Can Tor be replaced?

After interviewing numerous leading anonymity researchers for this article, one thing becomes clear: Tor is not going away any time soon. The most probable future we face is a world in which Tor continues to offer a good-but-not-perfect, general-purpose anonymity system, while new anonymity networks arrive offering stronger anonymity optimised for particular use-cases, like anonymous messaging, anonymous filesharing, anonymous microblogging, and anonymous voice-over-IP.

Nor is the Tor Project standing still. Tor today is very different from the first public release more than a decade ago, Mathewson is quick to point out. That evolution will continue.

"It's been my sense for ages that the Tor we use in five years will look very different from the Tor we use today," he says. "Whether that's still called Tor or not is largely a question of who builds and deploys it first. We are not stepping back from innovation. I want better solutions than we have today that are easier to use and protect people's privacy."

The following five projects are breaking new ground in developing stronger anonymity systems. Here's a rundown of the big ideas in this space, the current status of each project, and speculation from the researchers about when we might expect to see real-world deployment.

Herd: Signal without the metadata

The twin Aqua/Herd projects look closest to real-world deployment, so let's start there. Aqua, short for "Anonymous Quanta," is an anonymous file-sharing network design. Herd, based on Aqua, and with similar anonymity properties, is an anonymous voice-over-IP network design—"Signal without the metadata," as its project leader Stevens Le Blond, a research scientist at the Max Planck Institute for Software Systems (MPI-SWS) in Germany, explains to Ars.

Le Blond reports that his team has implemented a working Herd prototype at MPI-SWS, and together with their colleagues from Northeastern University in the United States, have just raised half-a-million dollars from the US National Science Foundation to deploy Herd, Aqua, and other anonymity systems over the next three years. With funding in hand, Le Blond hopes to see the first Herd nodes online and ready for users in 2017.

Both Herd and Aqua work by padding traffic with “chaff”—random noise that makes a user’s traffic indistinguishable from any other user on the network. Unlike Tor, which can, with difficulty, be used for VoIP in a CB-radio kind of way, Herd promises usable, secure, anonymous VoIP calls.

"Aqua and Herd attempt to reconcile efficiency and anonymity by designing, implementing, and deploying anonymity networks which provide low latency and/or high bandwidth without sacrificing anonymity," Le Blond says.

According to Ford, the Herd/Aqua projects offer the most incremental advances in anonymity technology. "It's not inconceivable that something like Aqua or Herd could replace Tor," he says.

Vuvuzela/Alpenhorn: Metadata-free chat

Vuvuzela, named after the buzzy horn common at soccer matches in Africa and Latin America, and its second iteration, Alpenhorn, aim to offer anonymous, metadata-free chat. The best available metadata-free chat application today is Ricochet, while the abandoned Pond project also looked promising for a while. Alpenhorn, however, will offer stronger privacy guarantees, according to project leader David Lazar.

"Pond and Ricochet rely on Tor, which is vulnerable to traffic-analysis attacks," Lazar says. "Vuvuzela is a new design that protects against traffic analysis and has formalised privacy guarantees."

"Our experiments show that Vuvuzela and Alpenhorn can scale to millions of users," he adds, "and we're currently working on deploying a public beta."

Developed by a team of researchers at MIT's Computer Science and Artificial Intelligence Laboratory (CSAIL), Vuvuzela's approach to anonymous chat is to encrypt the metadata that it can, add noise to the metadata that it can't, and use differential privacy to analyse how much anonymity this noise provides.

Alpenhorn checks in at just over 3,000 lines of Go. At scale, the network promises latency of ~37 seconds per message, assuming around a million simultaneous users, with a throughput of 60,000 messages per second.

The Alpenhorn team will present their research at the 2016 Usenix Symposium on Operating Systems Design and Implementation (OSDI) in November.

"We are currently working on the final version of the Alpenhorn paper and on making the Vuvuzela and Alpenhorn code ready for production," Lazar says. "In the meantime, users can sign up to our e-mail list for updates on our progress.”

Dissent: The strongest-available anonymity

With strong anonymity guarantees come trade-offs in latency and bandwidth. Bryan Ford's Dissent Project made a bit of a splash a few years ago by pushing the slider to 11 on the anonymity scale. Dissent's proof-of-concept offers cryptographically provable anonymity—but at a high cost in terms of scalability and usability.

Unlike Tor's onion-routing model, Dissent is based on a dining cryptographers algorithm, or "DC-net." Combined with a verifiable-shuffle algorithm, Dissent offers the most anonymous design currently under investigation by researchers.

Dissent's high latency and low bandwidth make it most suitable for, well, dissent. The project's optimal use-case is one-to-many broadcasting that does not require real-time interaction, such as blogging, microblogging (anonymous Twitter, anyone?), or even IRC.

DC-nets work because when one client wishes to broadcast a message, all other clients on the network must broadcast a message of the same size. This creates a large bandwidth-overhead, and at present Dissent only scales to a few thousand users—although Ford says his team is working on improving the efficiency of the algorithm.

Dissent also has the potential to offer what Ford calls "PriFi"—integrated into a corporate or campus WiFi network, the platform could offer provably anonymous Web browsing within that set of users. A passive observer would know someone on campus was viewing a certain website, for example, but they would not be able to identify which user it was. PriFi traffic connecting to the Tor network would offer even stronger anonymity.

The Dissent team is in the process of redesigning Dissent and rewriting it in Go, and some of the new components, Ford says, are available on Github, but not yet ready as part of a complete system.

"Unfortunately none of this code is really ready for users who want a full ‘anonymity system’ to play with," Ford says, "but strong hacker-types who might want to help us further develop the pieces and/or help us put them together into usable applications are of course welcome to try them and get in touch."

Dissent has become something of a touchstone among anonymity researchers. The following two projects were both inspired, in part, by Dissent and a desire to make a more efficient anonymity system while still retaining much of Dissent's strength.

Riffle: Anonymous filesharing

Like Aqua, Riffle's main use-case is anonymous filesharing. Contrary to some reports that its new anonymity system could replace Tor, Riffle would, if successfully deployed, not only complement Tor, but perhaps even make it faster by giving users sharing large files a more secure alternative.

"[Riffle is] not a replacement for Tor but complementary to Tor," says Albert Kwon, a graduate student at MIT and the project’s lead researcher. "We have a very different goal. Our goal is to provide the strongest level of practical anonymity we could think of."

Kwon's interest in developing anonymous filesharing has nothing to do with enabling copyright infringement, he explains, but rather a desire to help journalists anonymously share large files and to make it easier for whistleblowers to submit large document sets to publishers.

Over Tor, "sending a very large file in a very short period of time is drastically different from Web browsing,” he says, “and much easier to fingerprint in that sense. I'd like to set up a filesharing group that wants to be anonymous; a lot of journalists are willing to have something like this running."

Riffle was inspired by the Dissent project and, like Dissent, uses a verifiable shuffle algorithm (hence the name "Riffle"), but forgoes the DC-net crypto primitive in order to make the network more efficient. It could also be used for anonymous microblogging, Kwon says, though as an academic prototype, it is not usable by a "regular person." He plans to spend the next semester building a public alpha release.

Riposte: An anonymous Twitter

Like Riffle, Riposte was inspired by Dissent, but the design has been fine-tuned for one specific use-case: microblogging.

"This is an example of where, if you're willing to tailor your system design to an application, you can get much better performance," says Henry Corrigan-Gibbs, a graduate student at Stanford's Applied Crypto Group and Riposte’s lead researcher. "You can't solve all the problems at the same time."

Riposte maintains the strong anonymity properties of a DC-net, including resistance to both traffic analysis and to disruption attacks by malicious clients, but scales to millions of users. The tradeoff, again, is much higher latency—but, Corrigan-Gibbs says, that may be acceptable for a Twitter-like service.

"Low-latency anonymity is inherently problematic when you're looking at an adversary that is able to see large parts of—or the interesting parts of—the network," he explains.

Riposte currently exists as an academic prototype. Corrigan-Gibbs says the team is working on improving the system’s anonymity and security properties. “My hope,” he tells Ars, “is to get some of the ideas from Riposte (if not the code itself) integrated into existing communication platforms for privacy-sensitive users.”

The Riposte team has no plans to deploy the network on its own, at least for now. "I come up with design ideas and prototype the system to show that it works," he explains. "And it takes a whole 'nother set of important skills to build something. The Tor Project is very impressive to keep this massive distributed system running ... and with relatively little funding."