Upon trying to understand Tor and mixnets, I recently stumbled upon the following question:

On https://blog.torproject.org/blog/one-cell-enough it is stated that if one can measure the traffic on the incoming node, i.e. the node that the client sends to and the outgoing node, i.e. the node that sends the traffic to the destination, one can then make a good (accurate) guess about the two communication partners using some "simple statistics".

However, the same would not apply to mix-nets. Why is that? What distinguishes mixnets from the tor-network that makes a logging attack infeasible when only in control of two nodes in the mixnet, but sufficient in the tor-network?

  • Tor is a type of mixnet, do you have a specific mixnet implementation in mind?
    – Lie Ryan
    Feb 3 '17 at 1:01
  • Paul Syverson considers Tor to not be a mixnet. Types of anonymity designs are onion, mixnet, and p2p. "Onion routing networks primarily get their security from choosing routes that are difficult for the adversary to observe, which for designs deployed to date has meant choosing unpredictable routes through a network. And onion routers typically employ no mixing at all." from freehaven.net/anonbib/cache/entropist.pdf Paper is old, but still valid afaik
    – jspacek
    Oct 29 '17 at 20:27

As Lie Ryan says, Tor is a low-latency network. It also uses a large number of nodes basically run by anyone who wants to run one (which is a problem because it's difficult to trust individual nodes). Good anonymity is achieved by randomly selecting two nodes that together with your mostly fixed, but initially also randomly selected entry guard make up a proxy chain, or "onion route".

There is another way to build anonymity networks (such as JAP/JonDo or whatever it's current name is): With JonDo, there is a much lower number of powerful nodes, run by known entities, which each route lots of traffic. As with Tor, the client also chooses a "mixer cascade" of nodes, but each node collects incoming packets, reorders them and sends them out at aproximately the same time. So if Eve observes the incoming and outgoing traffic of a node, she can't connect an outgoing packet to an incoming one. JonDo offers an okay user experience despite collecting and reordering packets (with means it adds a bit of latency) because it doesn't allow the client to use just any combination of nodes as a mixer cascade and there aren't all that many nodes in the first place, so the individual nodes always have enough traffic so they don't have to wait too long before they have collected enough packets to send out the next batch.

Note that since JonDo is basically low-latency like Tor, an attack that correlates traffic timings between the user and the first node and between the last node and the target server will still work. Also, traffic size correlation will work fine when done at traffic ingress and egress boundaries of the anonymity network.

There is no known countermeasure against these attacks in low latency mixer networks (except maybe generating a large volume of cover traffic, but I don't know any network that implements this.). Even with high-latency mixer networks such as mixminion for anonymous e-mail, which protect you against timing correlation, size correlation will still work.

Aside: Your question seems to imply that you need to control two nodes for traffic correlation to work. But for timing and message size correlation attacks to work, you don't actually need to be in control of any nodes at all. You can also just observe traffic to/from these nodes. This means that if you can get access to several very large internet exchanges such as the world's largest, the DE-CIX in Frankfurt (to which German signal intelligence, which is known to cooperate with other sigint agencies, had access in the past, and probably still does), sea cable termination points and so on, your chances that you'll be able to observe the right traffic increase a lot. This is why Tor warns you that it won't protect you against a global adversary, e.g. one who has global traffic surveillance capabilities.


Tor is a low latency mix network, thus means that Tor sends packets as soon as it receives them and doesn't insert artificial latency. High latency mix networks aren't as vulnerable to timing attack because the network adds artificial latency, reorder packets, batch the packets, etc to hide the timing correlation. This may be ok in a store and forward protocol like emails, but for browsing the web, the high latency results in a very poor user experience for what many people considers minimal security benefits.

  • Would love to see a source cited for this...
    – jspacek
    Oct 29 '17 at 20:28
  • @jspacek: What claim do you want to have sources for?
    – Lie Ryan
    Oct 29 '17 at 23:44
  • "Tor is a low latency mix network", low latency yes, but in what context a mix network? Syverson's 2009 entropist paper states it's not, and the Gen 2 onion paper (2004) states no mixing. These papers are so old...did they add some mixing I haven't come across yet? I know it originated from Chaum (1981) but I believe it diverged shortly thereafter.
    – jspacek
    Oct 30 '17 at 2:13

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.