Tor no longer secure, but can this be fixed?

Question

In a recent episode of a podcast called Security Now (#493: Tor: Not so Anonymous), they claimed that traffic can be delayed in unique ways to identify which client IP address on one side of the Tor onion is communicating with which server IP on the other side. So basically they insert gaps in the data transfers and look for gaps going to client IPs. Somehow or other Cisco's Netflow feature is involved.

Here's an idea:

To solve this deanonymization problem, why not have Tor clients simply always be uploading and downloading packets at a steady beat e.g. every 10 milliseconds, regardless of whether any meaningful data is really being sent? Of course the exit node would have to play along with this charade, accepting and sending packets even if there is no need. The tor process running on the client would have to be able to drop incoming "dummy" packets, as well as send them; same for the exit node's tor process.

Would this fix the Tor deanonymization problem?

Answer 1

From what you describe, they were referring to "On the Effectiveness of Traffic Analysis Against Anonymity Networks Using Flow Records", by Chakravarty, S. et al.

Roger Dingledine wrote a blog post about this back in November, when the media got all excited about the paper, that discusses this in more depth, and the author of the paper also commented.

As to your proposed defense, in is broken in "On Countermeasures to Traffic Analysis Attacks", Fu. X et al, and that specific scheme has terrible network behavior with regards to both performance and congestion (with your specific parameters, each connection will be limited to 50 KiB/s).

There are several "better" defenses proposed in academic literature including CS-BuFLO, but evaluating them context of mitigating end-to-end correlation is an open research question.