- tor-dev - lists.torproject.org

patch to improve consensus download decompress performance
by starlight.2015q3＠binnacle.cx 28 Aug '15

28 Aug '15

3 2

Triaged some TorCoreTeam201508 tickets; please review
by Nick Mathewson 26 Aug '15

26 Aug '15

Hi! I've moved all the TorCoreTeam201508 tickets to TorCoreTeam201509 or out entirely. I've also moved some of them to the 0.2.8 milestone, and tentatively assigned the PostFreeze027 ticket to others. If I'm wrong about any of those, please feel free to fix 'em! Now I'm moving on to the 0.2.7 milestone as a whole. In general, any ticket in 0.2.7 that isn't tagged with PostFreeze027 is not going to be a candidate for merge after 1 Sep, so please keep that in mind. (You can add the tag to your own tickets if you want, but please do so judiciously and in moderation.) cheers, -- Nick

1 1

FSCONS CFP extended
by tordevmuc＠encambio.com 26 Aug '15

26 Aug '15

Hello list, Organizers of the Free Society Conference and Nordic Summit (FSCONS) taking place in Goeteborg, Sweden on 7-8 November have extended the CFP and seek speakers [1] for the event. Particularly relevant to us is the track: Everyday Crypto ...and being that at least one group friendly to Tor is already scheduled, it would be a welcome gesture to have a Tor lecture or workshop as well. Anyone interested in this should contact Stian (in Cc) with a speaking/workshop proposal. [1] https://fscons.org/2015/cfp.html Cheers, Michael

1 0

Hash Visualizations to Protect Against Onion Phishing
by George Kadianakis 26 Aug '15

26 Aug '15

Hello, this mail lays down an idea for a TBB UI feature that will make it slightly harder to launch phishing attacks against hidden services. The idea is based on hash visualizations like randomart [0] and key poems: ------------------- | o=. | | o o++E | | + . Ooo. | | + O B.. | | = *S. | | o | | | | | | | ------------------- The idea came up during a discussion with Jeff Burdges in CCC camp. This is a heavily experimental idea and there are various unresolved research and UX issues here, but we hope that we will motivate further study. The aim is to make it harder to phish people who click untrusted onion links. Think of when you click an onion link on a forum, or when a friend sends you an onion URL. The problem is that many people don't verify the whole onion address, they just trust the onion link or verify the first few characters. This is bad since an attacker can create a hidden service with a similar onion address very easily. There are currently ready-made scripts that people have been using to launch impersonation attacks against real hidden services. The suggested improvement here is for TBB to provide additional visual fingerprints that people can use to verify the authenticity of a hidden service. So when TBB connects to a hidden service, it uses the onion address to generate a randomart or key poem and makes them available for the user to examine. Here is an experimental mockup just to illustrate the idea: https://people.torproject.org/~asn/tbb_randomart/randomart_mockup.png The idea is that you hash (or scrypt!) the onion address, and then you make a visualization using the hash output. This forces the phishing attacker to generate a similar onion address _and_ similar hash visualizations. We assume that this will be harder to do than simply faking a similar onion address, which increases the startup cost for such an attacker. This is the basic concept. Now, here are some thoughts: - What hash visualizations can we use here? The SSH randomart is an obvious idea, and we can even have it colored since we are not in a terminal. Then we have the key poem idea, which generates a poem from a key. I don't think this is used by a deployed system currently. Then we could imagine music-based hash fingerprints, where the onion address corresponds to a small tune that is played when you visit an onion. Then there are even more crazy ideas like the "Dynamic Security Skins" paper [1]. So for example, TBB could generate a unique UI theme for each hidden service. - Of course, none of the above ideas is perfect. Actually most of them suck. For example, when it comes to randomart, many people are colorblind to some degree and most people are not good at recognizing subtle color differences. Furthermore, given a randomart, it's easy [2] to generate similar randomarts. However we hope that most of those similar randomarts will not correspond to a public key that is similar to the original one. When it comes to key poems, given even a moderately sized dictionary leads to pretty big poems. We are talking about poems of 24 random words, which is not something that most people can remember. Much more research needs to be done here. - Even though all these techniques are flawed in some way or another, we hope that by deploying them we increase the cost of the attacker. If a few of these techniques are implemented, a phishing attacker will have to spend time generating similar visualizations, because she does not know whether the user actually looks at them and which one the user prefers. Also, this feature only requires a TBB addon/patch and no modifications to the Tor protocol whatsoever, which makes it slightly easier to prototype and experiment with. - On the other hand, this might be a terrible idea for multiple reasons. From the UX perspective, it will confuse people who don't expect to see crazy visuals or poems on their browser. Our hope here is that this feature will be hidden by most users, and will only be used by people who understand it. However, this exact logic is what causes bad UI. Also, from a security perspective this might encourage people to not spend time to verify the whole onion address (currently 16 chars, but will be extended to 54 chars or so with prop224), and instead rely on the stupid randomart. Some real UX research needs to be done here, before we decide something terrible. - Finally, a positive thing with this idea is that it nicely complements directories of onion addresses like search engines and human-memorable systems. In the future, people who visit the same onion address using a search engine all the time, will have an extra way of verifying its authenticity. In any case, this is just a crazy pants idea, so please send your feedback to make it more useful, or to kill it completely! Cheers!~ [0]: http://undeadly.org/cgi?action=article&sid=20080615022750 http://users.ece.cmu.edu/~adrian/projects/validation/validation.pdf [1]: http://www.eecs.berkeley.edu/~tygar/papers/Phishing/Battle_against_phishing… [2]: http://www.dirk-loss.de/sshvis/drunken_bishop.pdf

9 11

Design for onionsite certification and use with Let's Encrypt
by Paul Syverson 26 Aug '15

26 Aug '15

Hi Alec, Seth, Peter, Mike, all, I'm enthused about the progress Alec reported about the Onion RFC for certs for onion addresses in recent tor-dev posts and elsewhere. I wanted to further discuss a design for binding .onion addresses with registered (route-insecure) addresses. This ties in to in-person discussions had with Seth, Peter, and Mike back in June about how this all dovetails with Let's Encrypt and Tor Browser, which is why I am also addressing this message to them directly. I hope they can comment on whether this design seems realistic in that regard and any major caveats, stumbling blocks, etc. I'll start with a description of goals and complementarity comments about readability of onion addresses themselves, and other recent tor-dev discussion topics. I did a partially related post to tor-assistants on one-sided onion services back in June that covered perhaps too many alternatives concerning onion services and too many goals and too much of the motivation, and none of that adequately separated. I think it left most scratching their heads. This is an attempt to be a bit narrower and hopefully clearer. Those not interested in even the briefly described motivations and background set out here can skip below to the high-level design itself. Goals, Caveats, Complementarity to other recently discussed related topics A main goal is to give people a way to provide route-secure access to their websites in somewhat the same way that the current certificate and https protocol infrastructure lets them provide data-secure access to their website. I would really like to have a version of this be an offering as part of obtaining a certificate from Let's Encrypt because I would like it to encourage people to offer route-secure versions of their sites in the same way that Let's Encrypt as currently put forth is meant to encourage them to offer data-secure versions of their sites. Having this built into something like Let's Encrypt should make it easy for users to set up onionsites to provide security for their websites. The design should to be neutral between double onion services (services where connections involve a Tor circuit from the client and a Tor circuit from the server, such as the currently deployed design) and single onion services (basically just having a Tor circuit from the client). There's a draft Tor Proposal by John Brooks, Roger Dingeldine, and me on single onion services that I believe John should be making available soon, but I want to leave such details aside. I'm taking single onion services as the paradigmatic typical case, but unless it creates a big problem I would like to assume both single and double onion services will be compatible. Obviously an onion service tied to a registered domain doesn't cover many important uses of onion services, but it should cover many existing use cases. Note also that wanting to offer network-location protection for a service can be compatible with having a registered domain name for that service (and whether or not there was any attempt to obscure information about the registrant of the domain name). In some cases it is not compatible, but not necessarily. I think this is basically complementary to ways to make onion addresses more readable, recognizable. I'm OK with whatever an address is that will be acceptable to the RFC and that maintains the current self-authenticating property (not getting into quibbles about computational strength of that self-authentication), as long as it remains something that will fit into a cert as described below. I'm also leaving as an extension mentioned at the end below, offering an onion service for someone's site but not associated with a domain name she has registered. (E.g. an onionsite tied to Mary's Wordpress Blog, with, e.g., the goal being more about guarantees of binding to Mary than about guarantees of binding Wordpress.) I think that is another important and useful case, which we discussed in our W2SP paper, but I'd like to mostly leave it aside for now. High-level Design Creating the DV Cert At least the same DV level of checking should occur as for existing registered domain names. So the email check should include the onion name that is being bound as well as the route-insecure name(s). For simplicity, I am assuming a single onion address and possibly a small number of registered domain names, although I'm guessing doing this for a similarly small number of onion addresses might be made to work as well. (I'm assuming no wildcards, but maybe I'm not being ambitious enough.) Besides a check at the registered-domain name(s) a check should also be made that the onionsite verifies association with the registered-domain site(s). It is not as reasonable to assume email infrastructure exists corresponding to the onion address is in place. Instead a validation query protocol will be needed that simply connects to the onionsite and asks if it is acceptable to certify association of the onionsite with the registered-domain(s). Only if all DV checks complete successfully should the CA be willing to issue the Cert. The cert obtained will have the onion address listed as a SAN (subjectAltName) in the certificate. Connecting to an onionsite by the client I assume that the default HTTPS-everywhere ruleset will be updated to include a direction of route-insecure addresses to onion addresses for sites that hold appropriate certificates. It would be reasonable to have this update occur initially along with the certification process. HTTPS-everywhere rules should differentiate whether they are being requested by Tor Browser or another browser. If by Tor Browser, I assume(?) the redirection is straightforward: If a Tor-Browser request is to connect to a route-insecure address, HTTPS-everywhere should redirect this to an onion address. At that point everything should proceed as normal for connecting to an onion address. If another browser it could be a setup config option whether clients can choose to be redirected via tor2web or simply always sent to a route-insecure address. I will assume for simplicity that all requests for route-insecure addresses by other browsers simply send to a route-insecure HTTPS address in the ruleset (if available). I'm going to also assume that requests for onion addresses for other browsers simply fail, although if the tor2web option was available and chosen at the time of setup, then there is another question how to offer this to the client, perhaps as an HTTPS Everywhere setting. Comments on the feasibility, usefulness, design etc. of the tor2web option would be bonus, but of course I'm most wanting to know about the viability of the most basic version of things. If the Tor-Browser request is to connect to an onion address, proceed as normal except that it can now be redirected by HTTPS Everywhere to an https connection to the address. Certified connection to such an onionsite should work and be indicated as normal for any site with a DV Cert. End basic description Web of trust extension W had suggested in the w2sp paper that people could bind their route-insecure address to their onion address with a gpg key. One rationale is that there is an existing web of trust that can be leveraged, and existing mechanisms to do the verification. This would allow not just securing of human-meaningful addresses and connections but also certification by more human-meaningful trust relations than the usual CA. It also allows things like binding a wordpress blog to an onion address as mentioned above so people need not have a registered domain to have a human-meaningful address for a route-insecure site for which they would like to offer a route-secure alternative. Drawbacks include: 1. There is no simple automated significant infrastructure to support this. The Monkeysphere plugin is out there, and would probably be leveraged to support something like this, but... 2. PGP/GPG remains something of a geek tool. That is possibly changing slowly, but perhaps it would be better not to wait for that. Also, it's yet another thing to learn about, so... If onion keys could be themselves linked in a PGP-like web of trust, then this could be more directly relevant and meaning to people operating on the web, especially those unfamiliar with PGP-like notions. This would of course require things like the check and indication being either built into the browser or as a plugin. And it would similarly for people deciding when to sign another's key require an easy interface and easy to understand criteria as well as mechanisms for that to all happen securely. I think this holds more hope for successful widespread web of trust to complement the X.509 type trust hierarchy that the PGP plan would support. How to decide whether a site is trusted depending what each of these trust mechanisms indicate would also need to be worked out and might again be configurable with standard defaults.

3 3

Video of my presentation on domain fronting (PETS 2015)
by David Fifield 26 Aug '15

26 Aug '15

My presentation on domain fronting (the meek pluggable transport in Tor), which I gave at PETS 2015 on June 30, 2015, is online. This page has the video and a copy of the slides. It is about 17 minutes long. https://www.bamsoftware.com/talks/fronting-pets2015/ Here is the paper on which the talk is based, by Chang Lan, Rod Hynes, Percy Wegmann, Vern Paxson, and me: https://www.bamsoftware.com/papers/fronting/

1 0

[Measurement Team] Next IRC meeting happens on Wednesday, Aug 26, 14:00 UTC in #tor-project
by Karsten Loesing 25 Aug '15

25 Aug '15

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hello list, This is an announcement/reminder that there will be an IRC meeting of the Measurement Team on Wednesday, August 26, 2015, 14:00 UTC in #tor-project https://www.timeanddate.com/worldclock/fixedtime.html?iso=20150826T14 Talk to you tomorrow! All the best, Karsten -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 Comment: GPGTools - http://gpgtools.org iQEcBAEBAgAGBQJV3IStAAoJEJD5dJfVqbCr0NYIAK00hHH1HjxkjNGyjnJuAfyV 6XpSzI4zGLPNuuG5+rap3yGnYo/LgsvE4mfGfMGIfk4FWJ6mEC//rh0b/F6BgDsm lKfIG4FBaPkkjWHn/jTPfbSdHSc/6P3tXjM4M2ZJ1Kj28axmD3nIwAP7miRRQK5C fEq5WuKpmcW++rtJfuGml10pqOtMkbjgiTK41myVSqbWd4rdgix9A6siUcWY9Mkd ZDltyth1hDXuhDpmtBz3RuN6s4901KU6cc3ZrOk3mVUG/Eos6lfpThVkcIpRIUxz XrWPtQxUxBqOe2GuID/0pvZK4/n7R/nDldrOJ+QKd3ST5rgAVu2Q8CYo1a9YYoY= =qYpH -----END PGP SIGNATURE-----

1 0

[PATCH] Log malformed hostnames in socks5 request respecting SafeLogging
by Andreas Stieger 25 Aug '15

25 Aug '15

Hello, I found a warning-level message in socks5 code relating to malformed hostnames that did not respect the SafeLogging setting, breaking the rule of least surprise. Please review the attached simple patch. Andreas -- Andreas Stieger <astieger(a)suse.com> Project Manager Security SUSE Linux GmbH, GF: Felix Imendörffer, Jane Smithard, Graham Norton, HRB 21284 (AG Nürnberg)

2 3

Updated aggregated data served by Metrics
by Karsten Loesing 25 Aug '15

25 Aug '15

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hi devs, if you're fetching .csv files from Metrics or if you're interested in discussing future .csv files served by Metrics you should read on. (And if you're surprised that Metrics serves .csv files at all and want to learn more, tick the "Advanced" box under "Level" and take a look at all the pages of type "Data".) I just deployed a new data-aggregating module on Metrics that produces the .csv file here: https://metrics.torproject.org/connbidirect2-data.html That .csv file replaces the following .csv file which will go away in the future: https://metrics.torproject.org/connbidirect-data.html The main difference between the two files is that the new file contains daily aggregates whereas the old file contained raw statistics as reported by relays, which is why I added the aggregation step. So, that's news number one: if you're currently using that file for any reason, please let me know, and I'll try to help you generate the same data from CollecTor's data yourself. But the main reason for changing the format is that I wanted to separate the code to extract and aggregate statistics into a new Metrics module for better maintenance. And here's news number two: I'm planning to do the same with the following three .csv files: https://metrics.torproject.org/servers-data.html https://metrics.torproject.org/bandwidth-data.html https://metrics.torproject.org/torperf-data.html If you have any ideas for improving those data formats or adding closely related data while doing so, please let me know. Also, if you have ideas for adding new .csv files and new graphs based on them, I'd want to learn about that. Note that I might not be able to include all suggestions. But now's a much better time to make them than when I'm done replacing those three .csv files. (I'll also look through open Trac tickets before writing any new code.) Thanks! All the best, Karsten -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 Comment: GPGTools - http://gpgtools.org iQEcBAEBAgAGBQJV3DoyAAoJEJD5dJfVqbCroRgIAKL8lV6MkY+NQZcE7PkuVxzl lN/GadzzQVgN0bXzRw/qu10ds8yq7R3ir3z85OH2ojHxrSzrqK+7oZPpdhSELEvf jTE5Elr60G1YOGq1bw84v1eUoOnu4BfQOanPaIVG8Q8jzPCiIbGRhVOaWwR32gSf MFVphGwAjB+quz4I+63aPC/EPo0420QwnGSAEKpQiU4Cg2FJmj4NWGO/gkoQ0Xor 5hjJQGHKiwtzSUfiV+kGBaz65XPTLZv0od/IP6tCk6FAU8T1IphhANx8ZmWmlJas WlpoUzW+rRUQRY9bjkfDxRW5dRxt2EXTvoLLMlElUtnyCferX1g27TJQhwWjXNI= =n1mW -----END PGP SIGNATURE-----

1 0

Proposal: Padding for netflow record resolution reduction
by Mike Perry 25 Aug '15

25 Aug '15

Filename: xxx-netflow-padding.txt Title: Padding for netflow record resolution reduction Authors: Mike Perry Created: 20 August 2015 Status: Draft 0. Motivation It is common practice by many ISPs to record data about the activity of endpoints that use their uplink, if nothing else for billing purposes, but sometimes also for monitoring for attacks and general failure. Unfortunately, Tor node operators typically have no control over the data recorded and retained by their ISP. They are often not even informed about their ISP's retention policy, or the associated data sharing policy of those records (which tends to be "give them to whoever asks" in practice[1]). It is also likely that defenses for this problem will prove useful against proposed data retention plans in the EU and elsewhere, since these schemes will likely rely on the same technology. 0.1. Background At the ISP level, this data typically takes the form of Netflow, jFlow, Netstream, or IPFIX flow records. These records are emitted by gateway routers in a raw form and then exported (often over plaintext) to a "collector" that either records them verbatim, or reduces their granularity further[2]. Netflow records and the associated data collection and retention tools are very configurable, and have many modes of operation, especially when configured to handle high throughput. However, at ISP scale, per-flow records are very likely to be employed, since they are the default, and also provide very high resolution in terms of endpoint activity, second only to full packet and/or header capture. Per-flow records record the endpoint connection 5-tuple, as well as the total number of bytes sent and received by that 5-tuple during a particular time period. They can store additional fields as well, but it is primarily timing and bytecount information that concern us. When configured to provide per-flow data, routers emit these raw flow records periodically for all active connections passing through them based on two parameters: the "active flow timeout" and the "inactive flow timeout". The "active flow timeout" causes the router to emit a new record periodically for every active TCP session that continuously sends data. The default active flow timeout for most routers is 30 minutes, meaning that a new record is created for every TCP session at least every 30 minutes, no matter what. This value can be configured to be from 1 minute to 60 minutes on major routers. The "inactive flow timeout" is used by routers to create a new record if a TCP session is inactive for some number of seconds. It allows routers to avoid the need to track a large number of idle connections in memory, and instead emit a separate record only when there is activity. This value ranges from 10 seconds to 600 seconds on common routers. It appears as though no routers support a value lower than 10 seconds. 0.2. Default timeout values of major routers For reference, here are default values and ranges (in parenthesis when known) for common routers, along with citations to their manuals. Some routers speak other collection protocols than Netflow, and in the case of Juniper, use different timeouts for these protocols. Where this is known to happen, it has been noted. Inactive Timeout Active Timeout Cisco IOS[3] 15s (10-600s) 30min (1-60min) Cisco Catalyst[4] 5min 32min Juniper (jFlow)[5] 15s (10-600s) 30min (1-60min) Juniper (Netflow)[6,7] 60s (10-600s) 30min (1-30min) H3C (Netstream)[8] 60s (60-600s) 30min (1-60min) Fortinet[9] 15s 30min MicroTik[10] 15s 30min 1. Proposal Overview The combination of the active and inactive netflow record timeouts allow us to devise a low-cost padding defense that causes what would otherwise be split records to "collapse" at the router even before they are exported to the collector for storage. So long as a connection transmits data before the "inactive flow timeout" expires, then the router will continue to count the total bytes on that flow before finally emitting a record at the "active flow timeout". This means that for a minimal amount of padding that prevents the "inactive flow timeout" from expiring, it is possible to reduce the resolution of raw per-flow netflow data to the total amount of bytes send and received in a 30 minute window. This is a vast reduction in resolution for HTTP, IRC, XMPP, SSH, and other intermittent interactive traffic, especially when all user traffic in that time period is multiplexed over a single connection (as it is with Tor). 2. Implementation Tor clients currently maintain one TLS connection to their Guard node to carry actual application traffic, and make up to 3 additional connections to other nodes to retrieve directory information. We propose to pad only the client's connection to the Guard node, and not any other connection. We propose to treat Bridge node connections to the Tor network as client connections, and pad them, but otherwise not pad between normal relays. Both clients and Guards will maintain a timer for all application (ie: non-directory) TLS connections. Every time a non-padding packet is sent or received by either end, that endpoint will sample a timeout value from between 4 seconds and 14 seconds. If the connection becomes active for any reason before this timer expires, the timer is reset to a new random value between 4 and 14 seconds. If the connection remains inactive until the timer expires, a single CELL_PADDING cell will be sent on that connection. In this way, the connection will only be padded in the event that it is idle. 2.1. Tunable parameters We propose that the defense be controlled by the following consensus parameters: * nf_ito_low - The low end of the range to send padding when inactive, in ms. - Default: 4000 * nf_ito_high - The high end of the range to send padding, in ms. - Default: 14000 * nf_pad_relays - If set to 1, we also pad inactive relay-to-relay connections - Default: 0 * conn_timeout_low - The low end of the range to decide when we should close an idle connection (not counting padding). - Default: 900 seconds after last circuit closes * conn_timeout_high - The high end of the range to decide when we should close an idle connection. - Default: 1800 seconds after last circuit close If nf_ito_low == nf_ito_high == 0, padding will be disabled. 2.2. Maximum overhead bounds With the default parameters, we expect a padded connection to send one padding cell every 8 seconds (see Appendix A for the statistical analysis of expected padding packet rate on an idle link). This averages to 63 bytes per second, assuming a 512 byte cell and 55 bytes of TLS+TCP+IP headers. For a connection that remains idle for a full 30 minutes of inactivity, this is about 112KB of overhead. With 2.5M completely idle clients connected simultaneously, 63 bytes per second still amounts to only 157MB/second network-wide, which is roughly 1.5X the current amount of Tor directory traffic[11]. Of course, our 2.5M daily users will neither be connected simultaneously, nor entirely idle, so we expect the actual overhead to be much lower than this. If we choose to set the range such it is no longer even possible to configure an inactive timeout low enough such that a new record would be generated, (for example: 6.5 to 9.5 seconds for an average of 8 seconds), then the maximum possible overhead is 70 bytes/second, 125KB per connection, and 175MB/sec network-wide. 2.3. Measuring actual overhead To measure the actual padding overhead in practice, we propose to export the following statistics in extra-info descriptors for the previous (fixed, non-rolling) 24 hour period: * Total cells read (padding and non-padding) * Total cells written (padding and non-padding) * Total CELL_PADDING cells read * Total CELL_PADDING cells written * Total RELAY_COMMAND_DROP cells read * Total RELAY_COMMAND_DROP cells written These values will be rounded to 100 cells each, and no values are reported if the relay has read or written less than 10000 cells in the previous period. RELAY_COMMAND_DROP cells are circuit-level padding not used by this defense, but we may as well start recording statistics about them now, too, to aid in the development of future defenses. 2.4. Load balancing considerations Eventually, we will likely want to update the consensus weights to properly load balance the selection of Guard nodes that must carry this overhead. We propose that we use the extra-info documents to get a more accurate value for the total average Guard and Guard+Exit node overhead of this defense in practice, and then use that value to fractionally reduce the consensus selection weights for Guard nodes and Guard+Exit nodes, to reflect their reduced capacity relative to middle nodes. 3. Threat model and adversarial considerations This defense does not assume fully adversarial behavior on the part of the upstream network administrator, as that administrator typically has no specific interest in trying to deanonymize Tor, but only in monitoring their own network for signs of overusage, attack, or failure. Therefore, in a manner closer to the "honest but curious" threat model, we assume that the netflow collector will be using standard equipment not specifically tuned to capturing Tor traffic. We want to reduce the resolution of logs that are collected incidentally, so that if they happen to fall into the wrong hands, we can be more certain will not be useful. We feel that this assumption is a fair one because correlation attacks (and statistical attacks in general) will tend to accumulate false positives very quickly if the adversary loses resolution at any observation points. It is especially unlikely for the the attacker to benefit from only a few high-resolution collection points while the remainder of the Tor network is only subject to connection-level netflow configuration data retention, or even less data retention than that. Nonetheless, it is still worthwhile to consider what the adversary is capable of, especially in light of looming data retention regulation. Because no major router appears to have the ability to set the inactive flow timeout below 10 seconds, it would seem as though the adversary is left with three main options: reduce the active record timeout to the minimum (1 minute), begin logging full packet and/or header data, or develop a custom solution. It is an open question to what degree these approaches would help the adversary, especially if only some of its observation points implemented these changes. 3.1 What about sampled data? At scale, it is known that some Internet backbone routers at AS boundaries and exchanges perform sampled packet header collection and/or produce netflow records based on a subset of the packets that pass through their infrastructure. The effects of this against Tor were studied before against the (much smaller) Tor network as it was in 2007[12]. At sampling rate of 1 out of every 2000 packets, the attack did not achieve high accuracy until over 100MB of data were transmitted, even when correlating only 500 flows in a closed-world lab setting. We suspect that this type of attack is unlikely to be effective at scale on the Tor network today, but we make no claims that this defense will make any impact upon sampled correlation, primarily because the amount of padding that this defense introduces is comparatively low relative to the amount of transmitted traffic that sampled correlation attacks require to attain any accuracy. 3.2. What about long-term statistical disclosure? This defense similarly does not claim to defeat long-term correlation attacks involving many observations over large amounts of time. However, we do believe it will significantly increase the amount of traffic and the number of independent observations required to attain the same accuracy if the adversary uses default per-flow netflow records. 3.3. What about prior information/confirmation? In truth, the most dangerous aspect of these netflow logs is not actually correlation at all, but confirmation. If the adversary has prior information about the location of a target, and/or when and how that target is expected to be using Tor, then the effectiveness of this defense will be very situation-dependent (on factors such as the number of other tor users in the area at that time, etc). In any case, the odds that there is other concurrent activity (to create a false positive) within a single 30 minute record are much higher than the odds that there is concurrent activity that aligns with a subset of a series of smaller, more frequent inactive timeout records. 4. Synergistic effects with future padding and other changes Because this defense only sends padding when the OR connection is completely idle, it should still operate optimally when combined with other forms of padding (such as padding for website traffic fingerprinting and hidden service circuit fingerprinting). If those future defenses choose to send padding for any reason at any layer of Tor, then this defense automatically will not. In addition to interoperating optimally with any future padding defenses, simple changes to Tor network usage can serve to further reduce the usefulness of any data retention, as well as reduce the overhead from this defense. For example, if all directory traffic were also tunneled through the main Guard node instead of independent directory guards, then the adversary would lose additional resolution in terms of the ability to differentiate directory traffic from normal usage, especially when it is occurs within the same netflow record. As written and specified, the defense will pad such tunneled directory traffic optimally. Similarly, if bridge guards[13] are implemented such that bridges use their own guard node to route all of their connecting client traffic through, then users who run bridges bridges will also benefit from the concurrent traffic of their connected clients, which will also be optimally padded when it is concurrent with their own. Appendix A: Padding Cell Timeout Distribution Statistics It turns out that because the padding is bidirectional, and because both endpoints are maintaining timers, this creates the situation where the time before sending a padding packet in either direction is actually min(client_timeout, server_timeout). If client_timeout and server_timeout are uniformly sampled, then the distribution of min(client_timeout,server_timeout) is no longer uniform, and the resulting average timeout (Exp[min(X,X)]) is much lower than the midpoint of the timeout range. To compensate for this, instead of sampling each endpoint timeout uniformly, we instead sample it from max(X,X), where X is uniformly distributed. If X is a random variable uniform from 0..R-1 (where R=high-low), then the random variable Y = max(X,X) has Prob(Y == i) = (2.0*i + 1)/(R*R). Then, when both sides apply timeouts sampled from Y, the resulting bidirectional padding packet rate is now third random variable: Z = min(Y,Y). The distribution of Z is slightly bell-shaped, but mostly flat around the mean. It also turns out that Exp[Z] ~= Exp[X]. Here's a table of average values for each random variable: R Exp[X] Exp[Z] Exp[min(X,X)] Exp[Y=max(X,X)] 5000 2499.5 2662 1666.2 3332.8 6000 2999.5 3195 1999.5 3999.5 10000 4999.5 5328 3332.8 6666.2 15000 7499.5 7995 4999.5 9999.5 20000 9900.5 10661 6666.2 13332.8 In this way, we maintain the property that the midpoint of the timeout range is the expected mean time before a padding packet is sent in either direction. 1. https://lists.torproject.org/pipermail/tor-relays/2015-August/007575.html 2. https://en.wikipedia.org/wiki/NetFlow 3. http://www.cisco.com/en/US/docs/ios/12_3t/netflow/command/reference/nfl_a1g… 4. http://www.cisco.com/c/en/us/support/docs/switches/catalyst-6500-series-swi… 5. https://www.juniper.net/techpubs/software/erx/junose60/swconfig-routing-vol… 6. http://www.jnpr.net/techpubs/en_US/junos15.1/topics/reference/configuration… 7. http://www.jnpr.net/techpubs/en_US/junos15.1/topics/reference/configuration… 8. http://www.h3c.com/portal/Technical_Support___Documents/Technical_Documents… 9. http://docs-legacy.fortinet.com/fgt/handbook/cli52_html/FortiOS%205.2%20CLI… 10. http://wiki.mikrotik.com/wiki/Manual:IP/Traffic_Flow 11. https://metrics.torproject.org/dirbytes.html 12. http://freehaven.net/anonbib/cache/murdoch-pet2007.pdf 13. https://gitweb.torproject.org/torspec.git/tree/proposals/188-bridge-guards.… -- Mike Perry

3 2