FINDING · DEFENSE

DeTorOS's security relies on the honest-but-curious model: if the onion service refuses to participate or lies about its circuit, the client receives no avoidance guarantee. The paper explicitly flags this as an open limitation and notes it cannot be closed without either requiring a TEE on the onion service side or fundamental protocol changes.

From 2023-arora-detor-onion — Provably Avoiding Geographic Regions for Tor's Onion Services · §6 · 2023 · Financial Cryptography and Data Security

Implications

Any provable-avoidance scheme that depends on voluntary counterparty cooperation must be paired with a trust-signaling mechanism (e.g., onion service advertises DeTorOS support in its descriptor) so clients can self-select to services that will participate.
For threat models where the onion service itself may be adversarial or coerced, TEE-based remote attestation on the service side is the only known path to closing the cooperative honesty assumption — treat non-TEE deployments as best-effort rather than provable.