Proposal: Optionally allow exit from single-hop circuits

[Geoffrey Goodell]

Please see attached my proposed solution to address Bug 768.

Thanks!

Geoff

-------------- next part --------------
Filename: single-hop-circuits.txt
Title: Optionally allow exit from single-hop circuits
Version:
Last-Modified:
Author: Geoff Goodell
Created: 13-Jul-2008
Status: Draft

Overview

    Provide a special configuration option that adds a line to descriptors
    indicating that a router can be used as an exit for one-hop circuits, and allow
    clients to attach streams to one-hop circuits provided that the descriptor for
    the router in the circuit includes this configuration option.

Motivation

    At some point (r9735?), code was added to src/or/control.c that prevents
    controllers from attaching streams to one-hop circuits.  The idea seems to be
    that we can use the cost of forking and maintaining a patch as a lever to
    prevent people from writing controllers that jeopardize the operational
    security of routers and the anonymity properties of the Tor network by creating
    and using one-hop circuits rather than the standard three-hop circuits.  It may
    be, for example, that some users do not actually seek true anonymity but simply
    reachability through network perspectives afforded by the Tor network, and
    since anonymity is stronger in numbers, forcing users to contribute to
    anonymity and decrease the risk to server operators by using full-length paths
    may be reasonable.

    Whether or not we agree that the particular approach of using hardcoded,
    immutable policy in the Tor client to limit self-determinism on the part of
    clients is the right way to address the risks posed by one-hop circuit
    utilization (for example, I think that routers ought to take responsibility for
    ensuring that they are not allowing exit from one-hop circuits), it remains
    true that as presently implemented, the sweeping restriction of one-hop
    circuits for all routers limits the usefulness of Tor as a general-purpose
    technology for building circuits.  In particular, we should allow for
    controllers, such as Blossom, that create and use single-hop circuits involving
    routers that are not part of the Tor network.

Design

    Introduce a configuration option for Tor servers that, when set, indicates that
    a router is willing to provide exit from one-hop circuits.  Routers with this
    policy will not require that a circuit has at least two hops when it is used as
    an exit.

    In addition, routers for which this configuration option has been set will have
    a line in their descriptors, "opt exit-from-single-hop-circuits".  Clients will
    keep track of which routers have this option and allow streams to be attached
    to single-hop circuits including such routers.

Security Considerations

    This approach seems to eliminate the worry about operational router security,
    since server operators will not set the configuraiton option unless they are
    willing to take on such risk.  

    To reduce the impact on anonymity of the network resulting from including such
    "risky" routers in regular Tor path selection, clients may systematically
    exclude routers with "opt exit-from-single-hop-circuits" when choosing random
    paths through the Tor network.

-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 189 bytes
Desc: Digital signature
URL: <http://lists.torproject.org/pipermail/tor-dev/attachments/20080713/dc843b7a/attachment.pgp>