mirror of
https://github.com/torproject/torspec.git
synced 2024-12-03 16:10:42 +00:00
60 lines
2.2 KiB
Plaintext
60 lines
2.2 KiB
Plaintext
Filename: 277-detect-id-sharing.txt
|
|
Title: Detect multiple relay instances running with same ID
|
|
Author: Nick Mathewson
|
|
Created: 20-Feb-2017
|
|
Status: Open
|
|
Target: 0.3.??
|
|
|
|
1. Overview
|
|
|
|
This document proposes that we detect multiple relay instances running
|
|
with the same ID, and block them all, or block all but one of each.
|
|
|
|
2. Motivation
|
|
|
|
While analyzing microdescriptor and relay status transitions (see
|
|
proposal XXXX), I found that something like 16/10631 router
|
|
identities from January 2017 were apparently shared by two or
|
|
more relays, based on their excessive number of onion key
|
|
transitions. This is probably accidental: and if intentional,
|
|
it's probably not achieving whatever the relay operators
|
|
intended.
|
|
|
|
Sharing identities causes all the relays in question to "flip" back
|
|
and forth onto the network, depending on which one uploaded its
|
|
descriptor most recently. One relay's address will be listed; and
|
|
so will that relay's onion key. Routers connected to one of the
|
|
other relays will believe its identity, but be suspicious of its
|
|
address. Attempts to extend to the relay will fail because of the
|
|
incorrect onion key. No more than one of the relays' bandwidths will
|
|
actually get significant use.
|
|
|
|
So clearly, it would be best to prevent this.
|
|
|
|
3. Proposal 1: relay-side detection
|
|
|
|
Relays should themselves try to detect whether another relay is using
|
|
its identity. If a relay, while running, finds that it is listed in
|
|
a fresh consensus using an onion key other than its current or
|
|
previous onion key, it should tell its operator about the problem.
|
|
|
|
(This proposal borrows from Mike Perry's ideas related to key theft
|
|
detection.)
|
|
|
|
4. Proposal 2: offline detection
|
|
|
|
Any relay that has a large number of onion-key transitions over time,
|
|
but only a small number of distinct onion keys, is probably two or
|
|
more relays in conflict with one another.
|
|
|
|
In this case, the operators can be contacted, or the relay
|
|
blacklisted.
|
|
|
|
We could build support for blacklisting all but one of the addresses,
|
|
but it's probably best to treat this as a misconfiguratino serious
|
|
enough that it needs to be resolved.
|
|
|
|
|
|
|
|
|