[tor-bugs] #10777 [Tor]: Remotely triggerable circuit destruction by path bias code

[Tor Bug Tracker & Wiki]

#10777: Remotely triggerable circuit destruction by path bias code
-----------------------------+-----------------------------------
     Reporter:  cypherpunks  |      Owner:
         Type:  defect       |     Status:  closed
     Priority:  major        |  Milestone:  Tor: 0.2.4.x-final
    Component:  Tor          |    Version:
   Resolution:  fixed        |   Keywords:  tor-client regression
Actual Points:               |  Parent ID:
       Points:               |
-----------------------------+-----------------------------------

Comment (by mikeperry):

 Replying to [comment:21 cypherpunks]:
 > >We only return INTERNAL if the decryption itself fails, not for
 unrecognized. Still digging for other cases...
 > All working end stream reasons can be sent only after success relay cell
 decryption. Exit or AP can't to send relay_end if digest or 'recognized'
 field was wrong. Any STREAM END reason, including
 END_STREAM_REASON_INTERNAL and END_STREAM_REASON_TORPROTOCOL. Exit sends
 end stream (it's not circuit!) only if plain text was invalid for some
 reasons.
 >
 > If you believe tagging attack can be undetectable by honest exit node
 during digest checking, why do you think checking end stream reason have
 any sense?

 I don't think that. I was asking if Nick might think that. I think we're
 both going on the assumption that the recognized digest is strong enough
 to trust for this purpose, and so it is fine to remove the INTERNAL
 response. I did not check that there are no other ways to generate the
 other reasons though. It seems like you might be able get TORPROTOCOL if
 you messed with a relay cell such that it didn't cause the circuit to
 fail.

 Causing the stream to fail such that it is retried on a new circuit
 (without failing the old one) is still a source for path bias, though.
 Even if Tor doesn't retry that stream, there is a high likelihood that the
 client will.

--
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/10777#comment:26>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online