Problem

The Wasabi coordinator as the enemy

Wasabi is an Open Source software project and as such anyone can glone the repository, compile the project and deploy its own coordinator. Nothing prevent a developer to modify the code and deploy a modified version on its own infrastructure and that’s why Wasabi is developed with the mindset that there could be multiple coordinators and that the users should need to trust on those or, in better terms, that the Wasabi client should protect the users by assuming that the coordinator that it is connected to is malicious.

Client and Tor circuit building

Wasabi client must then not only to make sure also that a coordinator cannot correlate a sequence of requests to a single identity (IP address) and it uses a different Tor circuit for each request which identity isolation have to be guarranted.

However, Tor circuits creation is expensive in terms of network roundtrips and CPU, what forced the Wasabi team to introduce many mechanism/ optimizations to reduce the number and frequence of circuit creation.

Current approach

Currently Wasabi uses stream isolation, this is one stream by circuit what also meand that you need to build as many circuits as streams you need. But lets introduce some concepts first and discuss more about this after.

What is a Tor circuit?

A Tor circuit is simple a chain of onion routers, tipically is consists on a sequence of three routers: an entry guard router, a middle router and the exit router. However that is only the composition used by default and a circuit can be build with more and less routers.

In the graph below you can see how it would looks like to connect to the Wasabi coordinator using three different identities (circuits).

Circuits:

• Entry guard -> node 1 -> node 2 -> Coordinator
• Entry guard -> node 11 -> node 5 -> Coordinator
• Entry guard -> node 10 -> node 11 -> Coordinator

The coordinator receives http requests from three different nodes: node 2, node 5 and node 11. In other words, the coordinator only knows the IP addresses of those routers.

TCP stream

An stablished circuit can encapsulate multiple tcp streams independently of their final destination. However, it is important to know that if well the tipical mantal image of a Tor circuit looks like a pipe with two holes, one entry and one exit, the reality is more like a pipe with multiple holes that leak.

Proposal

Once we know that circuits can have more than only three routers and that more than one routers can act as exit routers it is easy to imagine how the three circuits ilustrated in the first image can be replaces by only one circuit with three exits like the one below: