Paper 2018/162

Untagging Tor: A Formal Treatment of Onion Encryption

Jean Paul Degabriele and Martijn Stam

Abstract

Tor is a primary tool for maintaining anonymity online. It provides a low-latency, circuit-based, bidirectional secure channel between two parties through a network of onion routers, with the aim of obscuring exactly who is talking to whom, even to adversaries controlling part of the network. Tor relies heavily on cryptographic techniques, yet its onion encryption scheme is susceptible to tagging attacks (Fu and Ling, 2009), which allow an active adversary controlling the first and last node of a circuit to deanonymize with near-certainty. This contrasts with less active traffic correlation attacks, where the same adversary can at best deanonymize with high probability. The Tor project has been actively looking to defend against tagging attacks and its most concrete alternative is proposal 261, which specifies a new onion encryption scheme based on a variable-input-length tweakable cipher. We provide a formal treatment of low-latency, circuit-based onion encryption, relaxed to the unidirectional setting, by expanding existing secure channel notions to the new setting and introducing circuit hiding to capture the anonymity aspect of Tor. We demonstrate that circuit hiding prevents tagging attacks and show proposal 261's relay protocol is circuit hiding and thus resistant against tagging attacks.

Metadata
Available format(s)
PDF
Category
Cryptographic protocols
Publication info
Published by the IACR in EUROCRYPT 2018
Keywords
AnonymityOnion RoutingSecure ChannelsTorTagging Attacks
Contact author(s)
jpdega @ gmail com
History
2018-11-06: revised
2018-02-11: received
See all versions
Short URL
https://ia.cr/2018/162
License
Creative Commons Attribution
CC BY

BibTeX

@misc{cryptoeprint:2018/162,
      author = {Jean Paul Degabriele and Martijn Stam},
      title = {Untagging Tor: A Formal Treatment of Onion Encryption},
      howpublished = {Cryptology {ePrint} Archive, Paper 2018/162},
      year = {2018},
      url = {https://eprint.iacr.org/2018/162}
}
Note: In order to protect the privacy of readers, eprint.iacr.org does not use cookies or embedded third party content.