summaryrefslogtreecommitdiff
path: root/doc/spec/proposals/109-no-sharing-ips.txt
diff options
context:
space:
mode:
authorNick Mathewson <nickm@torproject.org>2011-02-21 16:09:23 -0500
committerNick Mathewson <nickm@torproject.org>2011-02-21 16:09:23 -0500
commitd673479ebaa29b2dc8f227c342785112c945ec18 (patch)
tree34407f050e03c1e0b91055b6e06cef227286bee4 /doc/spec/proposals/109-no-sharing-ips.txt
parent9b745cdbf9cd7384e44e18bf40a3d2c9becbc345 (diff)
parent7bdb7d4811bb5ff027e124e6558181167c2e2f91 (diff)
downloadtor-d673479ebaa29b2dc8f227c342785112c945ec18.tar.gz
tor-d673479ebaa29b2dc8f227c342785112c945ec18.zip
Merge remote branch 'origin/maint-0.2.1' into maint-0.2.2
Conflicts: doc/Makefile.am doc/spec/Makefile.am doc/spec/address-spec.txt doc/spec/bridges-spec.txt doc/spec/control-spec-v0.txt doc/spec/control-spec.txt doc/spec/dir-spec-v1.txt doc/spec/dir-spec-v2.txt doc/spec/dir-spec.txt doc/spec/path-spec.txt doc/spec/proposals/000-index.txt doc/spec/proposals/001-process.txt doc/spec/proposals/098-todo.txt doc/spec/proposals/099-misc.txt doc/spec/proposals/100-tor-spec-udp.txt doc/spec/proposals/101-dir-voting.txt doc/spec/proposals/102-drop-opt.txt doc/spec/proposals/103-multilevel-keys.txt doc/spec/proposals/104-short-descriptors.txt doc/spec/proposals/105-handshake-revision.txt doc/spec/proposals/106-less-tls-constraint.txt doc/spec/proposals/107-uptime-sanity-checking.txt doc/spec/proposals/108-mtbf-based-stability.txt doc/spec/proposals/109-no-sharing-ips.txt doc/spec/proposals/110-avoid-infinite-circuits.txt doc/spec/proposals/111-local-traffic-priority.txt doc/spec/proposals/112-bring-back-pathlencoinweight.txt doc/spec/proposals/113-fast-authority-interface.txt doc/spec/proposals/114-distributed-storage.txt doc/spec/proposals/115-two-hop-paths.txt doc/spec/proposals/116-two-hop-paths-from-guard.txt doc/spec/proposals/117-ipv6-exits.txt doc/spec/proposals/118-multiple-orports.txt doc/spec/proposals/119-controlport-auth.txt doc/spec/proposals/120-shutdown-descriptors.txt doc/spec/proposals/121-hidden-service-authentication.txt doc/spec/proposals/122-unnamed-flag.txt doc/spec/proposals/123-autonaming.txt doc/spec/proposals/124-tls-certificates.txt doc/spec/proposals/125-bridges.txt doc/spec/proposals/126-geoip-reporting.txt doc/spec/proposals/127-dirport-mirrors-downloads.txt doc/spec/proposals/128-bridge-families.txt doc/spec/proposals/129-reject-plaintext-ports.txt doc/spec/proposals/130-v2-conn-protocol.txt doc/spec/proposals/131-verify-tor-usage.txt doc/spec/proposals/132-browser-check-tor-service.txt doc/spec/proposals/134-robust-voting.txt doc/spec/proposals/135-private-tor-networks.txt doc/spec/proposals/137-bootstrap-phases.txt doc/spec/proposals/138-remove-down-routers-from-consensus.txt doc/spec/proposals/140-consensus-diffs.txt doc/spec/proposals/141-jit-sd-downloads.txt doc/spec/proposals/142-combine-intro-and-rend-points.txt doc/spec/proposals/143-distributed-storage-improvements.txt doc/spec/proposals/145-newguard-flag.txt doc/spec/proposals/146-long-term-stability.txt doc/spec/proposals/147-prevoting-opinions.txt doc/spec/proposals/148-uniform-client-end-reason.txt doc/spec/proposals/149-using-netinfo-data.txt doc/spec/proposals/150-exclude-exit-nodes.txt doc/spec/proposals/151-path-selection-improvements.txt doc/spec/proposals/152-single-hop-circuits.txt doc/spec/proposals/153-automatic-software-update-protocol.txt doc/spec/proposals/154-automatic-updates.txt doc/spec/proposals/155-four-hidden-service-improvements.txt doc/spec/proposals/156-tracking-blocked-ports.txt doc/spec/proposals/157-specific-cert-download.txt doc/spec/proposals/158-microdescriptors.txt doc/spec/proposals/159-exit-scanning.txt doc/spec/proposals/ideas/xxx-hide-platform.txt doc/spec/proposals/ideas/xxx-port-knocking.txt doc/spec/proposals/ideas/xxx-separate-streams-by-port.txt doc/spec/proposals/ideas/xxx-what-uses-sha1.txt doc/spec/proposals/reindex.py doc/spec/rend-spec.txt doc/spec/socks-extensions.txt doc/spec/tor-spec.txt doc/spec/version-spec.txt
Diffstat (limited to 'doc/spec/proposals/109-no-sharing-ips.txt')
-rw-r--r--doc/spec/proposals/109-no-sharing-ips.txt90
1 files changed, 0 insertions, 90 deletions
diff --git a/doc/spec/proposals/109-no-sharing-ips.txt b/doc/spec/proposals/109-no-sharing-ips.txt
deleted file mode 100644
index 5438cf049a..0000000000
--- a/doc/spec/proposals/109-no-sharing-ips.txt
+++ /dev/null
@@ -1,90 +0,0 @@
-Filename: 109-no-sharing-ips.txt
-Title: No more than one server per IP address.
-Author: Kevin Bauer & Damon McCoy
-Created: 9-March-2007
-Status: Closed
-Implemented-In: 0.2.0.x
-
-Overview:
- This document describes a solution to a Sybil attack vulnerability in the
- directory servers. Currently, it is possible for a single IP address to
- host an arbitrarily high number of Tor routers. We propose that the
- directory servers limit the number of Tor routers that may be registered at
- a particular IP address to some small (fixed) number, perhaps just one Tor
- router per IP address.
-
- While Tor never uses more than one server from a given /16 in the same
- circuit, an attacker with multiple servers in the same place is still
- dangerous because he can get around the per-server bandwidth cap that is
- designed to prevent a single server from attracting too much of the overall
- traffic.
-
-Motivation:
- Since it is possible for an attacker to register an arbitrarily large
- number of Tor routers, it is possible for malicious parties to do this
- as part of a traffic analysis attack.
-
-Security implications:
- This countermeasure will increase the number of IP addresses that an
- attacker must control in order to carry out traffic analysis.
-
-Specification:
-
- For each IP address, each directory authority tracks the number of routers
- using that IP address, along with their total observed bandwidth. If there
- are more than MAX_SERVERS_PER_IP servers at some IP, the authority should
- "disable" all but MAX_SERVERS_PER_IP servers. When choosing which servers
- to disable, the authority should first disable non-Running servers in
- increasing order of observed bandwidth, and then should disable Running
- servers in increasing order of bandwidth.
-
- [[ We don't actually do this part here. -NM
-
- If the total observed
- bandwidth of the remaining non-"disabled" servers exceeds MAX_BW_PER_IP,
- the authority should "disable" some of the remaining servers until only one
- server remains, or until the remaining observed bandwidth of non-"disabled"
- servers is under MAX_BW_PER_IP.
- ]]
-
- Servers that are "disabled" MUST be marked as non-Valid and non-Running.
-
- MAX_SERVERS_PER_IP is 3.
-
- MAX_BW_PER_IP is 8 MB per s.
-
-Compatibility:
-
- Upon inspection of a directory server, we found that the following IP
- addresses have more than one Tor router:
-
- Scruples 68.5.113.81 ip68-5-113-81.oc.oc.cox.net 443
- WiseUp 68.5.113.81 ip68-5-113-81.oc.oc.cox.net 9001
- Unnamed 62.1.196.71 pc01-megabyte-net-arkadiou.megabyte.gr 9001
- Unnamed 62.1.196.71 pc01-megabyte-net-arkadiou.megabyte.gr 9001
- Unnamed 62.1.196.71 pc01-megabyte-net-arkadiou.megabyte.gr 9001
- aurel 85.180.62.138 e180062138.adsl.alicedsl.de 9001
- sokrates 85.180.62.138 e180062138.adsl.alicedsl.de 9001
- moria1 18.244.0.188 moria.mit.edu 9001
- peacetime 18.244.0.188 moria.mit.edu 9100
-
- There may exist compatibility issues with this proposed fix. Reasons why
- more than one server would share an IP address include:
-
- * Testing. moria1, moria2, peacetime, and other morias all run on one
- computer at MIT, because that way we get testing. Moria1 and moria2 are
- run by Roger, and peacetime is run by Nick.
- * NAT. If there are several servers but they port-forward through the same
- IP address, ... we can hope that the operators coordinate with each
- other. Also, we should recognize that while they help the network in
- terms of increased capacity, they don't help as much as they could in
- terms of location diversity. But our approach so far has been to take
- what we can get.
- * People who have more than 1.5MB/s and want to help out more. For
- example, for a while Tonga was offering 10MB/s and its Tor server
- would only make use of a bit of it. So Roger suggested that he run
- two Tor servers, to use more.
-
-[Note Roger's tweak to this behavior, in
-http://archives.seul.org/or/cvs/Oct-2007/msg00118.html]
-