I was researching attack vectors on the Tor network and stumbled across something interesting
For example, suppose the attacker controls or watches the Tor relay you choose to enter the network, and also controls or watches the website you visit. In this case, the research community knows no practical low-latency design that can reliably stop the attacker from correlating volume and timing information on the two sides.
My question is if the packet size is consistent throughout the circuit, that means:
Eve can monitor Bob, OR1, OR2, OR3 and Alice. Eve cannot exactly see what the packet contains but he has meta data about when a packet was send/received, who sends/received it, and how big the packet is.
Bob sends a request
GET /contact HTTP 1.1 Host: 220.127.116.11:80
The request is 44 bytes long. Now he sends them to the first Onion Router (OR1), the package he send is now 47 bytes long (2 bytes Circuit ID, 1 byte CMD), OR1 sends a 47 byte package to OR2, OR2 sends a 47 byte package to OR3.
If I understood the Tor whitepaper right, Eve should see something like this in his magic internet surveillance program:
[13:37:20] 18.104.22.168 to 22.214.171.124 (OR1), 47 bytes long [13:37:23] 126.96.36.199 (OR1) to 188.8.131.52 (OR2), 47 bytes long [13:37:25] 184.108.40.206 (OR2) to 220.127.116.11 (OR3), 47 bytes long [13:37:27] 18.104.22.168 (OR3) to 22.214.171.124 (Alice.com), 44 bytes long
I am not quite sure if this is true, TLS encryption of the connection could interfere with the package size.