Tor uses AES in CTR mode, keystream blocks are XORed with the plaintext to get the resulting ciphertext. https://en.wikipedia.org/wiki/Keystream
....so yes I guess I do think that Tor XOR's data?
Hm this paper looks interesting, from december 2011.
http://freehaven.net/anonbib/cache/acsac11-backlit.pdf
Traffic watermarking is an important element in many network se-
curity and privacy applications, such as tracing botnet C&C com-
munications and deanonymizing peer-to-peer VoIP calls. The state-
of-the-art traffic watermarking schemes are usually based on packet
timing information and they are notoriously difficult to detect. In
this paper, we show for the first time that even the most sophisti-
cated timing-based watermarking schemes (e.g., RAINBOW and
SWIRL) are not invisible by proposing a new detection system
called BACKLIT. BACKLIT is designed according to the obser-
vation that any practical timing-based traffic watermark will cause
noticeable alterations in the intrinsic timing features typical of TCP
flows. We propose five metrics that are sufficient for detecting
four state-of-the-art traffic watermarks for bulk transfer and inter-
active traffic. BACKLIT can be easily deployed in stepping stones
and anonymity networks (e.g., Tor), because it does not rely on
strong assumptions and can be realized in an active or passive mod-
e. We have conducted extensive experiments to evaluate BACK-
LIT’s detection performance using the PlanetLab platform. The
results show that BACKLIT can detect watermarked network flows
schemes, such as RAINBOW and SWIRL with high accuracy and few false positives.
Show Posts
