Re: leaker-optimized versions of Tor

[Lucky Green <shamrock@xxxxxxxxxxxxxx>]

On 2010-12-08 06:30, Eugen Leitl wrote:
> On Wed, Dec 08, 2010 at 03:15:24PM +0100, Mitar wrote:
>> Hi!
>>
>> On Wed, Dec 8, 2010 at 2:17 PM, Eugen Leitl <eugen@xxxxxxxxx> wrote:
>>> It should default to a much larger number of hops,
>>
>> Why? Is this really necessary?
> 
> Tor as is wasn't designed to resist TLA-level adversaries (which
> have no issues instrumenting each Tor node upstream with realtime
> network probes, and dedicate enough resouces for traffic analysis).

There are no low-latency anonymizing system designs known to science
today that can protect a user's privacy against a determined, global,
TLA-level adversary. Considerable and by no means unreasonable doubt
exist in the community if such a design is even theoretically possible,
a question for which I refrain from forming an opinion solely due to the
impressive progress science has made over the millennia.

The picture is less clear when it comes to high-latency systems, such as
anonymous remailers. No rational doubt exists in the community that the
systems so far fielded fail to protect against this treat model. But the
question if we know how to design a high-latency system that defends
against the proposed threat model largely remains unanswered. This is in
part due to the fact that the bulk of recent research has focused
primarily on low-latency systems.

That said, it is my belief that if a low-latency system protecting
privacy in the face of TLA-level actors were to be identified, I suspect
the design will be based on PIR, not MIX. It is for this reason that I
encourage high-latency anonymity researchers to focus on PIR designs.

--Lucky Green
***********************************************************************
To unsubscribe, send an e-mail to majordomo@xxxxxxxxxxxxxx with
unsubscribe or-talk    in the body. http://archives.seul.org/or/talk/