-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 On 08/05/14 14:40, Christopher Baines wrote:
Perhaps it would make sense to pick one or more IPs per guard, and change those IPs when the guard is changed? Then waldo's attack by a malicious IP would only ever discover one guard.
If you change the IP's when the guard is changed, this could break the consistency between different instances of the same service (assuming that the different instances are using different guards).
It should be possible to avoid breaking consistency by having an overlap period: when a guard is scheduled to be replaced, each instance connects to a new guard and IPs, the new descriptor is published, then each instance disconnects from the old guard and IPs. This should work whether or not the instances use the same guards. If the instances use the same guards, waldo's attack can discover one guard shared by all instances; otherwise it can discover one guard per instance. I'm not sure which is worse for anonymity - any thoughts? Cheers, Michael -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.12 (GNU/Linux) iQEcBAEBCAAGBQJTbJxbAAoJEBEET9GfxSfMCx0H/RLCDgFIzISTyLGZMU9rPnuB gHmgD51bCiTDKmqCB4uYJMKl15o5RtTplLPIgnNCWz+W0x1nI+e7+6+M1IYmGGs7 cCe/wlYYMpNlN8T5DcsE/cTh3zMmWRidVsocJhV/4muZFZvihtTOHm48CHDSC86I urVUneJJFFXZLlQQKaW9NAcvom9srdt1NiKxhHSbxbHL8kyfYl4GiPgabBDStOUh jsJc5dgzC51mpnyOifHTL9lS0Mr05Y7WiGKMb3D0b7U3Mbc5YBEy9D7nq/4MZvW+ ScQTDaioXW5v6euF1cnmN6BH7yRJ/TKAVLD/ODrisGlDOvVI5z/a569zsbCMTdQ= =SOAW -----END PGP SIGNATURE-----