<div dir="ltr"><p class="MsoNormal" style="margin:0cm 0cm 8pt;line-height:107%;font-size:11pt;font-family:Calibri,sans-serif"><span lang="EN-US" style="font-family:Arial,sans-serif;background-image:initial;background-position:initial;background-size:initial;background-repeat:initial;background-origin:initial;background-clip:initial">As far as I know (if
there is any error, please tell me), the onion v3 services allow the master
keys -public and secret (or private)- ed25519, generated in the directory
stipulated in "HiddenServiceDir" to be stored offline (on a pendrive,
for example), because the secret key is used "only" to generate
derived keys, which are what the service actually uses. As far as I can read in
the corresponding protocol, the derivations of the master keys (which can be
stored offline) are: "blinded signing keys and descriptor signing keys
(and their credentials), and their corresponding descriptor encryption keys"
(</span><a href="https://gitweb.torproject.org/torspec.git/tree/rend-spec-v3.txt#n529" style="color:blue"><span lang="EN-US">https://gitweb.torproject.org/torspec.git/tree/rend-spec-v3.txt#n529</span></a><span lang="EN-US" style="font-family:Arial,sans-serif;background-image:initial;background-position:initial;background-size:initial;background-repeat:initial;background-origin:initial;background-clip:initial">).</span><span lang="EN-US" style="font-family:Arial,sans-serif"><br>
<br>
<span style="background-image:initial;background-position:initial;background-size:initial;background-repeat:initial;background-origin:initial;background-clip:initial">Assuming the above is correct,I have some doubts:</span><br>
<br>
<span style="background-image:initial;background-position:initial;background-size:initial;background-repeat:initial;background-origin:initial;background-clip:initial">1. The keys and other elements derived from the public and
private master keys (like “blinded signing keys”) are generated by the
operator, according to the protocol. Will Tor incorporate any software/tools
that make this procedure easier for the user?<br>
<br>
<span style="background-image:initial;background-position:initial;background-size:initial;background-repeat:initial;background-origin:initial;background-clip:initial">2. If the operator does not generate the derived elements,
and only modifies the torrc file to add "HiddenServiceDir" and
"HiddenServicePort", will the onion service work, or will the lack of
the derived elements not work?</span><br>
<br>
<span style="background-image:initial;background-position:initial;background-size:initial;background-repeat:initial;background-origin:initial;background-clip:initial">3. As far as I understand, currently the option to save
offline the master keys is not available. Does this mean that derived elements,
such as "blinded signing keys" are not used yet? To what extent is
the v3 protocol implemented?</span></span></span></p>

<p class="MsoNormal" style="margin:0cm 0cm 8pt;line-height:107%;font-size:11pt;font-family:Calibri,sans-serif"><span lang="EN-US" style="font-family:Arial,sans-serif;background-image:initial;background-position:initial;background-size:initial;background-repeat:initial;background-origin:initial;background-clip:initial">4. V3 encrypts the
onion service descriptor sent to the "HSDir" node to prevent these
nodes from collecting onion addresses. But is this currently happening, even if
the operator does not generate the derived keys using the master key pair?</span><span lang="EN-US" style="font-family:Arial,sans-serif"><br>
<br>
<span style="background-image:initial;background-position:initial;background-size:initial;background-repeat:initial;background-origin:initial;background-clip:initial">I apologize for any write errors (English is not my mother
tongue).</span></span><span lang="EN-US"></span></p></div>