Preferred terms for Tor relay positions

Question

Is it preferable to call the first relay the "entry" relay or "guard" relay? I've seen both in the published literature.

Answer 1

"Guard node|relay", "entry node|relay", or "entry guard" are used interchangeably, but I believe this is actually a conflation of two different ideas.

It's possible to turn off the use of guard nodes using the option UseEntryGuards. If you have the option set (which is the default), you'll use a relay marked with the Guard flag as your first hop. You will therefore be using an entry guard.

What is an entry guard, and what's it guarding against? The Tor Path Specification document has this to say in Section 5:

We use Guard nodes (also called "helper nodes" in the literature) to
prevent certain profiling attacks. Here's the risk: if we choose entry and exit nodes at random, and an attacker controls C out of N relays (ignoring bandwidth), then the attacker will control the entry and exit node of any given circuit with probability (C/N)^2. But as we make many different circuits over time, then the probability that the attacker will see a sample of about (C/N)^2 of our traffic goes to 1. Since statistical sampling works, the attacker can be sure of learning a profile of our behavior.

If, on the other hand, we picked an entry node and held it fixed, we would have probability C/N of choosing a bad entry and being profiled, and probability (N-C)/N of choosing a good entry and not being profiled.

Note that these paragraphs use the term "entry node" (without the word "guard") to generically mean the first node in the circuit. We're abstracting ourselves from the specifics.

The same document uses the following terms interchangeably when talking specifically about first-hop nodes that are guarding:

• entry guards
• guard nodes
• guards

Back to the story...

If you have the UseEntryGuards option unset, you won't be using a guard, simply another relay acting as your first hop. (Note that there are still the same number of hops.) In this case the use of the term "entry guard" or "guard relay" isn't appropriate, and the more generic, non-specific "entry node|relay" would be more accurate.

With this all said, I imagine very few people know the UseEntryGuards option exists, and even fewer turn it off, leading to all terms mentioned above - with and without the word "guard" - to have become conflated and used interchangeably.

It's worth noting that the original design document uses none of these terms, instead generalising with the term "onion router" (or, specifically, "OR"), and noting the position in the circuit with a number. e.g. "OR1", "OR2", etc.