Multiple adversaries able to deploy large numbers of relays; do they dilute each other's effectiveness?

Question

I note that when researchers analyse some particular types of attacks on Tor security, they assume a SINGLE adversary who is capable of deploying a significant number of relays that will eventually be selected as guards and exit relays. If that is a realistic assumption to make for the purposes their analysis, then out in the real world there are probably at least three adversaries interested in attacking Tor, each of which is capable of deploying large numbers of relays for that purpose.

The interesting thing about this is that these "big" adversaries are likely to be attacking real client groups who will have very little overlap in their membership. If that assumption is true then it seems at first glance that the more "big" adversaries out their deploying relays, the smaller is the percentage of relays any one actually controls. Is that dilution effect significant?

Put another way, a client who is worried about being attacked by a particular, "big", adversary actually benefits when other "big" adversaries add large numbers of relays. It gives our client a better chance of selecting a guard NOT controlled by their adversary. It does not matter if the selected guards are controlled by other adversaries since we assume they are not interested in our client.

Is that argument too simple minded?

Answer 1

Tor's threat model assumes adversaries that can operate and/or compromise "some fraction of the onion routers". Anonymity depends on the fraction of malicious routers being small enough. And so multiple adversaries, as long as they didn't collude, would in fact reduce each other's effectiveness. That's part of Tor's design.

Answer 2

One fact that is commonly ignored when dealing with Tor is the hosts of the relay/exit/entry nodes. The simple fact is that many, if not most, of the Tor nodes are botnets that are hosted by third parties. This is a sad fact, but it prevents many attacks simply because of the sheer number of hosts that these introduce. In essence, to fully de-anonymize the Tor network, one would have to create a larger number of hosts than many large-scale botnets. This is not only costly, but inefficient.

In conclusion, only a fraction of the total network can be compromised by rouge servers alone. This does NOT mean it is impossible for the network to be compromised, as there are most likely multiple vulnerabilities that have not been found yet, but this means that the chances of an attack like the one that happened recently on a large scale are minimal.

Answer 3

There are at least three distinct possibilities.

Option 1: The adversaries add relays for the purpose of surveillance, snooping and/or spying.

option 2: The adversaries compromise otherwise acceptable relays for the purpose of surveillance, snooping and/or spying.

Option 3: The adversaries add relays for above purpose and compromise other relays for the above purpose simultaneously or otherwise.

If you consider option 2, your argument is not applicable at all. Multiple adversaries may have compromised many relays, some of the the relays maybe compromised by multiple adversaries. It is logical that these are relays with the largest bandwidth.

In your question you have mentioned at least three adversaries interested in attacking Tor, I suggest the numbers are at least in dozens and at least five of them are colluding (The five eyes, namely US, UK, Canada, Australia, and New Zealand). Looking at this scenario I see little comfort in concluding that, they will dilute each other significance. On the contrary, this collusion will significantly increase their significance. You should understand that at times even non-colluding adversaries do have a business dealings, and they may sell their information to the other adversaries for a price (not necessarily monetary price but sometimes for political, or tactical advantage and sometimes you scratch my back and I scratch your back situation). In conclusion, compromised relays by any adversary is a significant tribulation and there is no solace in which adversary is compromising which relay.