Logo
ScienceStack
Table of Contents
Fetching ...
Sign In

I've Seen This IP: A Practical Intersection Attack Against Tor Introduction Circuits and Hidden Services

Nicolas Constantinides

TL;DR

A practical intersection attack on Tor introduction circuits that can, over repeated interactions, identify each hop from the introduction point toward the onion service while requiring observation at only one relay per stage is described.

Abstract

Tor onion services rely on long-lived introduction circuits to support anonymous rendezvous between clients and services. Although Tor includes some defenses against traffic analysis, the introduction protocol retains deterministic routing structure that can be leveraged by an adversary. We describe a practical intersection attack on Tor introduction circuits that can, over repeated interactions, identify each hop from the introduction point toward the onion service while requiring observation at only one relay per stage. The attack issues repeated probes and intersects destination IP address sets observed within narrowly defined \texttt{INTRODUCE1}--\texttt{RENDEZVOUS2} time windows, without assuming global visibility or access to packet payloads. We evaluate feasibility with live-network experiments using a self-operated onion service and relays, and we follow data-minimization and ethical safeguards throughout. The results show reliable convergence in practice, with the rate affected by consensus weight, and time-varying background traffic. We also assess practicality under a partial-global adversary model and discuss implications in light of the geographic concentration of Tor relay weight across cooperating jurisdictions.

I've Seen This IP: A Practical Intersection Attack Against Tor Introduction Circuits and Hidden Services

TL;DR

A practical intersection attack on Tor introduction circuits that can, over repeated interactions, identify each hop from the introduction point toward the onion service while requiring observation at only one relay per stage is described.

Abstract

Tor onion services rely on long-lived introduction circuits to support anonymous rendezvous between clients and services. Although Tor includes some defenses against traffic analysis, the introduction protocol retains deterministic routing structure that can be leveraged by an adversary. We describe a practical intersection attack on Tor introduction circuits that can, over repeated interactions, identify each hop from the introduction point toward the onion service while requiring observation at only one relay per stage. The attack issues repeated probes and intersects destination IP address sets observed within narrowly defined \texttt{INTRODUCE1}--\texttt{RENDEZVOUS2} time windows, without assuming global visibility or access to packet payloads. We evaluate feasibility with live-network experiments using a self-operated onion service and relays, and we follow data-minimization and ethical safeguards throughout. The results show reliable convergence in practice, with the rate affected by consensus weight, and time-varying background traffic. We also assess practicality under a partial-global adversary model and discuss implications in light of the geographic concentration of Tor relay weight across cooperating jurisdictions.
Paper Structure (24 sections, 6 equations, 3 figures, 7 tables)

This paper contains 24 sections, 6 equations, 3 figures, 7 tables.

Table of Contents

  1. Introduction
  2. Scope, Limitations, and Ethics.
  3. Background and Preliminaries
  4. Onion Routing
  5. Tor Onion Services
  6. The Vanguard Defense
  7. Anonymity Set
  8. Intersection Attacks
  9. Threat Model
  10. Adversary Goals.
  11. Adversary Capabilities.
  12. Problem Statement, Hypothesis, and Motivation
  13. Problem Statement.
  14. Attack Methodology
  15. Limitation: IP Co-location of Successive Hops.
  16. ...and 9 more sections

Figures (3)

  • Figure 1: Structure of a four-hop introduction circuit in the Vanguard-Lite configuration. IP: introduction point; M1: first middle relay; M0: second middle relay (Vanguard); E–G: entry guard; HS: hidden service.
  • Figure 2: Geographic Concentration of Tor Relays: 14-Eyes Alliance Countries vs. All Others
  • Figure 3: Selection probability for entry and middle relays hosted inside vs. outside the Fourteen-Eyes alliance, based on Tor consensus weights.