---
abstract: |
    Traffic correlation attacks to de-anonymize Tor users are possible when an adversary is in a position to observe traffic entering and exiting the Tor network. Recent work has brought attention to the threat of these attacks by network-level adversaries ([*e.g.,* ]{}Autonomous Systems). We perform a historical analysis to understand how the threat from AS-level traffic correlation attacks has evolved over the past five years. We find that despite a large number of new relays added to the Tor network, the threat has grown. This points to the importance of increasing AS-level diversity in addition to capacity of the Tor network.

    We identify and elaborate on common pitfalls of AS-aware Tor client design and construction. We find that succumbing to these pitfalls can negatively impact three major aspects of an AS-aware Tor client – (1) security against AS-level adversaries, (2) security against relay-level adversaries, and (3) performance. Finally, we propose and evaluate a Tor client – [Cipollino]{}– which avoids these pitfalls using state-of-the-art in network-measurement. Our evaluation shows that [Cipollino]{}is able to achieve better security against network-level adversaries while maintaining security against relay-level adversaries and performance characteristics comparable to the current Tor client.
author:
- |
    Rishab Nithyanand Rachee Singh Shinyoung Cho Phillipa Gill\
    \
bibliography:
- './bibliography.bib'
title: 'Holding all the ASes: Identifying and Circumventing the Pitfalls of AS-aware Tor Client Design'
---

[**Data and source-code release:** ]{} In an effort to enable reproducibility and ease future comparative evaluation efforts, the following resources will be made available on acceptance of this work: the [Cipollino]{}Tor client, the destination-based graphs provided by PathCache during the time of this study, and the Web and mixed-application user-models used in our simulations.
