September 2013 - tor-commits - lists.torproject.org

[torspec/master] Merge proposal 222 (eliminate timestamps) into the specifications
by nickm＠torproject.org 20 Sep '13

20 Sep '13

commit 6c974c54f190e9e0d75d37ec999f6a354d9fbc36 Author: Nick Mathewson <nickm(a)torproject.org> Date: Wed Sep 18 11:27:34 2013 -0400 Merge proposal 222 (eliminate timestamps) into the specifications Also update it with actual decisions and parameters. --- dir-spec.txt | 7 +++++++ proposals/222-remove-client-timestamps.txt | 25 ++++++++++++++++--------- rend-spec.txt | 9 ++++++++- tor-spec.txt | 6 ++++-- 4 files changed, 35 insertions(+), 12 deletions(-) diff --git a/dir-spec.txt b/dir-spec.txt index 7222a3b..538170e 100644 --- a/dir-spec.txt +++ b/dir-spec.txt @@ -1417,6 +1417,13 @@ entry for a router that isn't based on at least three measurements. + "Support022HiddenServices" -- Used to implement a mass switch-over + from sending timestamps to hidden services by default to sending + no timestamps at all. If this option is absent, or is set to 1, + clients with the default configuration send timestamps; otherwise, + they do not. + Min: 0, Max: 1. Default: 1. + The authority section of a vote contains the following items, followed in turn by the authority's current key certificate: diff --git a/proposals/222-remove-client-timestamps.txt b/proposals/222-remove-client-timestamps.txt index dd84bf2..7cd9cc5 100644 --- a/proposals/222-remove-client-timestamps.txt +++ b/proposals/222-remove-client-timestamps.txt @@ -3,7 +3,8 @@ Title: Stop sending client timestamps Authors: Nick Mathewson Created: 22 August 2013 Target: 0.2.5.x -Status: Open +Status: Closed +Implemented-In: 0.2.4.?? 0. Summary @@ -46,12 +47,14 @@ Status: Open The AUTHENTICATE cell is not ordinarily sent by clients. It contains an 8-byte timestamp and a 16-byte random value. - Instead, let's replace both with a 24-byte (truncated) HMAC of - the current time, using a random key. + Instead, let's just send 24 bytes or random value. - This will achieve the goal of including a timestamp in the - cell (preventing replays even in the presence of bad entropy), - while at the same time not including the time here. + (An earlier version of this proposal suggested that we replace + them both with a 24-byte (truncated) HMAC of the current time, + using a random key, in an attempt to retain the allegedly + desirable property of avoiding nonce duplication in the event of + a bad RNG. But really, a Tor process with a bad RNG is not going + to get security in any case, so let's KISS.) 2.3. TLS @@ -89,7 +92,7 @@ Status: Open Hidden service descriptors include a publication time. I propose that we round this time down to the nearest N minutes, - perhaps for N=30. + where N=60. 4.2. INTRODUCE2 cell timestamp @@ -102,8 +105,12 @@ Status: Open 0.2.2.x (and really, no hidden services should be running on 0.2.2.x!), we can simply send 0 instead. (See ticket #7803). - This might be a good place to use a consensus parameter, so - that a large number of clients switch at the same time. + We can control this behavior with a consensus parameter + (Support022HiddenServices) and a tristate (0/1/auto) torrc option of + the same name. + + When the timestamp is not completely disabled, it should be + rounded to the closest 10 minutes. I claim this would be suitable for backport to 0.2.4. diff --git a/rend-spec.txt b/rend-spec.txt index ca40fb5..ebaf4e8 100644 --- a/rend-spec.txt +++ b/rend-spec.txt @@ -301,7 +301,8 @@ [Exactly once] - A timestamp when this descriptor has been created. + A timestamp when this descriptor has been created. It should be + rounded down to the nearest hour. "protocol-versions" SP version-string NL @@ -668,6 +669,12 @@ v1, and v2 since 0.1.1.x. As of Tor 0.2.0.7-alpha and 0.1.2.18, clients switched to using the v2 intro format. + The Timestampe (TS) field is no longer used in Tor 0.2.3.9-alpha and + later. Clients MAY refrain from sending it; see the + "Support022HiddenServices" parameter in dir-spec.txt. Clients SHOULD + NOT send a precise timestamp, and should instead round to the nearest + 10 minutes. + 1.9. Introduction: From the Introduction Point to Bob's OP If the Introduction Point recognizes PK_ID as a public key which has diff --git a/tor-spec.txt b/tor-spec.txt index 8471bff..5561201 100644 --- a/tor-spec.txt +++ b/tor-spec.txt @@ -627,8 +627,10 @@ see tor-design.pdf. - the NUL terminated ASCII string: "Tor V3 handshake TLS cross-certification" [32 octets] - TIME: The time of day in seconds since the POSIX epoch. [8 octets] - RAND: A 16 byte value, randomly chosen by the initiator [16 octets] + RAND: A 24 byte value, randomly chosen by the initiator. (In an + imitation of SSL3's gmt_unix_time field, older versions of Tor + sent an 8-byte timestamp as the first 8 bytes of this field; + new implementations should not do that.) [24 octets] SIG: A signature of a SHA256 hash of all the previous fields using the initiator's "Authenticate" key as presented. (As always in Tor, we use OAEP-MGF1 padding; see tor-spec.txt

1 0

[torspec/master] Update proposal index with 222 closed
by nickm＠torproject.org 20 Sep '13

20 Sep '13

commit ecf9d02b5bf3d17fd90630f006591768a7473c22 Author: Nick Mathewson <nickm(a)torproject.org> Date: Fri Sep 20 11:10:49 2013 -0400 Update proposal index with 222 closed --- proposals/000-index.txt | 4 ++-- proposals/222-remove-client-timestamps.txt | 3 +-- 2 files changed, 3 insertions(+), 4 deletions(-) diff --git a/proposals/000-index.txt b/proposals/000-index.txt index 458745b..61d6ad6 100644 --- a/proposals/000-index.txt +++ b/proposals/000-index.txt @@ -142,7 +142,7 @@ Proposals by number: 219 Support for full DNS and DNSSEC resolution in Tor [DRAFT] 220 Migrate server identity keys to Ed25519 [DRAFT] 221 Stop using CREATE_FAST [OPEN] -222 Stop sending client timestamps [OPEN] +222 Stop sending client timestamps [CLOSED] Proposals by status: @@ -193,7 +193,6 @@ Proposals by status: 217 Tor Extended ORPort Authentication [for 0.2.5.x] 218 Controller events to better understand connection/circuit usage [for 0.2.5.x] 221 Stop using CREATE_FAST [for 0.2.5.x] - 222 Stop sending client timestamps [for 0.2.5.x] ACCEPTED: 140 Provide diffs between consensuses 147 Eliminate the need for v2 directories in generating v3 directories [for 0.2.4.x] @@ -265,6 +264,7 @@ Proposals by status: 208 IPv6 Exits Redux [for 0.2.4.x] [in 0.2.4.7-alpha] 214 Allow 4-byte circuit IDs in a new link protocol [in 0.2.4.11-alpha] 216 Improved circuit-creation key exchange [in 0.2.4.8-alpha] + 222 Stop sending client timestamps [in 0.2.4.18] SUPERSEDED: 112 Bring Back Pathlen Coin Weight 113 Simplifying directory authority administration diff --git a/proposals/222-remove-client-timestamps.txt b/proposals/222-remove-client-timestamps.txt index 7cd9cc5..b2a2ae9 100644 --- a/proposals/222-remove-client-timestamps.txt +++ b/proposals/222-remove-client-timestamps.txt @@ -2,9 +2,8 @@ Filename: 222-remove-client-timestamps.txt Title: Stop sending client timestamps Authors: Nick Mathewson Created: 22 August 2013 -Target: 0.2.5.x Status: Closed -Implemented-In: 0.2.4.?? +Implemented-In: 0.2.4.18 0. Summary

1 0

[tor/master] Document that disabledebuggerattachment prevents cores
by nickm＠torproject.org 20 Sep '13

20 Sep '13

commit 0c807cf3e48cca5f4f93e8b1082bd62f2978cba4 Author: Nick Mathewson <nickm(a)torproject.org> Date: Thu Sep 19 12:14:07 2013 -0400 Document that disabledebuggerattachment prevents cores --- doc/tor.1.txt | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/doc/tor.1.txt b/doc/tor.1.txt index 732a779..d53ff2e 100644 --- a/doc/tor.1.txt +++ b/doc/tor.1.txt @@ -358,7 +358,8 @@ GENERAL OPTIONS **DisableDebuggerAttachment** **0**|**1**:: If set to 1, Tor will attempt to prevent basic debugging attachment attempts - by other processes. It has no impact for users who wish to attach if they + by other processes. This may also keep Tor from generating core files if + it crashes. It has no impact for users who wish to attach if they have CAP_SYS_PTRACE or if they are root. We believe that this feature works on modern Gnu/Linux distributions, and that it may also work on *BSD systems (untested). Some modern Gnu/Linux systems such as Ubuntu have the

1 0

[tor/master] Stop sending the current time in client NETINFO handshakes.
by nickm＠torproject.org 20 Sep '13

20 Sep '13

commit 1d0ba9a61f0bc30209a8eae48b863241044b6b23 Author: Nick Mathewson <nickm(a)torproject.org> Date: Tue Sep 17 17:55:43 2013 -0400 Stop sending the current time in client NETINFO handshakes. Implements part of proposal 222. --- changes/no_client_timestamps_024 | 5 +++++ src/or/connection_or.c | 5 +++-- 2 files changed, 8 insertions(+), 2 deletions(-) diff --git a/changes/no_client_timestamps_024 b/changes/no_client_timestamps_024 new file mode 100644 index 0000000..6df5307 --- /dev/null +++ b/changes/no_client_timestamps_024 @@ -0,0 +1,5 @@ + o Minor features (security): + - Clients no longer send timestamps in their NETINFO cells. These were + not used for anything, and they provided one small way for clients + to be distinguished from each other as they moved from network to + network or behind NAT. diff --git a/src/or/connection_or.c b/src/or/connection_or.c index d5dd447..95cb39a 100644 --- a/src/or/connection_or.c +++ b/src/or/connection_or.c @@ -2051,8 +2051,9 @@ connection_or_send_netinfo(or_connection_t *conn) memset(&cell, 0, sizeof(cell_t)); cell.command = CELL_NETINFO; - /* Timestamp. */ - set_uint32(cell.payload, htonl((uint32_t)now)); + /* Timestamp, if we're a relay. */ + if (! conn->handshake_state->started_here) + set_uint32(cell.payload, htonl((uint32_t)now)); /* Their address. */ out = cell.payload + 4;

1 0

[tor/master] Get ready to stop sending timestamps in INTRODUCE cells
by nickm＠torproject.org 20 Sep '13

20 Sep '13

commit f8b44eedf725cadb15c3a0ad1bc5a0fa1dbbc21d Author: Nick Mathewson <nickm(a)torproject.org> Date: Tue Sep 17 18:05:48 2013 -0400 Get ready to stop sending timestamps in INTRODUCE cells For now, round down to the nearest 10 minutes. Later, eliminate entirely by setting a consensus parameter. (This rounding is safe because, in 0.2.2, where the timestamp mattered, REND_REPLAY_TIME_INTERVAL was a nice generous 60 minutes.) --- changes/no_client_timestamps_024 | 9 +++++++-- doc/tor.1.txt | 9 +++++++++ src/or/config.c | 1 + src/or/or.h | 3 +++ src/or/rendclient.c | 20 +++++++++++++++++++- 5 files changed, 39 insertions(+), 3 deletions(-) diff --git a/changes/no_client_timestamps_024 b/changes/no_client_timestamps_024 index 6df5307..fe8f419 100644 --- a/changes/no_client_timestamps_024 +++ b/changes/no_client_timestamps_024 @@ -1,5 +1,10 @@ - o Minor features (security): + o Minor features (security, timestamp avoidance, proposal 222): - Clients no longer send timestamps in their NETINFO cells. These were not used for anything, and they provided one small way for clients to be distinguished from each other as they moved from network to - network or behind NAT. + network or behind NAT. Implements part of proposal 222. + - Clients now round timestamps in INTRODUCE2 cells to the nearest + 10 minutes. If a new Support022HiddenServices option is set to 0, + or if it's set to "auto" and the feature is disabled in the consensus, + the timestamp is sent as 0 instead. + diff --git a/doc/tor.1.txt b/doc/tor.1.txt index d53ff2e..ff760d4 100644 --- a/doc/tor.1.txt +++ b/doc/tor.1.txt @@ -1338,6 +1338,15 @@ The following options are useful only for clients (that is, if Tor will use a default value chosen by the directory authorities. (Default: -1.) +**Support022HiddenServices** **0**|**1**|**auto**:: + Tor hidden services running versions before 0.2.3.x required clients to + send timestamps, which can potentially be used to distinguish clients + whose view of the current time is skewed. If this option is set to 0, we + do not send this timestamp, and hidden services on obsolete Tor versions + will not work. If this option is set to 1, we send the timestamp. If + this optoin is "auto", we take a recommendation from the latest consensus + document. (Default: auto) + SERVER OPTIONS -------------- diff --git a/src/or/config.c b/src/or/config.c index 4e08f3c..18f1c29 100644 --- a/src/or/config.c +++ b/src/or/config.c @@ -388,6 +388,7 @@ static config_var_t option_vars_[] = { V(SSLKeyLifetime, INTERVAL, "0"), OBSOLETE("StatusFetchPeriod"), V(StrictNodes, BOOL, "0"), + V(Support022HiddenServices, AUTOBOOL, "auto"), OBSOLETE("SysLog"), V(TestSocks, BOOL, "0"), OBSOLETE("TestVia"), diff --git a/src/or/or.h b/src/or/or.h index 8c6c1e3..eff5a6d 100644 --- a/src/or/or.h +++ b/src/or/or.h @@ -4099,6 +4099,9 @@ typedef struct { /** How long (seconds) do we keep a guard before picking a new one? */ int GuardLifetime; + + /** Should we send the timestamps that pre-023 hidden services want? */ + int Support022HiddenServices; } or_options_t; /** Persistent state for an onion router, as saved to disk. */ diff --git a/src/or/rendclient.c b/src/or/rendclient.c index 7115bf2..9d48b9c 100644 --- a/src/or/rendclient.c +++ b/src/or/rendclient.c @@ -16,6 +16,7 @@ #include "connection_edge.h" #include "directory.h" #include "main.h" +#include "networkstatus.h" #include "nodelist.h" #include "relay.h" #include "rendclient.h" @@ -127,6 +128,16 @@ rend_client_reextend_intro_circuit(origin_circuit_t *circ) return result; } +/** Return true iff we should send timestamps in our INTRODUCE1 cells */ +static int +rend_client_should_send_timestamp(void) +{ + if (get_options()->Support022HiddenServices >= 0) + return get_options()->Support022HiddenServices; + + return networkstatus_get_param(NULL, "Support022HiddenServices", 1, 0, 1); +} + /** Called when we're trying to connect an ap conn; sends an INTRODUCE1 cell * down introcirc if possible. */ @@ -238,7 +249,14 @@ rend_client_send_introduction(origin_circuit_t *introcirc, REND_DESC_COOKIE_LEN); v3_shift += 2+REND_DESC_COOKIE_LEN; } - set_uint32(tmp+v3_shift+1, htonl((uint32_t)time(NULL))); + if (rend_client_should_send_timestamp()) { + time_t now = (uint32_t)time(NULL); + now += 300; + now -= now % 600; + set_uint32(tmp+v3_shift+1, htonl(now)); + } else { + set_uint32(tmp+v3_shift+1, 0); + } v3_shift += 4; } /* if version 2 only write version number */ else if (entry->parsed->protocols & (1<<2)) {

1 0

[tor/master] Remove the timestamp from AUTHENTICATE cells; replace with random bytes
by nickm＠torproject.org 20 Sep '13

20 Sep '13

commit accadd8752bb26efeb31a5c866a16cc863963893 Author: Nick Mathewson <nickm(a)torproject.org> Date: Wed Sep 18 10:51:04 2013 -0400 Remove the timestamp from AUTHENTICATE cells; replace with random bytes This isn't actually much of an issue, since only relays send AUTHENTICATE cells, but while we're removing timestamps, we might as well do this too. Part of proposal 222. I didn't take the approach in the proposal of using a time-based HMAC, since that was a bad-prng-mitigation hack from SSL3, and in real life, if you don't have a good RNG, you're hopeless as a Tor server. --- changes/no_client_timestamps_024 | 8 +++++--- src/or/connection_or.c | 18 +++++------------- 2 files changed, 10 insertions(+), 16 deletions(-) diff --git a/changes/no_client_timestamps_024 b/changes/no_client_timestamps_024 index fe8f419..9ded8b3 100644 --- a/changes/no_client_timestamps_024 +++ b/changes/no_client_timestamps_024 @@ -3,8 +3,10 @@ not used for anything, and they provided one small way for clients to be distinguished from each other as they moved from network to network or behind NAT. Implements part of proposal 222. - - Clients now round timestamps in INTRODUCE2 cells to the nearest + - Clients now round timestamps in INTRODUCE2 cells down to the nearest 10 minutes. If a new Support022HiddenServices option is set to 0, or if it's set to "auto" and the feature is disabled in the consensus, - the timestamp is sent as 0 instead. - + the timestamp is sent as 0 instead. Implements part of proposal 222. + - Stop sending timestamps in AUTHENTICATE cells. This is not such + a big deal from a security point of view, but it achieves no actual + good purpose, and isn't needed. Implements part of proposal 222. diff --git a/src/or/connection_or.c b/src/or/connection_or.c index 95cb39a..39a5317 100644 --- a/src/or/connection_or.c +++ b/src/or/connection_or.c @@ -2287,19 +2287,11 @@ connection_or_compute_authenticate_cell_body(or_connection_t *conn, if (server) return V3_AUTH_FIXED_PART_LEN; // ptr-out - /* Time: 8 octets. */ - { - uint64_t now = time(NULL); - if ((time_t)now < 0) - return -1; - set_uint32(ptr, htonl((uint32_t)(now>>32))); - set_uint32(ptr+4, htonl((uint32_t)now)); - ptr += 8; - } - - /* Nonce: 16 octets. */ - crypto_rand((char*)ptr, 16); - ptr += 16; + /* 8 octets were reserved for the current time, but we're trying to get out + * of the habit of sending time around willynilly. Fortunately, nothing + * checks it. That's followed by 16 bytes of nonce. */ + crypto_rand((char*)ptr, 24); + ptr += 24; tor_assert(ptr - out == V3_AUTH_BODY_LEN);

1 0

[tor/master] Round down hidden service descriptor publication times to nearest hour
by nickm＠torproject.org 20 Sep '13

20 Sep '13

commit fd2954d06d2e9b8b0d33bcd0a2e3dfb947ff662e Author: Nick Mathewson <nickm(a)torproject.org> Date: Wed Sep 18 11:09:34 2013 -0400 Round down hidden service descriptor publication times to nearest hour Implements part of proposal 222. We can do this safely, since REND_CACHE_MAX_SKEW is 24 hours. --- changes/no_client_timestamps_024 | 2 ++ src/or/rendservice.c | 1 + 2 files changed, 3 insertions(+) diff --git a/changes/no_client_timestamps_024 b/changes/no_client_timestamps_024 index 9ded8b3..488630f 100644 --- a/changes/no_client_timestamps_024 +++ b/changes/no_client_timestamps_024 @@ -10,3 +10,5 @@ - Stop sending timestamps in AUTHENTICATE cells. This is not such a big deal from a security point of view, but it achieves no actual good purpose, and isn't needed. Implements part of proposal 222. + - Reduce down accuracy of timestamps in hidden service descriptors. + Implements part of proposal 222. diff --git a/src/or/rendservice.c b/src/or/rendservice.c index 00bca17..8a4a11e 100644 --- a/src/or/rendservice.c +++ b/src/or/rendservice.c @@ -593,6 +593,7 @@ rend_service_update_descriptor(rend_service_t *service) d = service->desc = tor_malloc_zero(sizeof(rend_service_descriptor_t)); d->pk = crypto_pk_dup_key(service->private_key); d->timestamp = time(NULL); + d->timestamp -= d->timestamp % 3600; /* Round down to nearest hour */ d->intro_nodes = smartlist_new(); /* Support intro protocols 2 and 3. */ d->protocols = (1 << 2) + (1 << 3);

1 0

[tor/master] Merge branch 'no_client_timestamps_024_v2' into maint-0.2.4
by nickm＠torproject.org 20 Sep '13

20 Sep '13

commit 07bb17185681f875be461c4fea6c661fae2dfde9 Merge: 0c807cf 39bb59d Author: Nick Mathewson <nickm(a)torproject.org> Date: Fri Sep 20 11:00:43 2013 -0400 Merge branch 'no_client_timestamps_024_v2' into maint-0.2.4 changes/no_client_timestamps_024 | 14 ++++++++++++++ doc/tor.1.txt | 9 +++++++++ src/or/config.c | 1 + src/or/connection_or.c | 23 ++++++++--------------- src/or/or.h | 3 +++ src/or/rendclient.c | 20 +++++++++++++++++++- src/or/rendservice.c | 1 + 7 files changed, 55 insertions(+), 16 deletions(-)

1 0

[tor/master] Avoid error by not saying which intro cell type I mean
by nickm＠torproject.org 20 Sep '13

20 Sep '13

commit 39bb59d36322f3092bcb8c80c54ce4930dddef3a Author: Nick Mathewson <nickm(a)torproject.org> Date: Fri Sep 20 11:00:04 2013 -0400 Avoid error by not saying which intro cell type I mean --- changes/no_client_timestamps_024 | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/changes/no_client_timestamps_024 b/changes/no_client_timestamps_024 index 488630f..41dea2f 100644 --- a/changes/no_client_timestamps_024 +++ b/changes/no_client_timestamps_024 @@ -3,7 +3,7 @@ not used for anything, and they provided one small way for clients to be distinguished from each other as they moved from network to network or behind NAT. Implements part of proposal 222. - - Clients now round timestamps in INTRODUCE2 cells down to the nearest + - Clients now round timestamps in INTRODUCE cells down to the nearest 10 minutes. If a new Support022HiddenServices option is set to 0, or if it's set to "auto" and the feature is disabled in the consensus, the timestamp is sent as 0 instead. Implements part of proposal 222.

1 0

[tor/master] Merge remote-tracking branch 'origin/maint-0.2.4'
by nickm＠torproject.org 20 Sep '13

20 Sep '13

commit 6178aaea0698d7f62754c2aa1574ad7fd4fa781d Merge: ee01e41 07bb171 Author: Nick Mathewson <nickm(a)torproject.org> Date: Fri Sep 20 11:01:10 2013 -0400 Merge remote-tracking branch 'origin/maint-0.2.4' changes/no_client_timestamps_024 | 14 ++++++++++++++ doc/tor.1.txt | 12 +++++++++++- src/or/config.c | 1 + src/or/connection_or.c | 23 ++++++++--------------- src/or/or.h | 3 +++ src/or/rendclient.c | 20 +++++++++++++++++++- src/or/rendservice.c | 1 + 7 files changed, 57 insertions(+), 17 deletions(-)

1 0