Thanks for your question - it is a very interesting one! I would personally refer to what Tor uses as ‘padding’ traffic not ‘cover’ traffic.
The two types of padding traffic Tor uses are:
- Connection-Level Padding: it is a 1-hop padding between the client and its guard node. It is used to hinder traffic analysis by ISPs and surveillance infrastructure and helps obscure NetFlow-style traffic monitoring. And my understanding is, that this padding is only sent when no real traffic is being sent. It does not add extra padding on top of real traffic. So while it prevents ISPs from knowing exactly when the user is actively sending or receiving data, it does not prevent advanced traffic analysis or hide communication patterns. It can prevent some basic forms of flow-based tracking, but won’t protect against advanced traffic analysis (eg one which utilises machine learning). Also, as a side note: The Guard node can distinguish padding packets from real traffic, meaning the Guard sees the exact communication patterns of the user.
- Circuit-Level Padding - this padding traffic is used to obfuscate client connections (handshakes) with hidden services. It mainly targets the first 10 cells (packets) of a circuit setup, making onion service circuits look more like general circuits. So it is only applied selectively in specific cases and does not provide comprehensive traffic analysis resistance for general Tor traffic. Once the initial handshake is complete, no further padding is added I believe, meaning that traffic patterns within the Tor network remain exposed.
We define cover traffic as a type of traffic whose primary purpose is to obfuscate a user’s communication patterns, making even advanced traffic analysis difficult. Additionally, in mix networks, cover traffic helps increase the anonymity set by blending user traffic with decoy traffic, making tracking much harder.
thanks for pointing it out, it might be a good idea to clarify this table in a blogpost indeed
let me know if you have any more questions about that!