Is a tor packet readily identifiable?

Question

if an exit node decides to trace back a Tor message to its source, will it be able to identify the same packet at the middle node, and from then identify the same packet at the entry node? assuming they have access to the internet logs of all nodes. As I understand the identity of the middle node will be obvious to the exit node. And the entry node identity is also obvious to the middle node.

I'm asking this to understand if, with access to the right logs, is it guaranteed that someone can identify the source and destination of any Tor message. I'm not asking about time correlation at the entry/exit nodes.

Answer 1

If we assume that all nodes a package traverses over actually create logs and someone has access to all of these logs then yes, a Tor package can be traced back.

Is it feasible? No, not really. Tor by itself does not create logs. A malicious actor can of course modify this so any traffic over the node gets logged. This scenario requires that all of these nodes are under the control of the same actor so that all are running the modified software.

I very much assume that quite some Tor nodes are under the control of some agencies. But it is very unlikely that a connection uses only nodes controlled by the same agency.

For cases in which this 'unlikely' is still too high of a likelihood, only the previous/next hope around the Tor network would be known. Anyone that serious about the privacy of the connection should ensure to add additional layers around. Of course, it will be a trade-off between usable speed and anonymity.