# Achieving Sender Anonymity in Tor against the Global Passive Adversary
## 7 Security Analysis  
In this section, we analyze the security of our solution. We start by defining the threat model we consider. We introduce the following assumption:  
**Assumption 1** (A1). : _Rings are formed in such a way that the background knowledge does not allow the adversary to have more information than sender uniform distribution._  
Observe that Assumption A1 is easily satisfied if rings are built among hosts belonging to the same, even large, geographical region. **Adversary Model (AM). ** We consider four types of adversaries. * **External (E). ** In this case, the adversary monitors incoming and outgoing traffic of the DS. In addition, for Ring2 Tor, the adversary monitors traffic coming in and going out from the RM. * **Weak (W). ** In this case, the adversary monitors the traffic between a client node and the entry Tor router. In Tor, the client node corresponds to the OP. To be fair, for  
Figure 8: Ratio \(\frac{j}{k}\) as \(k\) and \(p\) vary. Ring2 Tor, we allow the weak adversary to monitor all the traffic between the client nodes and the traffic between the client node playing as a proxy and the entry Tor router. * **Strong (S). ** In this case, the adversary monitors the traffic between a client node and the entry Tor router and the traffic between the exit Tor router and the destination host. For Ring2 Tor, in addition, the adversary can monitor all the traffic between the client nodes. * **Global (G). ** In this case, the adversary monitors all the traffic of the network. Furthermore, for all the four adversaries, regarding Ring2 Tor, we enable another capability: the adversary knows the entire composition of the rings. Observe that the capabilities of Global, Strong and Weak adversaries are in order (i.e., Global is stronger than Strong and Strong is stronger than Weak). Furthermore, Global is stronger than External. Both the External adversary and the Weak adversary model refer to a very feasible case in which an entity is able to control just an autonomous system. The feasibility of the External adversary can be contrasted by distributing the DS and the RM. The Strong adversary is a weak form of the Global adversary, because the autonomous systems of entry router and exit router can be very far from each other and even be in different continents [14]. The Global adversary is the standard global passive adversary. **Security properties. ** We analyze two security properties (see Section 3): (1) Sender anonymity (SA); (2) Relationship anonymity (RA). In the following analysis, we discuss how Tor and Ring2 Tor behave with respect to the security properties in the four adversary models. The results of the analysis are summarized in Table 1. First, we give a preliminary basic result in the following lemma. **Lemma 1**. : _In_ Ring2 Tor_, a ring of size \(k\) is a sender with an anonymity set of size \(k\) against the Global adversary._  
Proof of Lemma 1.: Due to the hop-by-hop probabilistic encryption mechanism that is used to move tokens inside the ring, the only point of the ring from which the adversary can draw some information more than a random guess to identify a sender is the proxy node. Indeed, this is the only point of the ring in which the possible state transitions of a token could be in principle related to the observable incoming or outgoing traffic in/out of the proxy. Transitions occurring in other points are not identifiable with probability higher than \(\frac{1}{k}\). Since reserved and used tokens cannot be filled by other client nodes different from the sender (associated with the reserved tokens), the only possibility for the adversary to identify a sender anonymity set of size less than \(k\) is to detect an empty token outgoing from a node and track it until it reaches a proxy node, which sends a message outside the ring before doing less than \(k\) steps. The only event in which the adversary can guess that a token is emptied is when a proxy node, say \(r_{x}\), dismisses a Tor circuit.