One Fast Guard for Life (or 9 months)

“Entry Guards” in the Tor anonymity network mitigate against several traffic analysis attacks including the “predecessor” attack, statistical profiling, and passive AS-level correlation attacks. Several recent works have shown that the current design does not provide sufficient mitigation against these attacks and may also introduce new vulnerabilities. We propose a simple response to these results: Tor clients should move from using three entry guards to a single, fast entry guard, and rotate entry guards after 9 months rather than after 45 days. We measure the likely effect on anonymity and performance of these changes, and discuss some of the remaining problems with entry guards not addressed by this proposal.