<div dir="ltr"><div dir="ltr">Hi,<div>In short, yes. I think everything mentioned above is correct, and I'm not sure what else to add.</div><div><br></div><div>Oh, I guess I should ask people NOT to use the "tweak" commit on my repository, which is also linked in the first email in this thread, as it actually has a bug (puts a 32bit hex in a 16bit IPv6 section ... smh). Instead use this: <a href="https://github.com/torproject/tor/pull/343">https://github.com/torproject/tor/pull/343</a> which is already merged and includes a couple of neat features that I couldn't add myself, thanks ahf!</div><div><br></div><div>ps: Thanks for cc'ing me. I'm trying to limit the number of tor-* mailing lists that I'm on, but feel free to cc me if needed.</div></div></div><br><div class="gmail_quote"><div dir="ltr">On Sat, Sep 22, 2018 at 9:09 PM teor <<a href="mailto:teor@riseup.net">teor@riseup.net</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="auto"><div><span></span></div><div><div><span></span></div><div><div><span></span></div><div><div><div><br></div></div><div>On 23 Sep 2018, at 04:50, Alec Muffett <<a href="mailto:alec.muffett@gmail.com" target="_blank">alec.muffett@gmail.com</a>> wrote:<br><br></div><blockquote type="cite"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div class="gmail_quote"><div dir="ltr">On Sat, 22 Sep 2018 at 19:28, Dave Rolek <<a href="mailto:dmr-x@riseup.net" target="_blank">dmr-x@riseup.net</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-style:solid;border-left-color:rgb(204,204,204);padding-left:1ex">The circID is scoped under a given connection between adjacent nodes.<br>
<br>
A relay node maintains a mapping of circIDs for a circuit - mapping the<br>
forward and backward circID - for traffic it is relaying.<br>
<br>
So for a circuit ...<br>
client <-ID_a-> guard <-ID_b-> middle <-ID_c-> exit<br>
<br>
... each of the ID_*s are independent, and any node only knows the IDs<br>
immediately "adjacent" to it. Each connection (e.g. each client to that<br>
guard) has a independent enumeration/allocation of IDs.</blockquote><div><br></div><div>That is an awesome explanation, thank you ever so much.</div><div><br></div><div>If I read that right, to the most that an attacker with observability of the Cloudflare IP addresses could get, is either ... </div><div><br></div><div>( using the nomenclature from the diagram at <a href="https://twitter.com/AlecMuffett/status/926032680055201792" target="_blank">https://twitter.com/AlecMuffett/status/926032680055201792</a> )</div><div><br></div><div>1) correlation backwards to "Server Side Middle 1" for browsing a normal onion over Tor; or...</div><div><br></div><div>2) correlation backwards to "Client Side Middle" for browsing a single-hop onion over Tor</div><div><br></div><div>Am I correct?</div></div></div></div></div></blockquote><div><br></div><div>I'm not sure what you mean by "correlation backwards".</div><div><br></div><div>The Onion Service and the Onion Service Guard (or Single Onion Service</div><div>Rendezvous Point) both know the circuit id sent from the Onion Service to the</div><div>proxy. If an attacker controls the <span style="background-color:rgba(255,255,255,0)">Onion Service Guard (or Single Onion Service</span></div><div><span style="background-color:rgba(255,255,255,0)">Rendezvous Point), then they can correlate backwards to the Server Side Middle 1</span></div><div><span style="background-color:rgba(255,255,255,0)">(or Client Side Middle) by looking up linked circuit ids on the node they control.</span></div><div><br></div><div>The Rendezvous Point is chosen by the client, so it is just as likely to be malicious</div><div>as any other node.</div><br><blockquote type="cite"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div class="gmail_quote"><div>That latter seems not very much worse than the information which a compromised exit node would be able to obtain ("Browsing Normal Web over Tor") although it would be a lot more available when the circID is presented to the any backbone observer who can sniff IPv6?</div></div></div></div></div></blockquote><br><div>This IPv6 address isn't in the IP header of the packets between Cloudflare's</div><div>onion service and Cloudflare's proxy.</div></div><div><br></div><div>It's sent inside the TCP (or TLS?) connection between the Tor onion service</div><div>and the proxy instance, as a text header before any other inner TCP or TLS:</div><div><a href="https://www.haproxy.org/download/1.8/doc/proxy-protocol.txt" target="_blank">https://www.haproxy.org/download/1.8/doc/proxy-protocol.txt</a></div><div><br></div><div><div><div><span style="background-color:rgba(255,255,255,0)">If Cloudflare encrypts their onion service to proxy connections (and they</span></div><div><span style="background-color:rgba(255,255,255,0)">should), the circuit id will only be known to the onion service and its guard</span></div><div><span style="background-color:rgba(255,255,255,0)">(or rendezvous point, for a single-hop onion service connection).</span></div></div><div><span style="background-color:rgba(255,255,255,0)"><br></span></div><div><span style="background-color:rgba(255,255,255,0)">Alternately, if Cloudflare hosts its onions in the same data centre as the proxies</span></div><div><span style="background-color:rgba(255,255,255,0)">they talk to, then the risk of interception is low.</span></div></div><div><br></div><div>Then, if the proxy strips out this header before sending the request to the origin</div><div>site, or connects to the origin site using TLS, then this IP address shouldn't be</div><div>visible on the backbone.</div><div><br></div><div>Note: some origin sites still use HTTP to talk to CloudFlare:</div><div><a href="https://www.cloudflare.com/ssl/" target="_blank">https://www.cloudflare.com/ssl/</a></div><div><br></div><div>Also note: the CloudFlare dashboard shows the circuit id to site owners:</div><div><a href="https://blog.cloudflare.com/cloudflare-onion-service/" target="_blank">https://blog.cloudflare.com/cloudflare-onion-service/</a></div><div><br></div><div>I can't see how having the actual circuit id is useful to site owners.</div><div>They can't block it effectively, because it's transient.</div><div>(And the same circuit id can be re-used by independent connections.)</div><div><br></div><div>These are good questions for Mahrud, who I've CC'd.</div><div><br></div><div>T</div><div><br></div><div><br></div><div><br></div></div></div></div></blockquote></div><br clear="all"><div><br></div>-- <br><div dir="ltr" class="gmail_signature" data-smartmail="gmail_signature"><div dir="ltr">mahrud <<a href="http://algorithms.jux-foundation.org/~mahrud/blog" target="_blank">algorithms.jux-foundation.org/~mahrud/blog</a>><br></div></div>