Onions Got Puzzled - On the Challenges of Mitigating Denial-of-Service Problems in Tor Onion Services

Explore a critical security vulnerability in Tor's onion services through this 12-minute conference presentation from USENIX Security '25. Discover how researchers from KAIST uncovered a fundamental flaw in Tor's client puzzle system designed to mitigate denial-of-service attacks, introducing the OnionFlation attack family that can render onion services unusable for just a few dollars per hour. Learn about the inherent trade-off between inflation resistance and congestion resistance in the current puzzle mechanism, understand how these attacks artificially inflate puzzle difficulty without causing noticeable congestion, and examine the ethical evaluation conducted on the live Tor network. Gain insights into the challenges of protecting anonymous services from DoS attacks when conventional mitigation strategies cannot be applied, and review practical guidance for balancing attack mitigation in Tor onion services.