5 ms·
So the end host calculates the entire path in advance, and embeds it in the packet… Imagine if this were augmented with onion routing capabilities, like Tor.
by comex 6y ago
So the end host calculates the entire path in advance, and embeds it in the packet…
Imagine if this were augmented with onion routing capabilities, like Tor. Each address in the path would be encrypted such that only the immediately preceding router can read it. That way, if an attacker intercepts a packet in transit, they can only determine the next hop address, not the final destination.
Yes, yes, this would add a massive amount of overhead and complexity, and it would probably take decades to get implemented.
But I've been wondering what the next step is after encrypted DNS. Encrypted DNS prevents an attacker from knowing which domain name you're connecting to, but they can still see the IP address, and if there's only one site hosted at a given address, that's all they need. So to achieve privacy you need many unrelated sites to be hosted at the same IP, i.e. you need a big CDN. But that risks overcentralization, and it means you have to trust the CDN. What if there was a way to hide the IP address itself?
- parksy 6y agoI took a shotgun approach to it with clacks-p2p. I thought, any directed attempt to send data from A to B is going to leave traces of a path. With enough command of the network you'll be able to figure out from various side-channels who is communicating with whom. Clacks just randomly sends stuff between peers, it's up to the peers to decide if it's relevant or not. With encryption and payload size obfuscation there would be no way to know which node is directing communications with another node. Anyway, obviously the drawback is performance. It might take a while for all your packets to reconvene on the intended target.
- labawi 6y agoIt seems to me, you still have to compromise between having a relatively small number of participants, very high and expensive overhead/throughput and sharing your network with potential attackers, which could observe the network by observing how their own data travels. I think it could work, but only for niche uses or low threat models.
- red0point 6y agoTheir research group actually went down a similar road, and explored a possible design of an anoymous communication network on top of SCION, called HORNET - check this out: https://netsec.ethz.ch/research/anonymity.php https://netsec.ethz.ch/research/anonymity.php
- hollerith 6y ago>What if there was a way to hide the IP address itself? That was the main motivation for TOR (the onion router) but I guess you are asking for a solution at a lower network layer.