The Cost of Stability: Deanonymizing Onion Services Long-Lived Introduction Circuits

In the 30 November 2025 Onionoo snapshot, approximately 75% of both guard and middle relay selection-probability mass lies within Fourteen-Eyes jurisdictions, with Germany, the United States, and the Netherlands hosting the largest shares. Because path selection is bandwidth-weighted, a state-level adversary from one of these jurisdictions is statistically likely to have ISP-level visibility at most relays a target introduction circuit passes through.

Appendix D, Fig. 7 evaluation flow-correlation generic

An adaptive intersection attack exploiting the 18–24h fixed lifetime of Tor onion-service introduction circuits reconstructed the complete four-hop introduction circuit in all nine live-network experiments. The median reconstruction required 260 iterations with an estimated median wall-clock time of 2.24h (12% of the 18h circuit lifetime) when per-relay visibility cost v=0; the slowest run completed in 6.63h (37% of 18h).

§4.2, Table 1 detection flow-correlationtraffic-shape generic

A persistent 'tail' of recurring candidates — not the early phase — dominates convergence cost and introduces high variance: three Vanguard stages at identical consensus weight 1200 converged at iterations 12, 142, and 251. In 13 of 36 stages, the intersection held ≥3 candidates at the penultimate iteration and collapsed to a singleton in one step, suggesting the tail is caused by persistent third-party guard/vanguard traffic rather than random noise.

§4.2, Table 2 detection flow-correlationtraffic-shape generic

Across all 36 stages in the nine end-to-end experiments, the median iteration at which the running intersection shrank to ≤10 candidates was 3, and 64% of stages reached this threshold within 5 iterations. Per-stage candidate sets shrank by 72–87% after the first intersection and by 85–96% by the third iteration, driven by the short (~0.5–1.8s) observation windows that prevent unrelated circuits from injecting persistent false candidates.

§4.2 detection flow-correlationtraffic-shape generic

Periodically rebuilding only the internal service-side path of the introduction circuit (entry guard → vanguard → middle relay) approximately every 10 minutes — while keeping the publicly advertised Introduction Point fixed — limits evidence accumulation to one rebuild interval without requiring a descriptor update. Under this mitigation the effective circuit lifetime visible to an intersection attacker drops from 18–24h to ~10 min, matching ordinary Tor circuit lifetimes.

§5 defense flow-correlation generic