[tor-relays] DoSer is back, Tor dev's please consider

[starlight.2017q4 at binnacle.cx]

At 03:20 3/23/2018 +0000, tor <tor at anondroid.com> wrote:
>> Suggestion: DoSCircuitCreationMinConnections=1 be established in consensus
>
>The man page for the above option says:
>
>"Minimum threshold of concurrent connections before a client address can be flagged as executing a circuit creation DoS. In other words, once a client address reaches the circuit rate and has a 
>minimum of NUM concurrent connections, a detection is positive. "0" means use the consensus parameter. If not defined in the consensus, the value is 3. (Default: 0)"
[snip]
>
>Am I misunderstanding?

"concurrent connections" refers to concurrent TCP+TLS network layer connections, not to Tor circuits--nominally one-connection-per-peer IP.  It means the excess circuit-extend rate logic does not kick in at all until at least N TCP connections from a particular IP exist.  Once the configured number of TCP connections is present, the circuit extend rate is examined.

An adversary who stays under the configured limit (presently three) can extend circuits at extreme rates on (two) TCP connections.  Adversary must marshal a larger number of IP addresses than previously to obtain the same effect and this raises the cost of attack, but they may still cause significant trouble as my relay's statistics demonstrate.