Cryptology ePrint Archive: Report 2021/374

ZXAD: High-volume Attack Mitigation for Tor

Akshaya Mani and Ian Goldberg

Abstract: The Tor anonymity network is often abused by some attackers to (anonymously) convey attack traffic. These attacks abuse Tor exit relays (i.e., the relays through which traffic exits Tor) by making it appear the attack originates there; as a result, many website operators indiscriminately block all Tor traffic (by blacklisting all exit IPs), reducing the usefulness of Tor.

Recent research shows that majority of these attacks are ones that generate high traffic volume (e.g., Denial-of-Service attacks). This suggests that a simple solution such as throttling traffic flow at the Tor exits may permit early detection of these attacks, improve overall reputation of exits, and eventually prevent blanket blocking of Tor exits. However, naively monitoring and throttling traffic at the Tor exits can endanger the privacy of the network's users.

This paper introduces ZXAD (pronounced "zed-zad"), a zero-knowledge based _private_ Tor exit abuse detection system that permits identification of otherwise unlinkable connections that are part of a high-volume attack. ZXAD does not reveal any information, apart from the fact that some user is conveying a high volume of traffic through Tor. We formally prove the correctness and security of ZXAD. We also measure two proof-of-concept implementations of our zero-knowledge proofs and show that ZXAD operates with low bandwidth and processing overheads.

Category / Keywords: applications / anonymity, privacy enhancing technologies, zero knowledge

Original Publication (with minor differences): WPES 2021

Date: received 20 Mar 2021, last revised 22 Sep 2021

Contact author: akshaya mani at uwaterloo ca, iang at uwaterloo ca

Available format(s): PDF | BibTeX Citation

Version: 20210922:213747 (All versions of this report)

Short URL:

[ Cryptology ePrint archive ]