Re: [tor-talk] 'relay early' attack logging at the infrastructure level?

[Roger Dingledine <arma@xxxxxxx>]

On Fri, Aug 01, 2014 at 09:37:02PM +0000, Nusenu wrote:
> > On July 30th, 2014 arma said: It will indeed kill circuits if it 
> > sees an inbound (towards the client) relay_early cell.
> > 
> > It doesn't have to decrypt the stream to see it, because whether a
> >  cell is relay or relay_early is a property of the (per hop) link, 
> > not a property of the (end-to-end) stream.
> 
> Does a patched relay also create a log entry as soon as it "kills" the
> circuit or is logging only happening on tor instances acting as clients?

The patched relay also does a log message, yes.

But the relay can only see its immediate neighbor in the circuit, so it
will only log that. Whether the attacking relay is that (adjacent) one,
or one farther on the circuit, isn't something your relay can learn.

--Roger

-- 
tor-talk mailing list - tor-talk@xxxxxxxxxxxxxxxxxxxx
To unsubscribe or change other settings go to
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-talk