[tor-dev] Proposal draft: Better hidden service stats from Tor relays

[A. Johnson]

Hi George,

I recommend a change to the way that these statistics are obfuscated. The problem is that new noise is used every day, and from the distribution of the reported bins, the exact location within the bin (assuming the stat stats constant) can be reported.

So instead of this

>                   +--------------+    +--------------------+
>   actual value -> |additive noise| -> |round-up obfuscation| -> public statistic
>                   +--------------+    +——————————+

I recommend that you flip the order, so that it is like this
                  +--------------+    +--------------------+
  actual value -> |round-up obfuscation| -> |additive noise| -> public statistic
                  +--------------+    +——————————+

“Additive noise” in the context of bins is actually just a distribution over bins. You can think of it in two ways:
  1. Add Laplace noise to the bin center, and then report the bin of the resulting number.
  2. Choose a bin using a two-sided geometric distribution centered at the correct bin.
I believe that these are equivalent.

Best,
Aaron