# Achieving Sender Anonymity in Tor against the Global Passive Adversary
## 7 Security Analysis
Indeed, according to the protocol, there is no other case in which tokens are emptied. However, \(r_{x}\) sets the field \(HID\) to \(H(PK_{next(r_{x})})\), and this means that such a token moves around the entire ring (in which it is, possibly, filled) before reaching \(next(r_{x})\), which possibly builds a Tor circuit outside the ring. Therefore, we can argue that the sender anonymity set is not always larger than \(k\), even for the Global passive adversary. The proof is then concluded. The above lemma is the basis for the fulfillment of the security properties stated above for Ring2 Tor. This is proven through the following theorems. The first theorem states that Tor does not guarantee **SA** against any adversary. This corresponds to the first four fields of the first row of Table 1.  
**Theorem 1**. : _In Tor, any adversary breaks **SA** with probability 1._Proof of Theorem 1.: Consider the External adversary. Since it observes the traffic intended to the DS, it receives the request of the sender and then the sender is identified. Since the Global adversary has the same capabilities as the External adversary, **SA** does not hold against it. Now, we consider the Weak adversary able to observe the traffic between the sender and the entry Tor router. Clearly, **W** identifies the sender. The Strong adversary has the same capabilities as the Weak adversary. The proof is then concluded. Now, we prove that RingTor guarantees that a sender can be identified (by any adversary) with probability \(\frac{1}{k}\). This corresponds to the first four fields of the second row of Table 1.  
**Theorem 2**. : _In RingTor, any adversary breaks **SA** with probability \(\frac{1}{k}\)._  
Proof of Theorem 2.: Consider the Global adversary **G**. By Lemma 1, it can identify the sender with a probability not higher than \(\frac{1}{k}\). Since **G** is stronger than all the other adversaries (i.e., **S**, **W**, and **E**), we conclude that for those three adversaries also, **SA** is broken with a probability not higher than \(\frac{1}{k}\). Now, we have to consider the remaining fields of Table 1 regarding relationship anonymity. These are covered by the following two theorems. **Theorem 3**. : _Let \(n_{d}\) be the size of the recipient anonymity set. In Tor, the External and Weak adversary break RA with probability \(\frac{1}{n_{d}}\). Furthermore, the Strong and Global adversary break RA with probability \(1\)._  
Proof of Theorem 3.: Consider the External adversary. By Theorem 1, it identifies the sender \(SN\) of a communication with probability \(1\). Anyway, **E** has no information about the recipient \(R\) of such a communication. Therefore, **E** (without further knowledge) identifies that \(SN\) communicates with \(R\) only with the smallest probability, i.e., \(\frac{1}{n_{d}}\). Similarly, the Weak adversary identifies the sender with probability \(1\), but has no information about the recipient. Therefore, **RA** is broken with probability \(\frac{1}{n_{d}}\). Consider the Strong adversary **S**. Since it monitors the outgoing traffic from the exit Tor router, it can identify the recipient \(R\) of a communication with probability \(1\). Since **S** also monitors the traffic between the sender \(SN\) and the entry Tor router, it can perform traffic analysis attacks [14] and identifies that \(SN\) communicates with \(R\) with probability \(1\). The Global adversary has the same power as the Strong adversary. The proof is then concluded. **Theorem 4**. : _Let \(n_{d}\) be the size of the recipient anonymity set. In RingTor, the External and Weak adversary break RA with probability \(\frac{1}{n_{d}-k}\). Furthermore, the Strong and Global adversary break RA with probability \(\frac{1}{k}\)._  
Proof of Theorem 4.: Since **SA** implies **RA**[7], by Theorem 2, it follows that **RA** can be broken with a probability not higher than \(\frac{1}{k}\) by any adversary. Consider now the adversaries \(E\) and \(W\). Even though they can identify the sender with a probability not higher than \(\frac{1}{k}\),