vidM.Goldschlag,MichaelG.Reed,andPaulF.Syverson.\HidingRoutingInformat - PDF document

vidM.Goldschlag,MichaelG.Reed,andPaulF.Syverson.\HidingRoutingInformation,"orkshoponInformationHiding,Cambridge,UK,Ma,1996. HidingRoutingInformationvidM.Goldschlag,MichaelG.Reed,andPaulF.SyvalResearchLaboratory,CenterForHighAssuranceComputerSystems,ashington,D.C.20375-5337,USA,phone:+1202.404.2389,fax:+1202.404.7942,lastnameThispaperdescribesanarcOnionR,thatlimitsanetork'svulnerabilitytotracanalysis.Thearchitecturepro-videsanonymoussocetconnectionsbymeansofproxyservers.Itpro-videsreal-time,bi-directional,anonymouscommunicationforanyproto-colthatcanbeadaptedtouseaproxyservice.Specically,thearctureprovidesforbi-directionalcommunicationeventhoughno-onebuttheinitiator'sproxyserverknowsanythingbutpreviousandnexthopsinthecommunicationchain.Thisimpliesthatneithertherespondennorhisproxyservernoranyexternalobserverneedknowtheidenoftheinitiatororhisproxyserver.AprototypeofOnionRbeenimplemented.ThisprototypeworkswithHTTP(WorldWideWxies.Inaddition,ananalogousproxyforTELNEThasbeenimple-ted.ProxiesforFTPandSMTPareunderdevtroductionThispaperpresentsanarchitecturethatlimitsanetork'svulnerabilitytotraf-canalysis.WecallthisapproacOnionR,becauseitreliesuponalaeredobjecttodirecttheconstructionofananonymous,bi-directional,real-timevirtualcircuitbeteentocommunicatingparties,anBecauseindividualoutingnoineachcircuitonlyknowtheidentitiesofadja-tnodes(asin[1]),andbecausethenodesfurtherencryptmultiplexedvirtualcircuits,studyingtracpatternsdoesnotyieldmhinformationaboutthepathsofmessages.Thismakesitdiculttousetracanalysistodeterminewhoiscommunicatingwithwhom.OnionRoutingprovidesananonymoussocetconnectionthroughaproer.Sinceproxiesareawelldenedinterfaceattheapplicationlaer[12,11],andmanyprotocolshaebeenadaptedtoworkwithproxyserversinordertoaccommodaterewalls,OnionRoutingcanbeeasilyusedbymanyapplications.OurprototypeworkswithHTTP(WorldWideWeb)proxies.Inaddition,axyforTELNEThasbeenimplemenracanalysiscanbeusedtohelpdeducewhoiscommunicatingwithwhomyanalyzingtracpatternsinsteadofthedatathatissent.Forexample,inmostnetorks,itisrelativelyeasytodeterminewhichpairsofmachinesarengbhingtheroutinginformationthatispartofeachpacenifdataisencrypted,routinginformationisstillsentintheclearbecauseroutersneedtoknowpacets'destinations,inordertoroutethemintherigh vidM.Goldschlag,MichaelG.Reed,andPaulF.Syverson.\HidingRoutingInformation,"orkshoponInformationHiding,Cambridge,UK,Ma,1996. direction.Tracanalysiscanalsobedonebhingparticulardatamothroughanetork,bymatchingamountsofdata,orbyexaminingcoincidences,hasconnectionsopeningandclosingataboutthesametime.OnionRoutinghidesroutinginformationbymakingadatastreamfollopaththroughseveralnodesenroutetoitsdestination.Thepathisdenedbtherstnode,whichisalsoaproxyfortheservicebeingrequested(e.g.,HTTPrequests).Therefore,thisProxy/RoutingNodeisthemostsensitiveone,sositesthatareconcernedabouttracanalysisshouldalsomanageaProNode.WewillseelaterthatitisimportantthatthisProxy/RoutingNodealsobeusedasanintermediateroutingnodeinothervirtualcircuits.Althoughthecompromiseofallroutingnodescompromisesthehiding,oneuncompromisedroutingnodeissucienttocomplicatetracanalysis.Figure1illustratesthetopologyofanOnionRoutingnetorkwithvenodes,oneofwhic)isthexy/Routingnodefortheinitiator'ssite. XUYZ Fig.1.RoutingTopologyThegoalofOnionRoutingisnottoprovideanonymouscommartiesarefreeto(andusuallyshould)identifythemselveswithinamessage.Buttheuseofapublicnetorkshouldnotautomaticallygivytheidentitiesandlocationsofthecommcatingparties.Forexample,imaginearesearcherwhousestheWorldWideWebtocollectdatafromavyofsources.Althougheac vidM.Goldschlag,MichaelG.Reed,andPaulF.Syverson.\HidingRoutingInformation,"orkshoponInformationHiding,Cambridge,UK,Ma,1996. pieceofinformationthatheretrievesispubliclyknown,itmaybepossibleforanoutsideobservertodeterminehissensitiveinterestsbystudyingthepatternsinhisrequests.OnionRoutingmakesitverydiculttomatchhisHTTPrequeststohissite.ymousre-mailers[5]attempttolimitthefeasibilityoftracanalysisyprovidingananonymousstoreandforwardarchitecture.Toprevtreplaks,re-mailerskeepalogofsentmessages.Thesetharacteristicsmaktheanonymousre-mailerapproachunsuitableforHTTPapplications,asHTTPrequestswouldbothgenerateanenormouslogandrequirebi-directionalcommnication.AnonymousISDN[8]hasevenmoreseverereal-timeandbi-directionaltsthanHTTP,but,thearchitectureofanISDNnetorkisconsider-ablydierentfromthearchitectureoftheInternet[4OnionRoutingprovidesbi-directionalcommn,withoutrequiringthattheresponderknowtheinitiator'sidenyorlocation.Individualmessagesarenotlogged.Inaddition,OnionRoutingiseasilyadaptedtoelectronicmail.MessagescanincludeeplyOnionsthatpermitalaterreplytothesenderwithoutknowinghisaddressandwithoutkeepingtheoriginalvirtualcircuitopen.Therestofthepaperisorganizedinthefollowingwy:Section2presenkgroundinformation.Section3describesthe,theobjectthatdirectstheconstructionofthevirtualcircuit.Section4describestheconstructionanduseofthesevirtualcircuits.Section5describesthevulnerabilitiesintheOnionRoutingarchitecture.Section6presentssomeconcludingremarks.Chaum[1]denesalaeredobjectthatroutesdatathroughintermediatenodes,.Theseintermediatenodesmayreorder,dela,andpadtractocomplicatetracanalysis.SomeworkhasbeendoneusingmixesinATMnet-orks[3ymousRemailerslike[5,6]usemixestoprovideanonymouse-mailservicesandalsotointanaddressthroughwhichmailcanbeforwardedbactotheoriginalsender.Remailersworkinastoreandforwardmanneratthemailapplicationlaer,bystrippingoheadersateachmix,andforwardingthemailmessagetothenextmix.TheseremailersprovideconrmationofdelivIn[8],mixesareusedtoprovideuntraceablecommunicationinanISDNork.Inaphonesystem,eachtelephonelineisassignedtoaparticularlocalh(i.e.,localexchange),andswitchesareinterconnectedbya(longdistance)ork.AnonymouscallsinISDNrelyuponananonymousconnectionwithinhswitchbeteenthecallerandthelongdistancenetork,whichisobtainedyroutingcallsthroughapredenedseriesofmixes.Thelongdistanceendpoinoftheconnectionarethenmatedtocompletethecall.(Noticethatobserverscantellwhichlocalswitchesareconnected.)ThisapproachreliesupontouniquefeaturesofISDNswitches.Sinceeachphonelinehasasubsetoftheswitctotalcapacitypre-allocatedtoit,thereisno(real)costassociatedwithk vidM.Goldschlag,MichaelG.Reed,andPaulF.Syverson.\HidingRoutingInformation,"orkshoponInformationHiding,Cambridge,UK,Ma,1996. aphonelineactiveallthetime,eitherbymakingcallstoitself,tootherphonelinesonthesameswitch,ortothelongdistancenetork.Keepingphonelinesecomplicatestracanalysisbecauseanobservercannottrackcoincidences.Also,sinceeachphonelinehasacontrolcircuitconnectiontotheswitctheswitchcanbroadcastmessagestoeachlineusingthesecontrolcircuits.So,withinaswitchatrulyanonymousconnectioncanbeestablished:Aphonelineesananonymousconnectiontosomemix.Thatmixbroadcastsatoktifyingitselfandtheconnection.Arecipientofthattokencanmakeanotherymousconnectiontothespeciedmix,whichmatesthetoconnectionstocompletethecall.OurgoalofanonymoussocetconnectionsoertheInternetdiersfromymousremailersandanonymousISDN.Thedataisdierent,withreal-timetsmoreseverethanmail,butsomewhatlooserthanvoice.BothHTTPandISDNconnectionsarebidirectional,but,unlikeISDN,HTTPconnectionsarelikelytobesmallrequestsfolloedbyshortburstsofreturneddata.Inalocalswitchcapacityispre-allocatedtoeachphoneline,andbroadcastingist.ButbroadcastingoertheInternetisnotfree,anddeningbroadcastsdomainsisnottrivial.Mostimportan,thenetorktopologyoftheInismoreakintothenetorktopologyofthelongdistancenetorkbethes,wherecapacityisasharedresource.InanonymousISDN,themixeshidecommnwithinthelocalswitch,butconnectionsbeteenswitcarenothidden.Thisimpliesthatallcallsbeteentobusinesses,eachlargeenoughtouseanentireswitch,revealwhichbusinessesarecomm.InOnionRouting,mixingisdispersedthroughouttheInternet,whichimproobeginasessionbeteenaninitiatorandaresponder,theinitiator'sprotiesaseriesofroutingnodesformingaroutethroughthenetorkandconstructsanhencapsulatesthatroute.Figure2illustratesanonionconstructedbytheinitiator'sProxy/RoutingNodeforananonymousroutetotheresponder'sProxy/RoutingNodethroughintermediateroutingnodes.Theinitiator'sproxythensendstheonionalongthatroutetoestablishavirtualcircuitbeteenhimselfandtheresponder'sproTheoniondatastructureiscomposedoflaeruponlaerofencryptionwrappedaroundapayload.Leavingasidetheshapeofthepayloadatthevter,thebasicstructureoftheonionisbasedontheroutetotheresponderthatischosenbytheinitiator'spro.Basedonthisroute,theinitiator'sproencryptsrstfortheresponder'spro,thenfortheprecedingnodeontheroute,andsoonbacktotherstroutingnodetowhomhewillsendtheonion.Whentheonionisreceived,eachnodeknowswhosenthimtheonionandtowhomheshouldpasstheonion.But,heknowsnothingabouttheothernodes,noraboutwmanythereareinthechainorhisplaceinit(unlessheislast).Whata vidM.Goldschlag,MichaelG.Reed,andPaulF.Syverson.\HidingRoutingInformation,"orkshoponInformationHiding,Cambridge,UK,Ma,1996. Fig.2.ardOnion.nodeeslookslikethis time;next isapublicencryptionkeyforroutingnode,whoisassumedtohaethecorrespondingdecryptionkThedecryptedmessagecontainsanexpirationtimefortheonion,thenextroutingnodetowhichthepayloadistobesent,thepayload,andtofunction/keypairsspecifyingthecryptographicoperationsandkeystobeappliedtodatathatwillbesentalongthevirtualcircuit.Theforwardpair()isappliedtodatamovingintheforwdirection(alongtheroutethattheonionistraeling)thebacardpair(isappliedtodatamovingintheoppositedirection(alongtheonion'srev(Ifthereceivingnodeistheresponder'spro,thenthe null.)Foranyintermediateroutingnodethepayloadwillbeanotheronion.Theexpirationtimeisusedtodetectreplays,whichpairsofcompromisednodescouldusetotrytocorrelatemessages.Eachnodeholdsacopyoftheonion .Ifhereceivesanothercopyofthesameonionwithinthattimehesimplyignoresit.And,ifhereceivesanonionthathasexpired,heignoresthataswNoticethatateachhoptheonionshrinksasalaerispeeledo.Tcompromisednodesinferringrouteinformationfromthismonotonicallydimin-ishingsize,arandombitstringthesizeofthepeeledolaerisappendedtotheendofthebeforeforwarding.Noproxyexceptthelastwillknowhohofthehereceivesissuchpaddingbecausehewon'tknowwhere Dependingoncertainassumptionsabouttheeldsineachonionlaer,anaiveRSAtationofthesimplepublickeyencryptionimpliedbyournotationcouldbevulnerabletoanattackasdescribedin[7].Inourimplementation,thispotenvulnerabilityisillusorysincethepublickeyisonlyusedtoencryptasecretk,andthatsecretkeyisusedtoencrypttheremainderofthemessageusinganeciensymmetricalgorithm.Thisalsomakesforamoreecientimplementationthanthesimple,straighardimplementationusingonlypublickSpecifyingtopairsoffunctionsuniesthevirtualcircuitsthatareconstructedbardandreplyonions.Seesection3.3. vidM.Goldschlag,MichaelG.Reed,andPaulF.Syverson.\HidingRoutingInformation,"orkshoponInformationHiding,Cambridge,UK,Ma,1996. heisinthechain.Hesimply`decrypts'thepaddingalongwiththerestoftheonion.Evenaconstantsizeonionmightbetracedunlessallonionsarethesamesize,sowexthesizeoftheonion.Tomaintainthisconstantsizetohidethelengthofthechainfromtheresponder'spro,theinitiator'sproxywillpadtheaccordingtothesizeoftheonion,i.e.,thenberofhops.So,whenanyonionarrivesattheresponder'sproxyitwillalwyshaethesametofpadding,eitheraddedinitiallyorenroute.CreatingthecircuitThegoalinsendingtheonionistoproducevirtualcircuitswithinlinkencryptedconnectionsalreadyrunningbeteenroutingnodes.Moredetailswillbegivinsection4.Anonionoccursasthedataeldinoneofthepresentlydescribed`messages'.Suchmessagescontainacircuitidentier,acommand(,and),anddata.Anyothercommandisconsideredanerror,andthenodewhoreceivessuchamessageignoresthatmessageexcepttoreturnacommandbackthroughthatvirtualcircuit.Thecommandaccompaniesanonion.Whenanodereceivesacreatecommandalongwithanonion,hehoosesavirtualcircuitidentierandsendsanothermessageconthisidentiertothenextnodeandtheonion(paddedwithhislaerpeeledo).Healsostoresthevirtualcircuitidentierhereceivedandvirtualcircuittierhesentasapair.Untilthecircuitisdestroed,wheneverhereceivdataontheoneconnectionhesendsitoontheother.Heappliestheforwcryptographicfunctionandkey(obtainedfromtheonion)todatamovinginthearddirection(alongtheroutetheoniontraeled)andthebacardcryp-tographicfunctionandkeytodatamovingintheoppositedirection(alongtheonion'sreverseroute).Thevirtualcircuitestablishedbytheonioningure2isillustratedingure3:Datasenytheinitiatoroeravirtualcircuitis\pre-crypted"repeatedlyyhisproxybyapplyingtheinerseofalltheforwardcryptographicoperationsspeciedintheonion,innermostrst.Therefore,theselaersofcryptographwillbepeeledoasthedatatraelsforwardthroughthevirtualcircuit.Dataytheresponderis\crypted"oncebyhisproxyandagainbyeachpreviousnodeinthevirtualcircuitusingthebacardcryptographicoperationspeciedatthecorrespondinglaeroftheonion.Theinitiator'sproxyappliestheinofthebacardcryptographicoperationsspeciedintheonion,outermostrst,tothisstream,toobtaintheplainLooseRoutingItisnotnecessarythattheentireroutebeprespeciedbytheinitiator'sproHecaninstructvariousnodesalongtheroutetochoosetheirownroutetothe Onionscouldbeusedtocarrydataalso,butsinceonionshaetobetracedtotrepla,thiswouldintroducealargecost.edenethevtomeantheapplicationofacryptographicoperation,beitencryptionordecryption,wherethetoarelogicallyin vidM.Goldschlag,MichaelG.Reed,andPaulF.Syverson.\HidingRoutingInformation,"orkshoponInformationHiding,Cambridge,UK,Ma,1996. Data Flow (with Function/Key Pairs if crypted)F XUYZ FFFFF Fig.3.AVirtualCircuit.nextprespeciednode.Thiscanbeusefulforsecurit,addingmorehopstothehain.Itcouldalsobeusediftheinitiatingproxydoesnotknowacomplete,connectedroutetotheresponderbutbelievesthatthenodewhereanybreakoccurscanconstructaroutetothenextnode.Or,looseroutingcanbeusedtohandleconnectionchangesthatoccurofwhichtheinitiatorwasunaare.Also,sinceonionsareallofxedsize,thereisaxedmaximumlengthtotheroutefromtheinitiator'sproxytotheresponder'spro.Looseroutingallowsustoincreasethesizeofthatmaximumforthesamexedonionsize.WhythisissoshouldbecomeclearpresenItisalsopossibletoiteratethelooseroutingprocess,allowingnodesontheaddedroutetothemselvesaddtothechain.Obeneedamechanismtotthechainfromlengtheningindenitely.Thiscanbeincorporatedintheonionstructure.Anonionforasystemthatallowsforlooseroutingisas time;next hop;max Ifthenodereceivingthisoniondecidestoloose-routetheonion,hepreparesanewonionwithupto ers.Thepayloadofthisonionis vidM.Goldschlag,MichaelG.Reed,andPaulF.Syverson.\HidingRoutingInformation,"orkshoponInformationHiding,Cambridge,UK,Ma,1996. simplytheonionhereceivedwithhangedforthelast(innermost)nodeheaddedtothechain.Inotherwords,hebehaesasaninitiator'sproxyexceptthathispayloadisitselfalreadyanonion.(Thisnodebehaeslikeaninitiator'sxywithrespecttodataalso,sincehemustrepeatedlypre-andpost-cryptdatathatmoesalongthedivertedroute.)Teeptheonionaconstantlengthhemusttruncatethepayloadbyanamountcommensuratewiththelaershehasaddedtotheonion.Theinitiatingproxymustanticipatetheamountofpadding(bothpresentinitiallyandanyaddedand/ortruncatedenroute)thatwillbeonthecentralpayloadatthetimelooseroutingoccurstoallowforthistruncation.Failuretopre-padcorrectlyorignoringanonion'sxedsizewillresultinamalformedonionlaterintheroute.Thetotalofthe aluesoccurringintheaddedlaersplusthenberofaddedlaersmustbelessthanorequaltothe aluethattheaddingnodereceivReplyOnionsThereareapplicationsinwhichitwouldbeusefulforarespondertosendbacareplyaftertheoriginalcircuitisbroken.Thiswouldallowanswers(likee-mailreplies)tobesenttoqueriesthatwerenotaailableatthetimeoftheoriginalconnection.Asweshallseepresen,thisalsoallowstheresponderaswellastheinitiatortoremainhidden.Theweallowforthesedelaedrepliesisbsendingareplyoniontoaccompanythereply.Liketheforwardonion,itrevtoeachnodeenrouteonlythenextsteptobetaken.Ithasthesamestructureastheforwardonionandistreatedthesamewynodesenroute.Innodesprocessinganonioncannotdierentiatebeteenforwardandreplyonions.urthermore,thebehavioroftheoriginalinitiatorandresponderproxiesarethesame,oncethecircuitisformed.Theprimarydierencebeteenaforwardandareplyonionistheinnermostyload.Thepayloadoftheforwardonioncanbeeectivelyempty(cononlypadding).Thereplyonionpayloadcontainsenoughinformationtoenabletheinitiator'sproxytoreachtheinitiatorandallthecryptographicfunctionandeypairsthataretocryptdataalongthevirtualcircuit.Theinitiator'sproesthekeysfromtheonion.Figure4illustratesareplyonionconstructedytheinitiator'sProxy/RoutingNodeforananonymousroutebacktohimstartingattheresponder'sProxy/RoutingNodethroughintermediateroutingnodesThereisnodierencebeteenvirtualcircuitsestablishedbyreplyonionsandforwardonions,exceptthatincircuitsestablishedbyreplyonionsindiateroutingnodesappeartothinkthatforwardpointstoardtheinitiator's.Butsincethebehaviorofintermediateroutingnodesissymmetric,thisdierenceisirrelevt.TheterminalProxy/Routingnodes,hoer,haethesamebehaviorincircuitsestablishedbyforwardandreplyonions.Therefore,agureofthevirtualcircuitformedbythereplyonionillustratedingure4wbeidenticaltothevirtualcircuitillustratedingure3eventhoughthecircuitasformedbythereplyonionmovingfromtheresponder'sproxynodetothe vidM.Goldschlag,MichaelG.Reed,andPaulF.Syverson.\HidingRoutingInformation,"orkshoponInformationHiding,Cambridge,UK,Ma,1996. z,y,x,ZYX Fig.4.AReplyOnion.initiator'sproxynode.Internallytotheintermediatenodes,theforwardcrypto-graphicfunctionsareappliedtodatamovinginthedirectionthatthecircuitwestablished,andthebacardcryptographicfunctionsareappliedtodatamoingintheoppositedirection.ThelocationoftheterminalProxy/RoutingNodesareinthissensereversed,withtheinitiator'sproxyattheendofthecircuitandtheresponder'sproxyatthebeginningofthecircuit.Hoer,thebehavioroftheinitiatorandresponderproxiesisidenticaltotheirbehaviorinthevirtualcircuitformedbyaforwardonion.Thisisthereasonforhavingforwardandardfunction/keypairsateachlaeroftheonion.eaforwardonion,areplyonioncanonlybeusedonce.Whenanodeesanonionitiskeptuntilitexpires,andanyonionreceivediscomparedtodetectrepla.Ifareplayisdetected,itistreatedasanerrorandignored.Sincereplyonionscanonlybeusedonce,ifmultiplerepliesaredesired,mreplyonionsmustbesent.Ofcourse,theyneednotallfollowthesamereturnroute;althoughtheyma.Ifrepliesareonlylikelytobeforthcomingiftheyareymous,oneormorereplyonionscanbebroadcast.Anonecanthenreplywithanunusedonion.Ifhecanmaintainanonyfromorincooperationwiththeresponder'sproxyforthatreplyonion,thenhecandosoanonTheeasiestwytobuildoursystemwithoutrequiringthecompleteredesignandtofnewclientandserversoftareistomakeuseofexistingprohnologies.Historically,proxytechnologieshaebeenusedtocreatetunnelsthrougharewall.Theuseofproxytechnologiesrequiresthattheclientapplica-tionsbe`proxyaare'.ThewidespreaddeplotofrewallsontheInhascreatedthedemandforsuchproxyaareapplications,whichsoftareman-ufacturersarerushingtomeet. vidM.Goldschlag,MichaelG.Reed,andPaulF.Syverson.\HidingRoutingInformation,"orkshoponInformationHiding,Cambridge,UK,Ma,1996. Intherewallsetting,asystemadministratorwillsetupaproxyserverontherewallmachinewhichwillberesponsibleforforwardingrequestsfromtheprotecteddomainoutontotheopenInternet,andmaintainareturnpathfortheresponsetotherequest.Aproxyservercanbedividedintotoparts:thetendthatreceivesandparsestherequest,andthebackendthatprocessestherequestandreturnstheresultsbacktotherequester.Classically,thefronandbackendsarethesameprocessrunningononemacUnderoursystemwewilluseatraditionalproxyfrontendandbackend,but,theywillbeseparateprocessesonseparatemachineswithatunnelconnectingthem.Inthismanner,ourProxy/RoutingNodeswilllooknodierenttothetandserversoftarethananyotherproxyserver.Acoupleofassumptionswillholdfortheremainderofthispaper:1)Proxy/RoutingNodesandindiateroutingnodesknowabouteachotherinadvanceoftheiroperation,and2)publickeycerticatesforeachnodehaebeensecurelydistributedtoallotherspriortooperation.Allnodesareconnectedbylinkencryptedconnectionswhicultiplexmanvirtualcircuitsbeteeninitiatorandresponderproxynodes.Theseconnectionsarelinkencryptedinanoddwy(foreciency).Allmessagesmovingthroughtheseconnectionsareofxedsizeandhaocomponents,headerandpaelds.Headereldscontainthevirtualcircuitidentierandthecommandandarelinkencryptedusingastreamcipher[10].Sinceallpayloadeldswillbeencryptedviaothermechanisms(publickeysoronionkeys),theyneednotbelinkencrypted.Therearethreecommandsthatnodesunderstand.Therstistovirtualcircuit.Ateachnode,avirtualcircuithastoconnections.Dataarriv-ingononeispassedalongontheother.Thecircuitisdenedbythelabelsforthesetoconnections.Creatingavirtualcircuitistheprocessofdeningtheselabelsforeachnodealongtheroute.FortherstProxy/RoutingNode,oneconnectionisalinktotheinitiator,andtheotherisalinktothenextroutingnode.TheProxy/RoutingNodecreatesanoniondeningthesequenceofintermediateroutingnodestotheresponder'sProxy/RoutingNode.Itbreakstheonionupintopayloadsizedcunksandtransmitsthesecunksinordertothenextnodewithacontroleldcontainingboththelabeloftheconnectionandacommand.Eachsubsequentnodereassemblestheonionandpeelsoalaerfromtheonionwhichrevealsthenextnodeintherouteandtocryp-tographicfunction/keypairs.Beforeactingonthecommand,thenodekswhethertheonionhasexpiredorisareplakforrepla,thenodeconsultsatableofunexpiredonions.Iftheonionisvalid,itisinsertedintothetable,andthenodethenlabelsanewconnectiontothenextnodeandpassesthepeeledandpaddedonioninasimilarsequenceofmessagestothenextnode.Italsoupdatesatablecontainingthelabelsandcryptographicfunction/keypairsassociatedwiththenewvirtualcircuit.Theappropriate(forwardorbaceypairshouldbeusedtocryptdatamovingalongthatcircuit.Theresponder'sProxy/RoutingNode,recognizingthattheonionisempt,willpar-tiallyupdateitstables.Aswithstandardproxiesthenextmessagealong vidM.Goldschlag,MichaelG.Reed,andPaulF.Syverson.\HidingRoutingInformation,"orkshoponInformationHiding,Cambridge,UK,Ma,1996. thiscircuitwillidentifytheresponder.Thesecondcommandis.Thesecondroleoftheinitiator'sProingNodeistopassastreamofdatafromtheinitiatoralongthevirtualcircuittogetherwithothercontrolinformationfortheresponder'sProxy/RoutingNode.odothis,hebreakstheincomingstreaminto(atmost)payloadsizedcandrepeatedlypre-cryptseacunkusingtheinerseofthecryptographicoperationsspeciedintheonion,innermostrst.Thefunction/keypairsthatareapplied,andthevirtualcircuitidentieroftheconnectiontothenextnodeareobtainedfromatable.Theheadereldforeachpayloadisthelabeloftheconnectionandacommand.Eachsubsequentnodelooksatitstable,obtainingthecryptographicfunction/keypairassociatedwiththecircuit(fortheappropriatedirection)andthevirtualcircuitidentieroftheconnectiontothenextnode.Itthenpeelsoalaerofcryptographyandforwardsthepeeledyloadtothenextnode.Oncethedatareachestheresponder'spro,itsnalcryptionwillproducetheplaintextthatistobeprocessedorforwardedtotheresponder.commandcanalsobeusedtomoedatafromtheresponder'sxy/RoutingNodetotheinitiator'sProxy/RoutingNode.Theresponder'sxy/RoutingNodeobtainsthecryptographicfunction/keypairandthevir-tualcircuitidentierforthenextnodefromitstables,andcryptsthestream.Itbreaksthecryptedstreamintopayloadsizedcunksandforwardsthemtothenextnodewiththeappropriatecontroleld.Eachsubsequentnodefurtherstreamcryptseachpayloadusingtheappropriatefunction/keyassociatedwiththatvirtualcircuit.Onceamessagesarrivesattheinitiator'sProNodehelooksathistableandappliestheinerseofthebacardcryptographicoperationsspeciedintheonion,outermostrst,tothisstreamtoobtainthetext.Theplaintextisforwardedtotheinitiator.Thethirdcommandishisusedtoteardownavirtualcircuitwhenitisnolongerneededorinresponsetocertainerrorconditions.Noticemessagescanbeinitiatedbyanynodealongavirtualcircuit,anditisanode'sobligationtoforwardthemessagesintheappropriatedirec-tions.(Anodeinitiatingamessageinanactivevirtualcircuitforwitinbothdirections.Anodethatreceivesamessagepassesitalonginthesamedirection.)Thepayloadofacommandisemptypadding.Nonetheless,thispayloadisstillcryptedwiththeappropriatefunction/keypair.Inadditiontothecommand,thecontroleldcontainsthevirtualcir-cuitidentieroftherecipientofthecommand.Uponreceiptofacommandanodedeletesthetableentriesassociatedwiththatvirtualcircuit.OnionRoutingisnotinvulnerabletotracanalysisattacks.Withenoughdata,itisstillpossibletoanalyzeusagepatternsandmakeeducatedguessesabouttheroutingofmessages.Also,sinceourapplicationrequiresrealtimecommnication,itmaybepossibletodetectthenearsimultaneousopeningofsoc vidM.Goldschlag,MichaelG.Reed,andPaulF.Syverson.\HidingRoutingInformation,"orkshoponInformationHiding,Cambridge,UK,Ma,1996. connectionsontherstandlastproxyserversrevealingwhoisrequestingwhatinformation.Hoer,thesesortsofattacksrequirethecollectionandanalysisofhugeamountsofdatabyexternalobservOtherattacksdependuponcompromisedProxyServersandRoutingNodes.Iftheinitiator'sproxyiscompromisedthenallinformationisrevealed.Ingeneralitissucientforasingleroutingnodetobeuncompromisedtocomplicatetracanalysis.Hoer,asinglecompromisedroutingnodecandestroyconnectionsorstopforwardingmessages,resultingindenialofserviceattacOnionRoutingusesexpirationtimestoprevtreplayattacks.Itiscuriousthat,unliketimestamps,thevulnerabilityduetopoorlysynchronizedclockshereisadenialofserviceattack,insteadofareplayattack.Ifanode'sclockistoofast,otherwisetimelyonionswillappeartohaealreadyexpired.Also,sinceexpirationtimesdenethewindowduringwhichnodesmuststoreusedonions,anodewithaslowclockwillendupstoringmoreinformation.Iftheresponder'sproxyiscompromised,andcandeterminewhentheunen-crypteddatastreamhasbeencorrupted,itispossibleforcompromisednodesearlierinthevirtualcircuittocorruptthestreamandaskwhichresponder'sxyreceiveduncorrupteddata.Byworkingwithcompromisednodesaroundasuspectedinitiator'spro,onecanidentifythebeginningofthevirtualcircuit.Thedicultywiththisattackisthatoncethedatastreamhasbeencorrupted,itwillremaincorrupted(becauseweuseastreamcipher),limitingfurtheranalysis.InorderforOnionRoutingtobeeective,theremustbesignicantuseofallthenodes,andProxyNodesmustalsobeintermediateroutingnodes.Choosingtheappropriatebalancebeteenecientuseofnetorkcapacityandsecurityisahardproblembothfromatheoreticalandpracticalstandpoint.Theoreticallyitisdiculttocalculatethevalueofthetradeo.Formoresecurit,nettracmustberelativelyconstant.Thisrequiressendingdummytracoeraconnectionwhentracislightandbueringdatawhentracishea.Iftracisveryburstyandresponsetimeisimportant,smoothingoutnetorktracrequireswastingcapacit.Ifhoer,tracisrelativelyconstant,additionalsmoothingmaynotbenecessaryromapracticalpointofview,theInynotprovidethecontrolnecessarytosmoothouttrac:unlikTM,usersdonotowncapacityonsharedconnections.Theimportantobservation,hoisthatOnionRoutingformsanarchitecturewithinwhichthesetradeoscanbemadeandexplored.OnionRoutingisanarchitecturethathidesroutinginformationwhileproreal-time,bi-directionalcommunication.Sinceitprovidesavirtualcircuitthatcanreplaceasocetconnection,OnionRoutingcanbeusedinanyprotocolthatcanbeadaptedtouseaproxyservice.AlthoughourrstuseisinHTTPandTELNET,itiseasytoimagineotherapplications.Ine-mail,forexample,OnionRoutingwouldcreateananonymoussocetconnectionbeteentosendmaildaemons.ThiscontrastswithAnonymousRemailers,whereeachremailerpro- vidM.Goldschlag,MichaelG.Reed,andPaulF.Syverson.\HidingRoutingInformation,"orkshoponInformationHiding,Cambridge,UK,Ma,1996. videsasinglehopinachainofmailforwarding.Inthissense,inOnionRouting,thereroutingofmessagesisindependentofthetypeofmessage.Otherextensionsarealsopossibleandintegratenicelywiththeproxyap-htoanonorexample,tocreateacompletelyanonymousconsationbeteentoparties,eachpartouldmakeananonymousconnectiontosomeanonyserver,whichmatesconnectionssharingsometoken.Thish,similartoIRCservers,canalsobeusediftheresponderdoesnottrusttheinitiator,especiallywith(broadcast)replyonions.Theresponderbuildshiswn(trusted)connectiontosomeanonyserver,andasksthatanonertobuildanotherconnectiontotheinitiatorusingareplyonionandtomatethetoconnections.EachpartyisthereforeprotectedbyaroutethatheInOnionRoutingtheencryptionburdenonconnectedintermediatenodesislessthantheburdenoflinkencryptiononrouters.Inlinkencryption,eachpacisencryptedbythesenderanddecryptedbytherecipient.InOnionRoutingtheheaderandpayloadofeachmessagearecryptedseparately:theheaderisencryptedanddecryptedusingtheconnection'sk,andthepayloadiscrypted(onlybytherecipient)usingtheappropriatefunction/keypairassociatedwiththevirtualcircuit.Ourgoalhereisnottoprovideanonymouscommunication,but,toplaceiden-ticationwhereitbelongs.Theuseofapublicnetorkshouldnotautomaticallyealtheidentitiesofcommunicatingparties.Ifanonymouscommunicationisundesirable,itiseasytoimagineltersontheendpointmachinesthatrestrictontosignedmessages.OnionRoutingwillonlybeeectiveincomplicatingtracanalysisifitsxyandRoutingNodesbecomewidespreadandwidelyused.Thereisanob-vioustensionbeteenanonyandlawenforcement.Ifthistensionisresolvinfaoroflawenforcement,itwouldbestraighardtointegrateakeyescrosystemwithintheonion,whicouldmakeroutinginformationaailabletothewfulauthorities.Discussionswithmanypeoplehelpeddeveloptheideasinthispaper.WetothankRanAtkinson,MarkusJakobbsen,JohnMcLean,CathyMeadoAndyMoore,MoniNaor,HolgerPeterson,BirgitPtzmann,MichaelSteiner,andtheanonymousrefereesfortheirhelpfulsuggestions.1.D.unicationsoftheACM,v.24,n.2,Feb.1981,pages84-88.2.D.Chaum,TheDiningCryptoaphersProblem:UncalSenderandRientUntrJournalofCryptology,1/1,1988,pages65-75. vidM.Goldschlag,MichaelG.Reed,andPaulF.Syverson.\HidingRoutingInformation,"orkshoponInformationHiding,Cambridge,UK,Ma,1996. 3.S.ChcurityManagementofATMNetworks,Ph.D.thesis,inprogress,bridgeUniv4.D.E.Comer.InternetworkingwithTCP/IP,Volume1:Principles,Prols,andtice{Hall,EngelwoodClis,NewJersey,1995.5.L.Cottrell.MixmasterandRemailerAloki/remailer/remailer-essa6.C.GulcuandG.Tsudik.MixingEmailwithBabel1996SymposiumonNetandDistributedSystemSecurit,SanDiego,February1996.7.A.PtzmannandB.Ptzmann.HowtoBraktheDirctRSA-implementationofancesinCryptology{EURYPT'89Proceedings,Springer-VBerlin,1990,pages373-381.8.A.Ptzmann,B.Ptzmann,andM.WISDN-Mixes:UntrableCommu-ationwithVerySmallBandwidthOverheGI/ITGConference:CommtioninDistributedSystems,MannheimFeb,1991,Informatik-Fbericte267,erlag,Heildelberg1991,pages451-463.9.A.PtzmannandM.WNetworksWithoutUserObservability,&Securit,6/21987,pages158-166.10.B.ScdCryptoaphy:Prols,AlgorithmsandSoureCodeinC,JohnWileyandSons,1994.11.W.R.StevTCP/IPIllustrd,Volume3:TCPforTansactions,HTTP,NNTP,andtheUNIXDomainPresley,Reading,Mass.,1996.12.L.D.Stein.HowtoSetupandMaintainaWorldWideWebSite:TheGuideforInformationPresley,Reading,Mass.,1995.ThisarticlewasprocessedusingtheLXmacropacagewithLLNCSst