<html><head><meta http-equiv="Content-Type" content="text/html charset=us-ascii"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class=""><br class=""><div><blockquote type="cite" class=""><div class="">On 12 Feb 2016, at 15:57, Roger Dingledine <<a href="mailto:arma@mit.edu" class="">arma@mit.edu</a>> wrote:</div><br class="Apple-interchange-newline"><div class=""><div class="">I made some hopefully uncontroversial changes to the proposal in<br class="">git, but here are the comments that you might want to think about or<br class="">disagree with before acting on. :)<br class=""><br class="">On Fri, Oct 23, 2015 at 01:54:50AM +1100, Tim Wilson-Brown - teor wrote:<br class=""><blockquote type="cite" class=""> Rendezvous single onion services have a few benefits over single onion<br class=""> services:<br class=""><br class=""> * A rendezvous single onion service can load-balance over multiple<br class=""> rendezvous backends (see proposal #255)<br class=""> * A rendezvous single onion service doesn't need an accessible ORPort<br class=""> (it works behind a NAT, and in server enclaves that only allow<br class=""> outward connections)<br class=""></blockquote><br class=""> * A rendezvous single onion service can use the existing onion<br class=""> service authorisation mechanisms<br class=""></div></div></blockquote><div><br class=""></div><div>Yes, true.</div><br class=""><blockquote type="cite" class=""><div class=""><div class=""><br class=""><blockquote type="cite" class=""> * A rendezvous single onion service is compatible with existing tor<br class=""> clients, hidden service directories, introduction points, and<br class=""> rendezvous points<br class="">[...]<br class="">5. Publishing a rendezvous single onion service<br class=""><br class=""> To act as a rendezvous single onion service, a tor instance (or cooperating<br class=""> group of tor instances) must:<br class=""><br class=""> * Publish onion descriptors in the same manner as any onion service,<br class=""> using three-hop circuits. This avoids service blocking by IP address,<br class=""> proposal #224 (next-generation hidden services) avoids blocking by<br class=""> onion address.<br class=""></blockquote><br class="">Is this last part true? I think it isn't? If you know the onion address,<br class="">you can look at a 224-style descriptor and check if it corresponds to<br class="">that onion address.<br class=""></div></div></blockquote><div><br class=""></div><div>You're right, it's not true. We hide the onion address only from those who *don't* know it.</div><br class=""><blockquote type="cite" class=""><div class=""><div class=""><br class=""><blockquote type="cite" class="">5.1.3 Recommended Additional Options: Performance<br class=""><br class=""> LongLivedPorts<br class=""> The default LongLivedPorts setting creates additional, unnecessary<br class=""> connections. This specifies no long-lived ports (the empty list).<br class=""></blockquote><br class="">Why specify this part? Is there much harm in leaving Tor to make a few<br class="">circuits here and there?<br class=""></div></div></blockquote><div><br class=""></div><div>We decided not to implement this in Tor.</div><div>Operators running hundreds of RSOS instances may wish to add this to the config to avoid building extra circuits.</div><br class=""><blockquote type="cite" class=""><div class=""><div class=""><blockquote type="cite" class="">7. Considerations<br class=""></blockquote><br class="">Is it worthwhile to add a security note about the new surface area<br class="">we're giving the client, by letting it ask the RSOS to extend to<br class="">arbitrary destinations? I am thinking #17788.<br class=""></div></div></blockquote><div><br class=""></div><div>Yes, we only discovered this issue after the proposal was written, and we've been working through the implications since then.</div><br class=""><blockquote type="cite" class=""><div class=""><div class="">More generally, I wonder if the denial-of-service and similar "you can<br class="">make it open new connections" risk is symmetric to the proposal 252 design<br class="">(that is, you get the same dangers whether it's an external connection<br class="">coming in to the HS, or the HS making a connection out), or if there's<br class="">some meaningful difference. For example, I was thinking about sending<br class="">an intro request that specifies a particular relay, but with a different<br class="">identity fingerprint in the intro cell, thus forcing the HS to establish<br class="">a growing number of non-canonical OR conns. I think that particular<br class="">attack wouldn't work, but I wonder if there are others that would.<br class=""></div></div></blockquote><div><br class=""></div><div>We need to think about this a bit more.</div><br class=""><blockquote type="cite" class=""><div class=""><div class=""><blockquote type="cite" class="">9. Further Work<br class=""><br class="">Further proposals or research could attempt to mitigate the anonymity-set<br class="">splitting described in section 8. Here are some initial ideas.<br class=""></blockquote><br class="">I suggest splitting this whole section 9 into a separate proposal. It<br class="">seems to be about making it harder to distinguish whether a Tor<br class="">connection you're observing is being used for an onion service or a<br class="">normal (exit) connection -- for example, to stymie attacks like the<br class="">"Circuit Fingerprinting Attacks" from the Usenix Security '15 paper. I<br class="">think that is a totally different topic than RSOS.<br class=""></div></div></blockquote><br class=""></div><div>Yes, I think it's a set of ideas that are somewhat orthogonal.</div><div><br class=""></div><div>Tim</div><br class=""><div class="">
<div style="color: rgb(0, 0, 0); letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px; word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class=""><div style="color: rgb(0, 0, 0); letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px; word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class=""><div style="color: rgb(0, 0, 0); letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px; word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class=""><div style="color: rgb(0, 0, 0); letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px; word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class=""><div style="color: rgb(0, 0, 0); letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px; word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class=""><div style="color: rgb(0, 0, 0); letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px; word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class=""><div style="color: rgb(0, 0, 0); letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px; word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class=""><div style="color: rgb(0, 0, 0); letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px; word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class=""><div style="orphans: auto; text-align: start; text-indent: 0px; widows: auto; word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class=""><div style="orphans: auto; text-align: start; text-indent: 0px; widows: auto; word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class=""><div style="orphans: auto; text-align: start; text-indent: 0px; widows: auto; word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class=""><div style="orphans: auto; text-align: start; text-indent: 0px; widows: auto; word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class=""><div style="orphans: auto; text-align: start; text-indent: 0px; widows: auto; word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class=""><div style="orphans: auto; text-align: start; text-indent: 0px; widows: auto; word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class=""><div style="orphans: auto; text-align: start; text-indent: 0px; widows: auto; word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class=""><div style="orphans: auto; text-align: start; text-indent: 0px; widows: auto; word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class=""><div style="orphans: auto; text-align: start; text-indent: 0px; widows: auto; word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class=""><div style="orphans: auto; text-align: start; text-indent: 0px; widows: auto; word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class=""><div style="orphans: auto; text-align: start; text-indent: 0px; widows: auto; word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class=""><div style="color: rgb(0, 0, 0); letter-spacing: normal; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; orphans: auto; text-align: start; text-indent: 0px; widows: auto; word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class="">Tim Wilson-Brown (teor)</div><div style="color: rgb(0, 0, 0); letter-spacing: normal; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; orphans: auto; text-align: start; text-indent: 0px; widows: auto; word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class=""><br class=""></div><div style="orphans: auto; text-align: start; text-indent: 0px; widows: auto; word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class="">teor2345 at gmail dot com<br class="">PGP 968F094B<br class=""><br class="">teor at blah dot im<br class="">OTR CAD08081 9755866D 89E2A06F E3558B7F B5A9D14F</div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div>
</div>
<br class=""></body></html>