[tor-dev] Hidden Service Scaling

[Michael Rogers]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

On 08/05/14 14:40, Christopher Baines wrote:
>> Perhaps it would make sense to pick one or more IPs per guard,
>> and change those IPs when the guard is changed? Then waldo's
>> attack by a malicious IP would only ever discover one guard.
> 
> If you change the IP's when the guard is changed, this could break
> the consistency between different instances of the same service
> (assuming that the different instances are using different
> guards).

It should be possible to avoid breaking consistency by having an
overlap period: when a guard is scheduled to be replaced, each
instance connects to a new guard and IPs, the new descriptor is
published, then each instance disconnects from the old guard and IPs.

This should work whether or not the instances use the same guards. If
the instances use the same guards, waldo's attack can discover one
guard shared by all instances; otherwise it can discover one guard per
instance. I'm not sure which is worse for anonymity - any thoughts?

Cheers,
Michael
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.12 (GNU/Linux)

iQEcBAEBCAAGBQJTbJxbAAoJEBEET9GfxSfMCx0H/RLCDgFIzISTyLGZMU9rPnuB
gHmgD51bCiTDKmqCB4uYJMKl15o5RtTplLPIgnNCWz+W0x1nI+e7+6+M1IYmGGs7
cCe/wlYYMpNlN8T5DcsE/cTh3zMmWRidVsocJhV/4muZFZvihtTOHm48CHDSC86I
urVUneJJFFXZLlQQKaW9NAcvom9srdt1NiKxhHSbxbHL8kyfYl4GiPgabBDStOUh
jsJc5dgzC51mpnyOifHTL9lS0Mr05Y7WiGKMb3D0b7U3Mbc5YBEy9D7nq/4MZvW+
ScQTDaioXW5v6euF1cnmN6BH7yRJ/TKAVLD/ODrisGlDOvVI5z/a569zsbCMTdQ=
=SOAW
-----END PGP SIGNATURE-----