💻 computer science

I've Seen This IP: A Practical Intersection Attack Against Tor Introduction Circuits and Hidden Services

This paper presents a practical intersection attack that exploits the deterministic routing structure of Tor introduction circuits to identify service hops through repeated probes and time-windowed IP intersection, demonstrating its feasibility in live networks without requiring global visibility or payload access.

Original authors: Nicolas Constantinides

Published 2026-03-02

📖 5 min read🧠 Deep dive

CC BY 4.0

Original authors: Nicolas Constantinides

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

Imagine the Tor network as a massive, high-tech game of "Hide and Seek" played on the internet. Its goal is to let people talk to each other without anyone knowing who they are or where they are.

Here is how the game usually works:

The Onion: Your message is wrapped in layers of encryption (like an onion).
The Relay Race: Your message hops through three different strangers (relays) before reaching its destination. Each relay only knows the person who handed it the message and the person they are passing it to. No single relay knows the whole path.
The Hidden Service: Sometimes, you want to visit a secret website (an "Onion Service") that doesn't want to reveal its location either. To do this, they set up a special, long-lasting meeting point called an Introduction Circuit.

The Paper's Big Discovery: "The Intersection Attack"

The authors of this paper found a clever way to cheat at this game of Hide and Seek. They discovered that while the content of the messages is secret, the timing and the path of these secret meetings have a predictable pattern.

Here is the attack explained in simple terms:

1. The Setup: A Long-Lasting Meeting

Most internet connections are like quick handshakes—they happen and then disappear. But the secret "Introduction Circuits" used by Hidden Services are like long-term leases. They stay active for 18 to 24 hours. This gives an attacker a huge window of time to watch.

2. The Strategy: The "Party Guest" Game

Imagine you are a spy trying to figure out who is sitting at a secret table in a crowded, noisy restaurant (the Tor network). You can't see the whole room, and you can't hear the conversations. You can only stand at one specific table (the "Introduction Point") and watch who walks by.

Here is your plan:

The Probe: You send a secret note to the person at your table saying, "I want to meet the secret host."
The Window: You know that exactly 1 second later, the person at your table will pass a message to the next person in the chain.
The List: During that 1-second window, you write down the names of everyone who walks past your table.
- The Problem: In a busy restaurant, hundreds of people walk by. Your list is huge and useless. It's an "Anonymity Set."

3. The Magic Trick: Intersection

Now, you repeat this probe 50 or 100 times.

Trial 1: You see 500 people walk by. The secret person is in there.
Trial 2: You see 480 different people. The secret person is still in there.
Trial 3: You see 400 people.

The "Intersection" is the key:
The only person who appears on every single list is the one you are looking for. Everyone else is just background noise (other customers eating lunch) who only happened to walk by once or twice.

By crossing out everyone who didn't appear every time, your list shrinks.

List 1: 500 people.
List 2: 500 people.
The Overlap: Only 1 person remains.

Bingo. You have identified the next person in the chain.

4. The Domino Effect

Once you identify the second person, you move your spy to stand next to them. You repeat the process. You find the third person. Then the fourth. Eventually, you have mapped the entire path from the secret meeting point all the way to the hidden server's actual location.

Why Does This Work?

The paper explains that this works because of three main reasons:

Patience: The secret circuits stay open for so long (18+ hours) that you have plenty of time to run your "probe" experiment.
Predictability: The secret path doesn't change. The "next person" is always the same, while the background noise (other internet users) changes constantly.
Local Spying: You don't need to be a super-spy watching the whole internet. You only need to be able to watch one relay at a time. If a government or a group of cooperating countries controls enough relays, they can do this step-by-step.

The Real-World Impact

The authors tested this on a secret website they created themselves. They successfully identified every single "hop" in the chain, proving that Tor's hidden services are not as anonymous as we thought if an attacker is patient and uses this specific "Intersection Attack."

They also noted that this is easier if the secret servers are located in countries that share intelligence (like the "14 Eyes" alliance), because those countries likely control many of the "relay stations" (the restaurants) where the spies are standing.

The Takeaway

Tor is still a great tool for privacy, but this paper shows that long-term connections are a weakness.

The Solution?
The authors suggest that instead of keeping the secret meeting path open for 24 hours, the system should change the path every few minutes (like changing the route of a bus while keeping the same bus stop). This would make the "Intersection Attack" fail because the "next person" would keep changing, and the spy would never be able to narrow down the list to just one person.

In short: The paper shows that if you watch a secret meeting long enough and cross-reference the guests, you can figure out exactly who is sitting at the table.

1. Problem Statement

The paper addresses a critical vulnerability in the Tor Onion Service (Hidden Service) protocol, specifically targeting the Introduction Circuit. While Tor is designed to anonymize traffic, the introduction protocol—which facilitates the initial handshake between a client and a hidden service—relies on long-lived circuits with deterministic routing structures.

The Vulnerability: Unlike standard Tor circuits which are short-lived (approx. 10 minutes) to prevent correlation, introduction circuits are designed to persist for 18–24 hours. This extended lifetime, combined with the static nature of the path from the Introduction Point (IP) to the Hidden Service, creates a window for intersection attacks.
The Threat Model: The authors assume a partial-global adversary who can observe traffic at a single relay (e.g., via ISP cooperation) but does not require global network visibility or access to packet payloads. The adversary's goal is to iteratively identify every hop in the introduction circuit to deanonymize the hidden service's location.

2. Methodology: The Intersection Attack

The proposed attack exploits the deterministic behavior of the introduction protocol to narrow down the set of possible next-hop relays.

Core Mechanism

Anonymity Set Construction: When an adversary monitors a relay (e.g., the Introduction Point) during an INTRODUCE1 to RENDEZVOUS2 transaction, they observe all destination IP addresses that communicate with that relay within the specific time window ( $\Delta t \approx 0.5–1.5$ seconds).
The Intersection Logic:
- The true successor relay in the circuit must appear in the traffic set for every single trial because the protocol requires the packet to pass through it.
- Background noise (other unrelated Tor traffic) varies across trials due to circuit churn and path selection randomness.
- By repeatedly initiating INTRODUCE1 requests and recording the set of observed IPs ( $A_t$ ) for each trial, the adversary computes the intersection: $I_t = A_1 \cap A_2 \cap \dots \cap A_t$ .
- Over time, the noise cancels out, and the set shrinks until only the true successor relay remains ( $|I_t| = 1$ ).
Iterative Progression: Once the first successor is identified, the adversary moves to observe that new relay and repeats the process to identify the next hop, eventually reconstructing the entire circuit up to the hidden service.

Experimental Setup

Live Network: The authors conducted experiments on the live Tor network using a self-operated hidden service and four relays they controlled (Introduction Point, Middle 1, Vanguard/Middle 0, and Entry Guard).
Ethical Safeguards: To adhere to Tor Research Safety Board guidelines, they used data minimization. They did not store packet payloads or raw IPs. Instead, destination IPs were immediately pseudonymized using a one-way cryptographic function ( $SHA256(RSA_{pk}(IP))$ ) and stored only in volatile memory.
Variables: The study tested convergence rates across different times of day (to account for traffic load) and against relays with varying consensus weights (bandwidth reputation).

3. Key Contributions

Identification of Deterministic Patterns: The paper explains how the introduction protocol's static routing and long circuit lifetimes create a predictable pattern exploitable by intersection attacks.
Practical Demonstration: It provides the first live-network validation of an intersection attack on Tor introduction circuits, proving that an adversary with visibility at only one relay per stage can deanonymize the entire path.
Quantification of Feasibility: The study quantifies the number of trials required for convergence, showing that the attack is practical and reliable under real-world conditions.
Jurisdictional Risk Analysis: It analyzes the geographic concentration of Tor relays, demonstrating that coordinated state-level adversaries (e.g., the "Fourteen Eyes" alliance) have a statistically high probability of observing multiple hops in a single circuit due to the concentration of high-weight relays in their jurisdictions.

4. Results and Analysis

The experiments confirmed that the attack reliably converges, though the speed depends on specific network factors:

Convergence Speed: The number of trials required to isolate a relay varied significantly:
- Entry Guards: High consensus weight relays (e.g., ~9300) required more trials (31–78) due to higher selection probability and larger anonymity sets.
- Middle Relays: Generally converged faster (4–20 trials) due to lower traffic volume.
- Outliers: In some cases, convergence took significantly longer (e.g., 285 trials for an Introduction Point) due to persistent background traffic patterns where unrelated users selected similar path segments.
Time Variance: Convergence was affected by the time of day, with higher background traffic generally slowing the process by increasing the size of the initial anonymity sets.
Geographic Concentration: The analysis of Tor relay statistics (as of Nov 2025) revealed that approximately 35.3% of introduction circuits could theoretically have all four hops hosted within "Fourteen Eyes" jurisdictions. This suggests that a coordinated multi-jurisdiction adversary could realistically observe the entire circuit without needing global visibility.

5. Significance and Implications

Threat to Anonymity: The paper demonstrates that Tor onion services are not immune to intersection attacks, challenging the assumption that long-lived circuits are safe from traffic analysis.
Partial-Global Adversary: The attack proves that a powerful adversary does not need to control the entire network or decrypt traffic; observing a single relay at each stage is sufficient to break anonymity.
Policy and Infrastructure: The findings highlight the risks associated with the geographic concentration of Tor relays in Western nations, suggesting that intelligence-sharing alliances could effectively collaborate to deanonymize targets.
Future Mitigations: The authors propose that periodically rebuilding introduction circuits (e.g., every few minutes) while keeping the same Introduction Point could disrupt the attack. This would introduce path diversity, preventing the intersection of static paths, though it would increase circuit construction overhead.

Conclusion

This work establishes that the Tor introduction protocol contains a structural weakness allowing for practical deanonymization via intersection attacks. The combination of long circuit lifetimes, deterministic routing, and geographic relay concentration creates a viable attack surface for state-level adversaries. The authors emphasize that while they demonstrated feasibility, the design of robust countermeasures (such as dynamic circuit reconstruction) remains a critical area for future research.