diff options
Diffstat (limited to 'doc/tor-design.tex')
| -rw-r--r-- | doc/tor-design.tex | 37 |
1 files changed, 7 insertions, 30 deletions
diff --git a/doc/tor-design.tex b/doc/tor-design.tex index 9893e58a7..89399c6bb 100644 --- a/doc/tor-design.tex +++ b/doc/tor-design.tex @@ -1379,39 +1379,16 @@ we make the simplifying assumption that all participants agree on the set of directory servers. Second, while Mixminion needs to predict node behavior, Tor only needs a threshold consensus of the current -state of the network. - -% XXXX Do we really want this next part? It isn't really sound, and -% XXXX we haven't implemented it. -NM -Tor directory servers build a consensus directory through a simple -four-round broadcast protocol. In round one, each server dates and -signs its current opinion, and broadcasts it to the other directory -servers; then in round two, each server rebroadcasts all the signed -opinions it has received. At this point all directory servers check -to see whether any server has signed multiple opinions in the same -period. Such a server is either broken or cheating, so the protocol -stops and notifies the administrators, who either remove the cheater -or wait for the broken server to be fixed. If there are no -discrepancies, each directory server then locally computes an algorithm -(described below) -on the set of opinions, resulting in a uniform shared directory. In -round three servers sign this directory and broadcast it; and finally -in round four the servers rebroadcast the directory and all the -signatures. If any directory server drops out of the network, its -signature is not included on the final directory. - -The rebroadcast steps ensure that a directory server is heard by -either all of the other servers or none of them, even when some links -are down (assuming that any two directory servers can talk directly or -via a third). Broadcasts are feasible because there are relatively few -directory servers (currently 3, but we expect as many as 9 as the network -scales). Computing the shared directory locally is a straightforward -threshold voting process: we include an OR if a majority of directory -servers believe it to be good. +state of the network. Third, we assume that we can fall back to the +human administrators to discover and resolve problems when a concensus +directory cannot be reached. Since there are relatively few directory +servers (currently 3, but we expect as many as 9 as the network scales), +we can afford operations like broadcast to simplify the consensus-building +protocol. To avoid attacks where a router connects to all the directory servers but refuses to relay traffic from other routers, the directory servers -must build circuits and use them to anonymously test router +must also build circuits and use them to anonymously test router reliability~\cite{mix-acc}. Unfortunately, this defense is not yet designed or implemented. |