[tor-dev] Timing of opening pre-emptive circuits?
jeremyrand at airmail.cc
Wed Sep 18 21:35:48 UTC 2019
-----BEGIN PGP SIGNED MESSAGE-----
I'm curious what the timing is of Tor's opening of preemptive circuits.
Specifically, consider the following attack:
1. A new stream is assigned to a clean circuit.
2. Because of the above, that clean circuit is now a dirty circuit.
3. Because of the above, the number of clean circuits is now decreased
4. Because of the above, the number of clean circuits is now lower than
the number that Tor wants to have open.
5. Because of the above, Tor opens a new preemptive circuit.
6. An attacker who can observe the circuit in (1) and the circuit in (5)
can deduce by temporal proximity that those 2 circuits belong to the
This attack seemed obvious enough to me that I assumed that Tor must
have some kind of countermeasure to it, e.g. random delays in opening
preemptive circuits. However, the tor-path specification doesn't
mention any such countermeasure, and based on a brief search through the
Tor source code, all I can find is that Tor opens preemptive circuits
using a function that always gets called once per second (with no
mention of any delay beyond that one-second interval, random or
So, does Tor make any effort to mitigate the above attack? If so, what
mitigations are present, and where would I find them (in both the spec
and the source code)? If not, is there any documented reason (e.g. "the
attack is too hard to pull off" or "we want to mitigate it but haven't
gotten to it yet") for the lack of mitigation?
- -Jeremy Rand
Lead Application Engineer at Namecoin
Mobile email: jeremyrandmobile at airmail.cc
Mobile OpenPGP: 2158 0643 C13B B40F B0FD 5854 B007 A32D AB44 3D9C
Send non-security-critical things to my Mobile with OpenPGP.
Please don't send me unencrypted messages.
My business email jeremy at veclabs.net is having technical issues at the
-----BEGIN PGP SIGNATURE-----
-----END PGP SIGNATURE-----
More information about the tor-dev