[tor-dev] Introduction Points and their rotation periods (was Re: Hidden Service Scaling)

[Michael Rogers]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

On 10/05/14 21:09, George Kadianakis wrote:
> It's interesting that you say this, because we pretty much took
> the opposite approach with guard nodes. That is, the plan is to
> extend their rotation period to 9 months (from the current 2-3
> months). See: 
> https://gitweb.torproject.org/torspec.git/blob/HEAD:/proposals/236-single-guard-node.txt
>
>  I was even planning on writing an extension to rend-spec-ng.txt
> to specify how IPs should be picked and to extend their rotation 
> period. That's for the same reason we do it for entry guards:

Hi George,

Is there an analysis somewhere of why it would be better to change IPs
less frequently? I think it would be good for the performance of
mobile hidden services, but I'm concerned about the attack waldo
described eariler in this thread, in which a malicious IP breaks
circuits until the service builds a circuit through a malicious middle
node, allowing the attacker to discover the service's entry guard.

Perhaps the attack could be mitigated by keeping the same middle node
and IP for as long as possible, then choosing a new middle node *and*
a new IP when either of them became unavailable? Then a malicious IP
that broke a circuit would push the circuit onto a new IP.

However, that might require all three nodes in the circuit to be
picked from the high-uptime pool.

Cheers,
Michael
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.12 (GNU/Linux)

iQEcBAEBCAAGBQJTb5hbAAoJEBEET9GfxSfMtwUH/jFE64dbgZAsi0QM0C5htVlU
3Wz932lW9QXYxQoPw8axPZY4WjpA/XQwp7T2CZE3vpd6zgMaRAvEvmhcyefdOkD8
fBQzaL0jBILZkbNKZKTnCAF5Te4qpg/wwAnbC1v7q2c/KS806Q6+/T0FkBTcIrib
MbbHn0Cr301P1l5WMe1e7xNTArvSIiQsyVhebhNWdhbfwK20ek/YCKSdPblWVZwI
WqLr/n8EWWw2OwmPBOHKl7nZHfPQ2OJ1Q0/hoAzDg0UmaQc8qBwW+k/TlfPyMVTC
phRF8+9sIhVFYebXip2QKwM7sF5OL3CVMT80QJGlo6G2ADGD+9OFCUsx7oXUEjc=
=u2Ph
-----END PGP SIGNATURE-----