FlashFlow: A Secure Speed Test for Tor

The Tor network uses a measurement system called TorFlow to estimate its relays' forwarding capacity and to balance traffic among them. This system has been shown to be vulnerable to adversarial manipulation, and inaccuracies even in benign circumstances have long been observed. To solve the issues with security and accuracy, we present FlashFlow, a system to measure the capacity of Tor relays. Our analysis shows that FlashFlow limits a malicious relay to obtaining a capacity estimate at most 1.33 times its true capacity. Through realistic Internet experiments, we find that FlashFlow measures relay capacity with
$\geq {89\%}$
accuracy 95 % of the time. Through simulation, we find that FlashFlow can measure the entire Tor network in less than 5 hours using 3 measurers with 1 Gbit/s of bandwidth each. Performance simulations using FlashFlow for load balancing shows that, compared to TorFlow, network weight error decreases by 86 %, while the median of 50 KiB, 1 MiB, and 5 MiB transfer times decreases by 15 %, 29 %, and 37 %, respectively. Moreover, FlashFlow yields more consistent client performance: the median rate of transfer timeouts decreases by 100 %, while the standard deviation of 50 KiB, 1 MiB, and 5 MiB transfer times decreases by 55%, 61 %, and 41 %, respectively. We also find that the performance improvements increase relative to TorFlow as the total client-traffic load increases, demonstrating that FlashFlow is better suited to supporting network growth.