I’m looking into a piece of software which heavily relies on using unlinkable identities for different message types. If the 4 identities belonging to the same user can be grouped together, its anonymity is compromised.
The software in question uses Tor to connect to the central server, which is a hidden service. It opens 4 separate TCP sockets through localhost:9050 SOCKS5 proxy. However beside that it does not implement any kind of stream isolation. None of the proxy connections supply a username or a password (which would cause Tor to route them through separate sockets). The Tor control port is not used either.
My question: is the server able to recognize that the different TCP connections come from the same circuit? I know that by default, the hidden service’s server will see them all coming from different ephemeral TCP port on localhost. However assuming that the Tor client on their (hidden service’s) side can be modified to expose any internal information available, would it be possible?