New relay selection fix for Tor to spoil spooks' fun (eventually)
Quick, before Skynet takes control of the Five Eyes
Surveillance breeds conformity
Observing that "vanilla" Tor will often select paths that may be subject to an adversary that exploits asymmetric network paths for the sake of analysis, the researchers have said that they "seek to design a relay selection algorithm to mitigate the opportunities for such attackers".
"We design our relay selection system, Astoria, based on the idea of stochastic relay selection. This works by having the Tor client generate a probability distribution that minimizes the chance of attack over all possible relay selection choices, and selecting an entry and exit-relay based on this distribution."
The paper explains:
The advantage of such a stochastic selection is that if the client has no safe options, choosing randomly can be engineered to minimize the amount of information gained by a given adversary. Further, it allows clients to skew their relay selection towards relays with higher capacity.
"The paper presents very interesting ideas," Murdoch told The Reg "and in particular looks at how to defend against the latest types of attack discussed in the academic literature – those taking advantage of the fact that data sent between two computers on the net may take a different path backwards as it does forwards and so increases the potential points for surveillance."
"There have been gradual improvements of the Tor relay-selection algorithm but so far have mainly focussed on performance rather than surveillance resistance. Because a large number of people depend on Tor, before any change would be made there would need to be a convincing case made that the risk of it introducing problems is minimal."
The Register asked Steven Murdoch about the popular desire to avoid having your communications snapped up by mass-surveillance programs.
"Using encryption and using anonymous communication systems does make mass surveillance harder," he said, "but no current system is foolproof. Individuals can also ask governments to put more controls and safeguards on mass surveillance, though just because your own country isn’t spying on you doesn’t mean others won’t and so security technology still has an important role to play."
When asked what the priorities of the Tor development community were, Murdoch explained that the "developers' priorities are guided by their personal wishes, those of the very diverse groups of users, and the availability of funding so there are many ways that Tor is being considered to being improved".
He added that "Security is one of these goals, but there are also a very large number of users whose priority is censorship resistance and performance rather than resistance against sophisticated surveillance techniques."
In the UK, despite Prime Minister David Cameron's qualms about public access to cryptography, the Parliamentary Office of Science and Technology has defended public access to Tor, and it is understood the service is often used by the security services and law enforcement when they wish to use the internet anonymously. ®