[tor-bugs] #15744 [Tor]: Is 16384 introductions a sane limit for IP rotation?

[Tor Bug Tracker & Wiki]

#15744: Is 16384 introductions a sane limit for IP rotation?
-------------------------+--------------------------------
     Reporter:  dgoulet  |      Owner:
         Type:  defect   |     Status:  new
     Priority:  normal   |  Milestone:  Tor: 0.2.8.x-final
    Component:  Tor      |    Version:
   Resolution:           |   Keywords:  SponsorR, tor-hs
Actual Points:           |  Parent ID:  #15714
       Points:           |
-------------------------+--------------------------------

Comment (by asn):

 We continued our analysis, by setting up a relay that collected
 aggregated statistics on established introduction
 circuits. Specifically, we collected an aggregated daily histogram of
 the number of introductions happening over intro circuits, as well as
 the lifetime of intro circuits.

 By doing this we were trying to answer the following questions:

   Q: What's the average number of introductions happening over intro
 circuits? Hidden services used to have a hard limit of about 16k
 introductions before rotating the intro circuit. This was recently raised
 to a random number around 25k introductions, is this better or is it too
 low/high? (#15744)

   Q: How is hidden service traffic spread? Is hidden service traffic
 concentrated on a few giant services, or is it more evenly spread out?

   Q: Are hidden services volatile? Do they stay up for days, or do they
 tend to disappear soon after they spawn?

 We collected statistics for 23 days. During our measurement period we
 encountered about 8000 introduction circuits. You can find our results
 here:
   https://trac.torproject.org/projects/tor/attachment/ticket/15744
 /introduction-circuits-2015-05-19.pdf
   https://people.torproject.org/~asn/intro_stats/lifetimes_graph.png
   https://people.torproject.org/~asn/intro_stats/intros_graph.png
   https://trac.torproject.org/projects/tor/ticket/15744

 - About 80% of introduction circuits see no introductions at all.
   90% of introduction circuits see between 0 and 49 introductions during
 their lifetime.

 - We also see that about 60% of introduction circuits only stay up for
   half an hour or less.

 - This means that a big number of hidden services are ephemeral.
   This is expected since hidden services are still early on
   their adoption phase and there are not that many users out there.
   This might also be caused by short-living protocols like Ricochet
   and Onionshare, or it might be the result of people experimenting
   with hidden services.

 - We can also see that a non-negligible amount of hidden services have
   performed 10k+ introductions, which is close to the old introduction
   point rotation limit of 16k. Hence, we believe that raising the
   limit (#15745) to about 25k introductions was the correct move.

 - Even though there is a hard limit of introductions per circuit, we
   see that there are some introduction circuits that have performed
   more than 34000 introductions. This should not be possible with any
   current version of Tor. We believe that these hidden services are
   either using an alternative Tor implementation, or they have modded
   their Tor client to allow a greater number of introductions per
   circuit.

 - We can see that some introduction circuits lasted for 25+ hours. This is
 peculiar,   since the normal lifetime of introduction circuits is maximum
 24 hours. We suspect that features like circuit cannibalization might be
 the cause of this behavior, but we need to dig into this more.

--
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/15744#comment:16>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online