Safely collecting data to estimate the number of Tor users

[Robert Ransom]

On Fri, 27 Aug 2010 09:07:45 +0200
Björn Scheuermann <scheuermann at cs.uni-duesseldorf.de> wrote:

> FM sketches have (at least) three very intriguing properties for the
> application that you outline:
> 
> 1) Since many IP addresses map to the same bit, you cannot reverse the
> operation, i.e., at least to me it seems that it would be no problem at
> all to exchange the generated bit fields between operators (or between
> operators and you), even if the used hash function, keys, etc. are
> known.

FM sketches were not designed to destroy information about which
elements were hashed into it, and they cannot be relied on to destroy
sensitive information in this application.

If an adversary knows that only one IP address with a certain hash
value could possibly be using Tor, the adversary can use an operator's
FM sketch to determine whether or not that IP address accessed the
operator's directory mirror in the FM sketch's time period.  The
tin-foil-hat crowd and their parodists will also point out that the
adversary may design the hash function to single out certain users.
(Are you enjoying that CIA time-share, Dr. Loesing?)


Robert Ransom
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 198 bytes
Desc: not available
URL: <http://lists.torproject.org/pipermail/tor-dev/attachments/20100827/b96c3efa/attachment.pgp>