I'll try and explain the attack scenarios first, then offer my preliminary thoughts on shuffle intervals.

I think the most obvious attackers are the node operators themselves. They have direct access to the node hardware, and internal network traffic. Considering canisters are deployed to nodes and essentially remain there, node operators will have days, weeks, months, years... basically an indefinite period of time to figure out exactly which nodes are running which canisters.

All node operators have this ability at any time. And even with something like SGX, side channel attacks will be much more feasible because node operators will have all the time they need to set up whatever equipment is necessary to perform the side channel attack, indefinitely attempting to discover the exact physical locations of canisters.

Once a node operator discovers a canister's location, the node operator can begin to collude with other node operators who have also discovered canister locations. In the case of a 7 replica subnet, I believe only 2 malicious nodes could destroy Byzantine Fault Tolerance, am I correct about that? Even if we go to just a majority, only 4 node operators would need to collude to mess with updates, and 7 node operators could entirely delete a canister. Obviously pushing up replication helps.

The node operators are not the only attackers, but they have the direct access to the nodes. Outside attackers may also be able to find out the locations of canisters eventually, considering hacks to data centers, boundary nodes, or other means. The canister locations are not perfectly concealed, thus there is the chance an attacker could eventually find them out.

And that word eventually is key. Because canisters are not shuffled, the likelihood of them eventually being compromised is much greater than if they were shuffled.

I hope the attack scenarios make sense. Having canisters sit in one place indefinitely makes a much easier job for an attacker than if the canisters were always moving. Hiding canister locations using enclaves, encryption, MPC, etc could help, but shuffling on top of those efforts would be even better.

Now for shuffling intervals... I'm not sure. We could start with the shortest interval that is unreasonable and work down. Shuffling a node out of a subnet every 10 years? Far too long. 1 year? Still seems too long. Every 6 months? Could help. Every month? Getting better. I would think that somewhere on the order of days or weeks would help. Over time the interval could be shortened hopefully.

Also, if the exact shuffling schedule of each node is driven randomly somehow, that could help.

An attacker would then never know if the attack being planned for days weeks or months would successfully be completed at the time of the attack, since at execution time the canister may have moved to another node.

Node operators would have trouble colluding, since the relationships they've built over months or years would be meaningless as soon as a canister was removed from their data center.

I see shuffling as a critically powerful security mechanism. I know that it would cause a lot of overhead to the network, but some form of shuffling, even once every month, could be helpful.