On the performance scalability of Tor

2007-07-18 Thread Steven Murdoch
A frequently stated problem with Tor is the poor performance and improving this is the goal of several sub-projects. One of these is to simply encourage the deployment of more Tor servers. This will increase the capacity of the network, but the consequent improvement to users is more difficult to

Sampled Traffic Analysis by Internet-Exchange-Level Adversaries

2007-05-28 Thread Steven Murdoch
Some of you might remember my email to this list in February, where I asked for help from operators of Tor nodes in the UK [1]. This was for an experiment to establish how diverse the topology of the Tor network is -- an important component of how secure it is against traffic analysis. Thanks to

Re: Sampled Traffic Analysis by Internet-Exchange-Level Adversaries

2007-05-28 Thread Steven Murdoch
On Mon, May 28, 2007 at 03:36:05AM -0700, coderman wrote: you state an assumption that the global passive adversary is unrealistic. is this really true in anonymity research circles? The convention in anonymity research is to assume a global passive adversary, since then any system shown to be

Tor experiment: request for assistance from operators of UK nodes

2007-02-17 Thread Steven Murdoch
I'm a researcher at the University of Cambridge, and I'm studying anonymous communication systems (e.g. Tor). I also operate a Tor node (ephemer) myself. Currently, I'm working on a study to discover how diverse the location of Tor nodes is on the Internet, to see how secure it is against someone

Re: Wired article on Tor

2007-01-01 Thread Steven Murdoch
On Sat, Dec 30, 2006 at 07:29:16AM -0500, Dan Collins wrote: A very interesting and unique idea, though I can't believe that the change due to a little heat would be detectable? Have a look at the graphs in the paper: http://www.cl.cam.ac.uk/~sjm217/papers/ccs06hotornot.pdf They were

Re: Wired article on Tor

2007-01-01 Thread Steven Murdoch
On Sat, Dec 30, 2006 at 09:49:01PM +0800, John Kimble wrote: If I were to set up a machine with any information worth hiding behind Tor, I wouldn't have made it accessible other than through Tor's hidden service. There has been some discussion over the pros and cons of running a Tor router on

Re: flooding attacks to discover hidden services

2007-01-01 Thread Steven Murdoch
On Tue, Jan 02, 2007 at 01:39:05AM +1100, Wikileaks wrote: Open an onion connection to the hidden service, asking for echos. Now flood each router. If the ping is overly delayed, the router is on the hidden path. This is a special case of the attack described in 5.2 of [1]. If we assume

Re: setup tor in private intranet

2006-12-01 Thread Steven Murdoch
On Thu, Nov 30, 2006 at 12:39:20PM -0700, otr comm wrote: i am new to tor and was wondering if it is possible to setup tor in a private intranet without gateways to the internet? i have to assume it is, but where would i find documentation and code to build such a system? There are

Traces left by Torpark, and other security discussion (was Re: TorPark)

2006-11-26 Thread Steven Murdoch
On Mon, Nov 13, 2006 at 03:17:31PM -0600, Arrakistor wrote: Until an official doc is produced for helping users compile and understand the choice that were made, the answer to all your questions is here: http://www.torrify.com/forum/viewtopic.php?p=1800 I was also interested in the

Mechanism for resisting targetted backdoors in Tor

2006-08-10 Thread Steven Murdoch
At the PET workshop (http://petworkshop.org/2006) I gave a brief talk on a simple idea relating to Tor. One known weakness of open source software is that, even if the source is well auditied, an attacker could still implant a backdoor in the version downloaded by one person, and have a very low