Why Tor Uses Entry Guards Instead of Random Hops

The Tor network protects user anonymity by routing encrypted traffic through a three-node circuit: the entry guard, the middle relay, and the exit node. While it might seem intuitive to pick a completely random first relay for every new connection to maximize unpredictability, Tor deliberately uses a persistent “entry guard” for extended periods. This article explains the security rationale behind persistent entry guards, focusing on how they prevent statistical traffic correlation attacks and protect users from long-term deanonymization.

The Threat of Traffic Correlation

Tor does not modify the timing or volume of data packets enough to stop an adversary who can observe both ends of a circuit. If an attacker controls or monitors both the entry node (which sees the user’s real IP address) and the exit node (which sees the destination server), they can perform an end-to-end timing attack. By correlating packet sizes and timestamps entering and leaving the network, the attacker can confirm with near certainty that a specific user is visiting a specific website.

The Problem with Random First Hops

If Tor randomized the entry node for every circuit, a user would connect through dozens of different entry relays each day. An adversary running even a modest fraction of the network’s relays—for example, 5% of all guard and exit bandwidth—would eventually get lucky.

Under a fully randomized model: * Every new connection carries an independent probability of choosing both an attacker-controlled entry node and an attacker-controlled exit node. * Over time and across hundreds of connections, the cumulative probability of hitting an attacker-controlled entry and exit pair approaches 100%. * This is known as a predecessor attack: the more random circuits a user builds, the faster they guarantee their own deanonymization.

How Persistent Entry Guards Protect Users

To counter this statistical certainty, Tor introduced persistent entry guards. When a Tor client starts for the first time, it selects a very small set of relays (currently focusing on a single primary guard) and pins them for roughly two to three months.

This model alters the risk profile in favor of the user:

  1. Deterministic Risk: Instead of facing an inevitable probability of compromise over time, the user gambles only once when selecting their guard.
  2. Safety with an Honest Guard: If the chosen entry guard is honest and unmonitored (which is true the vast majority of the time), an attacker can never control both ends of the circuit, no matter how many malicious exit nodes they operate. The user remains secure for the entire lifespan of that guard.
  3. Contained Exposure: If the user happens to select a malicious entry guard, they are vulnerable only to the malicious exit nodes the attacker also controls, rather than leaking data across the entire network over time.

Guard Selection Criteria

Tor does not allow just any relay to become an entry guard. To qualify for the “Guard” flag, a relay must demonstrate high bandwidth, high uptime, and long-term stability. This requirement prevents attackers from flooding the network with cheap, ephemeral relays in an attempt to capture user traffic. By combining strict relay requirements with persistent guard pinning, Tor drastically reduces the feasibility of passive, large-scale correlation attacks.