analysis, a fair number of bogus data-packages must be swapped around the network, so each Tor-relay and indeed each Tor-user, appears to have a constant workload.

Answer 1

What you describe is a timing attack. (See here: https://www.torproject.org/docs/faq.html.en#AttacksOnOnionRouting )

In order to perform it, you need a birds-eye view of the network. Only very few parties have this.

Splitting/joining packets in a stream would not help (much) against this, as you could still analyse the change in volume. Unless you take padding almost to the extreme where Tor constantly pumps noise to keep all connections saturated all the time. I imagine this would have a negative impact on network performance.