Tor 的 Onion 導入防禦機制，在遭受 DoS 的時候要求用戶端執行 PoW 任務

在「Introducing Proof-of-Work Defense for Onion Services」這邊看到 0.4.8 的新機制，當 Onion 服務受到 DoS 時，會需要 client 提供 PoW 證明，有證明的會優先處理：

Tor’s PoW defense is a dynamic and reactive mechanism, remaining dormant under normal use conditions to ensure a seamless user experience, but when an onion service is under stress, the mechanism will prompt incoming client connections to perform a number of successively more complex operations. The onion service will then prioritize these connections based on the effort level demonstrated by the client.

主要原因是傳統遇到 DoS 時可以透過 IP address 之類的資訊設計阻擋機制，但在 Onion 服務裡面沒有這個資訊，所以需要其他方式阻擋：

The inherent design of onion services, which prioritizes user privacy by obfuscating IP addresses, has made it vulnerable to DoS attacks and traditional IP-based rate limits have been imperfect protections in these scenarios. In need of alternative solutions, we devised a proof-of-work mechanism involving a client puzzle to thwart DoS attacks without compromising user privacy.

這個 PoW 機制的說明可以在「torspec/proposals/327-pow-over-intro.txt」這邊看到，看起來是三年前 (2020/04/02) 就提出來了，直到 0.4.8 才推出。

裡面有提到 PoW 的演算法是用 Equi-X：

For our proof-of-work function we will use the Equi-X scheme by tevador [REF_EQUIX].

看起來是個方法，而且從 cryptocurrency 後大家對 PoW 的用法愈來愈熟悉了，在這邊用還不錯…

Read More