<html><head><meta http-equiv="Content-Type" content="text/html charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class=""><br class=""><div><blockquote type="cite" class=""><div class="">On 14 Sep 2015, at 09:07, Mike Perry <<a href="mailto:mikeperry@torproject.org" class="">mikeperry@torproject.org</a>> wrote:</div><br class="Apple-interchange-newline"><div class="">...<br class=""><br class=""><br class="">4. Security concerns and mitigations<br class=""><br class="">4.1. Mitigating fingerprinting of new HS circuits<br class=""><br class=""> By pinning the middle nodes of rendezvous circuits, we make it<br class=""> easier for all hops of the circuit to detect that they are part of a<br class=""> special hidden service circuit with varying degrees of certainty.<br class=""><br class=""> ...<br class=""><br class=""> The most serious of these is the Guard fingerprinting issue. When<br class=""> proposal xxx-padding-negotiation is implemented, services that enable<br class=""> this feature should use those padding primitives to create fake circuits<br class=""> to random middle nodes that are not their guards, in an attempt to look<br class=""> more like a client.<br class=""></div></blockquote><div><br class=""></div><div>How will this interact with the rate limiting in xxx-padding-negotiation section 4.1?</div><div><br class=""></div><div><div><blockquote type="cite" class=""><div class="">On 12 Sep 2015, at 10:34, Mike Perry <<a href="mailto:mikeperry@torproject.org" class="">mikeperry@torproject.org</a>> wrote:</div><br class="Apple-interchange-newline"><div class=""><span class="" style="float: none; display: inline !important;">4.1. Rate limiting</span><br class=""><br class="">...<br class=""><br class=""><span class="" style="float: none; display: inline !important;">We recommend that three consensus parameters be used in the event that</span><br class=""><span class="" style="float: none; display: inline !important;">the network is being overloaded from padding to such a degree that</span><br class=""><span class="" style="float: none; display: inline !important;">padding requests should be ignored:</span><br class=""><br class=""><span class="" style="float: none; display: inline !important;"> * CircuitPaddingMaxRatio</span><br class=""><span class="" style="float: none; display: inline !important;"> - The maximum ratio of padding traffic to non-padding traffic</span><br class=""><span class="" style="float: none; display: inline !important;"> (expressed as a percent) to allow on a circuit before ceasing</span><br class=""><span class="" style="float: none; display: inline !important;"> to pad. Ex: 75 means 75 padding packets for every 100 non-padding</span><br class=""><span class="" style="float: none; display: inline !important;"> packets.</span><br class=""><span class="" style="float: none; display: inline !important;"> - Default: 100</span><br class=""><span class="" style="float: none; display: inline !important;"> * CircuitPaddingLimitCount</span><br class=""><span class="" style="float: none; display: inline !important;"> - The number of padding cells that must be transmitted before the</span><br class=""><span class="" style="float: none; display: inline !important;"> ratio limit is applied.</span><br class=""><span class="" style="float: none; display: inline !important;"> - Default: 500</span><br class=""><span class="" style="float: none; display: inline !important;"> * CircuitPaddingLimitTime</span><br class=""><span class="" style="float: none; display: inline !important;"> - The time period in seconds over which to count padding cells for</span><br class=""><span class="" style="float: none; display: inline !important;"> application of the ratio limit.</span><br class=""><span class="" style="float: none; display: inline !important;"> - Default: 60</span><br class=""><br class=""><span class="" style="float: none; display: inline !important;">XXX: Should we cap padding at these rates, or fully disable it once</span><br class=""><span class="" style="float: none; display: inline !important;">they're crossed?</span></div></blockquote></div></div><div><br class=""></div><div>If the rate limiting is being applied, that will limit fake middle circuits (with few non-padding packets) to ~500 cells per minute (~4KBytes per second).</div><div><br class=""></div><div>Does CircuitPaddingLimitCount reset after CircuitPaddingLimitTime?</div><div>(I can’t tell from the proposal, but I assume it has to reset, otherwise the limit is quite low, at 500 cells per fake circuit for its entire lifetime [plus whatever dribble it gets from non-padding cells].)</div><div><br class=""></div><div>Are those consensus parameters intended to be always set, or just set when there is an issue with padding?</div><div>(I can see arguments both ways, but having them always set could be useful as a precaution against a quick attack.)</div><div><br class=""></div><div>Tim</div><div><br class=""></div></div><div class="">
<div style="color: rgb(0, 0, 0); letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px; word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class=""><div style="color: rgb(0, 0, 0); letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px; word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class=""><div style="color: rgb(0, 0, 0); letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px; word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class=""><div style="color: rgb(0, 0, 0); letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px; word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class=""><div style="color: rgb(0, 0, 0); letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px; word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class=""><div style="color: rgb(0, 0, 0); letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px; word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class=""><div style="orphans: auto; text-align: start; text-indent: 0px; widows: auto; word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class=""><div style="orphans: auto; text-align: start; text-indent: 0px; widows: auto; word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class=""><div style="orphans: auto; text-align: start; text-indent: 0px; widows: auto; word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class=""><div style="orphans: auto; text-align: start; text-indent: 0px; widows: auto; word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class=""><div style="orphans: auto; text-align: start; text-indent: 0px; widows: auto; word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class=""><div style="orphans: auto; text-align: start; text-indent: 0px; widows: auto; word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class=""><div style="orphans: auto; text-align: start; text-indent: 0px; widows: auto; word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class=""><div style="orphans: auto; text-align: start; text-indent: 0px; widows: auto; word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class=""><div style="orphans: auto; text-align: start; text-indent: 0px; widows: auto; word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class=""><div style="orphans: auto; text-align: start; text-indent: 0px; widows: auto; word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class=""><div style="orphans: auto; text-align: start; text-indent: 0px; widows: auto; word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class=""><div style="color: rgb(0, 0, 0); letter-spacing: normal; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; orphans: auto; text-align: start; text-indent: 0px; widows: auto; word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class="">Tim Wilson-Brown (teor)</div><div style="color: rgb(0, 0, 0); letter-spacing: normal; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; orphans: auto; text-align: start; text-indent: 0px; widows: auto; word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class=""><br class=""></div><div style="orphans: auto; text-align: start; text-indent: 0px; widows: auto; word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class="">teor2345 at gmail dot com<br class="">PGP: 968F094B (ABFED1AC & A39A9058 expire 15 Sep 2015)<br class=""><br class="">teor at blah dot im<br class="">OTR CAD08081 9755866D 89E2A06F E3558B7F B5A9D14F (From 1 Sep 2015)</div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div>
</div>
<br class=""></body></html>