-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256
On 08/05/14 14:40, Christopher Baines wrote:
Perhaps it would make sense to pick one or more IPs per guard, and change those IPs when the guard is changed? Then waldo's attack by a malicious IP would only ever discover one guard.
If you change the IP's when the guard is changed, this could break the consistency between different instances of the same service (assuming that the different instances are using different guards).
It should be possible to avoid breaking consistency by having an overlap period: when a guard is scheduled to be replaced, each instance connects to a new guard and IPs, the new descriptor is published, then each instance disconnects from the old guard and IPs.
This should work whether or not the instances use the same guards. If the instances use the same guards, waldo's attack can discover one guard shared by all instances; otherwise it can discover one guard per instance. I'm not sure which is worse for anonymity - any thoughts?
Cheers, Michael