16

With onion-routing a relay in a circuit only knows its predecessor and its successor, while a "normal" proxy is just one hop, so that it knows who connects to it and where it has to connect to.

Wouldn't it be sufficient enough, from the anonymity point-of-view, to have just two hops, guard and exit? The Guard knows where the request is coming from and the exit where it is going to.

Why does Tor use three hops, instead of two?

Improve this question
4

1 Answer 1

Reset to default
12

Maybe think of it as a defense in depth idea. If you only have two hops, and your adversary owns or watched your exit node, they immediately know which other node to compromise to get you.

That single node is a particularly high-value target since you'll be using your guard node for a while, so maybe it's worth investing some resources to be able to watch that. Due to the middle hop this equation changes slightly.

Now of course the next question is "why not four"? At some point adding more nodes just increases latency and doesn't add that much security. And some attacks don't care how often and long you bounce around within the Tor cloud anyway.

It just seems that three is a good compromise, or as Roger put it "3 is a good number of anonymity".

Improve this answer
4
  • 1
    As I understand it correlation attacks allow an adversary to deanonymize with just the first and last hop. A third hop obscures what the first hop they need to own is, but as I understand it doesn't actually help anonymity. Could certainly be wrong - curious to see what other answers this gets. :)
    – Damian
    Commented Oct 13, 2013 at 7:45
  • @weasel, that's how I understood it, too. An exit would always know one's guard relay(s) and could profile a client based on the set of guards and rotation. Me repeatedly visiting tor.stackexchange.com, several times a day and every day for months, with the same guards would enable the exit to guess that it is the same client. With the middle relay in place an exit is unable to tell from what guard it comes.
    – bastik
    Commented Oct 13, 2013 at 8:20
  • There are about 900 exits. At ten minutes per circuit, it would take about six days to cycle through them all. But, of course, Tor doesn't just cycle -- it chooses "randomly" (unless constrained). In any case, it doesn't seem like typical users would be using a given exit very often. Right?
    – mirimir
    Commented Oct 13, 2013 at 8:58
  • @mirimir, I haven't checked what my exit nodes were. I remember to have seen 'chaoscomputerclub$XY' much more often than I can say about others. Tor choses probabilistic based on router bandwidth. I'm unable to tell how often users end up with the same exit, don't know the model or some statistics.
    – bastik
    Commented Oct 13, 2013 at 9:38

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .