On Evaluating Anonymity of Onion Routing