[tor-bugs] #2668 [Tor Relay]: Rate limit RELAY_EARLY and TLS by IP

Tor Bug Tracker & Wiki torproject-admin at torproject.org
Mon Mar 7 01:25:42 UTC 2011


#2668: Rate limit RELAY_EARLY and TLS by IP
-----------------------+----------------------------------------------------
 Reporter:  mikeperry  |          Owner:       
     Type:  defect     |         Status:  new  
 Priority:  normal     |      Milestone:       
Component:  Tor Relay  |        Version:       
 Keywords:             |         Parent:  #2664
   Points:             |   Actualpoints:       
-----------------------+----------------------------------------------------
Description changed by mikeperry:

Old description:

> It is possible to execute an amplification attack on the Tor network
> and/or the directory authorities by launching many onionskin and tls
> attempts to each relay. These onion skins do not have to be valid, and
> can be replays: their only purpose would be to induce a relay to perform
> the PK step to attempt to decrypt them. Such an amplification attack can
> be used to consume all of the spare CPU of a relay.
>
> One solution would be to rate limit RELAY_EARLY and TLS connections by IP
> address as opposed to by only circuit.

New description:

 It is possible to execute an amplification attack on the Tor network
 and/or the directory authorities by launching many onionskin and tls
 attempts to each relay. These onion skins do not have to be valid, and can
 be replays: their only purpose would be to induce a relay to perform the
 PK step to attempt to decrypt them. Such an amplification attack can be
 used to consume all of the spare CPU of a relay.

 One solution would be to rate limit RELAY_EARLY and TLS connections by IP
 address as opposed to by only circuit.

 This ticket is meant as a place for the discussion for the creation of a
 proper Tor proposal for this behavior.

--

-- 
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/2668#comment:1>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online


More information about the tor-bugs mailing list