June 2015 - tor-commits - lists.torproject.org

[tech-reports/master] Merge branch 'hidserv3' into master
by karsten＠torproject.org 17 Jun '15

17 Jun '15

commit c65aa9b86190bff0c212237fa82f4219d3b1d297 Merge: 54799c8 ad1068f Author: Karsten Loesing <karsten.loesing(a)gmx.net> Date: Wed Jun 17 20:29:17 2015 +0200 Merge branch 'hidserv3' into master 2015/hidden-service-stats/.gitignore | 4 + 2015/hidden-service-stats/Makefile | 18 + 2015/hidden-service-stats/hidden-service-stats.bib | 183 +++ 2015/hidden-service-stats/hidden-service-stats.tex | 1694 ++++++++++++++++++++ 2015/hidden-service-stats/protocol.odg | Bin 0 -> 14037 bytes 2015/hidden-service-stats/protocol.pdf | Bin 0 -> 20270 bytes 2015/hidden-service-stats/tortechrep.cls | 1 + 7 files changed, 1900 insertions(+)

1 0

[tech-reports/master] Put in a report number and a date.
by karsten＠torproject.org 17 Jun '15

17 Jun '15

commit 4f6a2573c322e2c676d060a4c98319ea9b5bb899 Author: Karsten Loesing <karsten.loesing(a)gmx.net> Date: Wed Jun 17 20:34:29 2015 +0200 Put in a report number and a date. --- 2015/hidden-service-stats/.gitignore | 2 +- 2015/hidden-service-stats/hidden-service-stats.tex | 6 +++--- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/2015/hidden-service-stats/.gitignore b/2015/hidden-service-stats/.gitignore index 863d44c..5aebaf3 100644 --- a/2015/hidden-service-stats/.gitignore +++ b/2015/hidden-service-stats/.gitignore @@ -1,4 +1,4 @@ .DS_Store -hidden-service-stats.pdf +hidden-service-stats-2015-04-28.pdf *.toc diff --git a/2015/hidden-service-stats/hidden-service-stats.tex b/2015/hidden-service-stats/hidden-service-stats.tex index e1444e2..598b0c9 100644 --- a/2015/hidden-service-stats/hidden-service-stats.tex +++ b/2015/hidden-service-stats/hidden-service-stats.tex @@ -21,8 +21,8 @@ George Kadianakis\\The Tor Project\\ \href{mailto:asn@torproject.org}{asn@torpro Karsten Loesing\\The Tor Project\\ \href{mailto:karsten@torproject.org}{karsten@torproject.org}} %\footnotemark[\ref{tpi}] -%\reportid{DRAFT} -\date{} +\reportid{2015-04-001} +\date{April 28, 2015} \maketitle @@ -1691,4 +1691,4 @@ specific algorithms for publishing broadly useful count and distribution statistics. \bibliography{hidden-service-stats} -\end{document} \ No newline at end of file +\end{document}

1 0

[translation/torbutton-torbuttonproperties] Update translations for torbutton-torbuttonproperties
by translation＠torproject.org 17 Jun '15

17 Jun '15

commit aa62366dd753de0b8be45e862e47809397c85d1e Author: Translation commit bot <translation(a)torproject.org> Date: Wed Jun 17 18:45:55 2015 +0000 Update translations for torbutton-torbuttonproperties --- tr/torbutton.properties | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tr/torbutton.properties b/tr/torbutton.properties index d5b857e..d78c07f 100644 --- a/tr/torbutton.properties +++ b/tr/torbutton.properties @@ -7,7 +7,7 @@ torbutton.circuit_display.this_browser = Bu tarayıcı torbutton.circuit_display.relay = ayna torbutton.circuit_display.tor_bridge = Köprü torbutton.circuit_display.unknown_country = Bilinmeyen ülke -torbutton.content_sizer.margin_tooltip = Tor Browser adds this margin to make the width and height of your window less distinctive, and thus reduces the ability of people to track you online. +torbutton.content_sizer.margin_tooltip = Tor tarayıcı pencerenizin genişlik ve yüksekliğini daha az belirgin hala getirmek için marj ekler, ve çevrimiçi insanların sizi izleme yeteneğini azaltır. torbutton.panel.tooltip.disabled = Tor'u etkinleştirmek için tıklayın torbutton.panel.tooltip.enabled = Tor'u devre dışı bırakmak için tıklayın torbutton.panel.plugins.disabled = Eklentileri etkinleştirmek için tıklayın

1 0

[tor/master] Handle "keygen" if datadir does not yet exist
by nickm＠torproject.org 17 Jun '15

17 Jun '15

commit c2c23d1443ba69d356a11303071e4ea5723ba1b6 Author: Nick Mathewson <nickm(a)torproject.org> Date: Wed Jun 17 13:51:45 2015 -0400 Handle "keygen" if datadir does not yet exist --- src/or/routerkeys.c | 15 +++++++++++++-- 1 file changed, 13 insertions(+), 2 deletions(-) diff --git a/src/or/routerkeys.c b/src/or/routerkeys.c index 277dc6e..f5cae44 100644 --- a/src/or/routerkeys.c +++ b/src/or/routerkeys.c @@ -486,8 +486,19 @@ load_ed_keys(const or_options_t *options, time_t now) if (options->command == CMD_KEYGEN) flags |= INIT_ED_KEY_TRY_ENCRYPTED; - char *fname = - options_get_datadir_fname2(options, "keys", "ed25519_master_id"); + /* Check the key directory */ + if (check_private_dir(options->DataDirectory, CPD_CREATE, options->User)) { + log_err(LD_OR, "Can't create/check datadirectory %s", + options->DataDirectory); + goto err; + } + char *fname = get_datadir_fname("keys"); + if (check_private_dir(fname, CPD_CREATE, options->User) < 0) { + log_err(LD_OR, "Problem creating/checking key directory %s", fname); + tor_free(fname); + goto err; + } + fname = options_get_datadir_fname2(options, "keys", "ed25519_master_id"); id = ed_key_init_from_file( fname, flags,

1 0

[tor/master] add test-memwipe to .gitignore
by nickm＠torproject.org 17 Jun '15

17 Jun '15

commit 118bfab75b4115b5490120fe4f6445095bbc9227 Author: Nick Mathewson <nickm(a)torproject.org> Date: Wed Jun 17 13:01:39 2015 -0400 add test-memwipe to .gitignore --- .gitignore | 1 + 1 file changed, 1 insertion(+) diff --git a/.gitignore b/.gitignore index 6139201..6d87d61 100644 --- a/.gitignore +++ b/.gitignore @@ -173,6 +173,7 @@ cscope.* /src/test/test-bt-cl.exe /src/test/test-child.exe /src/test/test-ntor-cl.exe +/src/test/test-memwipe.exe /src/test/test_workqueue.exe /src/test/test_zero_length_keys.sh /src/test/test_ntor.sh

1 0

[tor/master] Fix an unchecked-case warning on windows
by nickm＠torproject.org 17 Jun '15

17 Jun '15

commit d3b4214c6e45b9fd8ba147c2167208adc32180b4 Author: Nick Mathewson <nickm(a)torproject.org> Date: Wed Jun 17 11:31:53 2015 -0400 Fix an unchecked-case warning on windows --- src/or/ntmain.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/src/or/ntmain.c b/src/or/ntmain.c index 833d870..89e26c4 100644 --- a/src/or/ntmain.c +++ b/src/or/ntmain.c @@ -315,8 +315,10 @@ nt_service_main(void) case CMD_HASH_PASSWORD: case CMD_VERIFY_CONFIG: case CMD_DUMP_CONFIG: + case CMD_KEYGEN: log_err(LD_CONFIG, "Unsupported command (--list-fingerprint, " - "--hash-password, or --verify-config) in NT service."); + "--hash-password, --keygen, --dump-config, or --verify-config) " + "in NT service."); break; case CMD_RUN_UNITTESTS: default:

1 0

[stem/master] Include Electrum Bitcoin in port list
by atagar＠torproject.org 17 Jun '15

17 Jun '15

commit 6f46525ed02fa5bfa9cc915a103b7abbf2c3299e Author: Damian Johnson <atagar(a)torproject.org> Date: Wed Jun 17 08:22:55 2015 -0700 Include Electrum Bitcoin in port list Change from Toralf Förster... This port is used frequently, IANA marked it as "Dynamic and/or Private Ports". --- stem/util/ports.cfg | 1 + 1 file changed, 1 insertion(+) diff --git a/stem/util/ports.cfg b/stem/util/ports.cfg index 8b7829e..ebef834 100644 --- a/stem/util/ports.cfg +++ b/stem/util/ports.cfg @@ -310,4 +310,5 @@ port 19638 => Ensim port 23399 => Skype port 30301 => BitTorrent port 33434 => traceroute +port 50002 => Electrum Bitcoin SSL

1 0

[tor/master] changes file for 13642
by nickm＠torproject.org 17 Jun '15

17 Jun '15

commit be32777aa5708a26e6d8c63baef7dd0071a5e8e6 Author: Nick Mathewson <nickm(a)torproject.org> Date: Wed Jun 17 10:51:39 2015 -0400 changes file for 13642 --- changes/feature13642 | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/changes/feature13642 b/changes/feature13642 new file mode 100644 index 0000000..a1a9b25 --- /dev/null +++ b/changes/feature13642 @@ -0,0 +1,5 @@ + o Major features: + - Add support for offline encrypted ed25519 master keys. To use + this feature on your tor relay, run "tor --keygen" to make a new + master key (or to make a new signing key if you already have a + master key). Closes ticket 13642.

1 0

[tor/master] Add a tor_getpass to read passphrases. Needs better backend.
by nickm＠torproject.org 17 Jun '15

17 Jun '15

commit cbdf2c5d8f6fcce432e2355f406ca9e3c2340a5b Author: Nick Mathewson <nickm(a)torproject.org> Date: Sun Mar 1 15:35:36 2015 +0100 Add a tor_getpass to read passphrases. Needs better backend. --- configure.ac | 3 +++ src/common/compat.c | 33 +++++++++++++++++++++++++++++++++ src/common/compat.h | 2 ++ 3 files changed, 38 insertions(+) diff --git a/configure.ac b/configure.ac index 952fc9f..6010172 100644 --- a/configure.ac +++ b/configure.ac @@ -386,6 +386,7 @@ AC_CHECK_FUNCS( ftime \ getaddrinfo \ getifaddrs \ + getpass \ getrlimit \ gettimeofday \ gmtime_r \ @@ -399,6 +400,7 @@ AC_CHECK_FUNCS( pipe \ pipe2 \ prctl \ + readpassphrase \ rint \ sigaction \ socketpair \ @@ -926,6 +928,7 @@ AC_CHECK_HEADERS( netinet/in.h \ netinet/in6.h \ pwd.h \ + readpassphrase.h \ stdint.h \ sys/eventfd.h \ sys/file.h \ diff --git a/src/common/compat.c b/src/common/compat.c index 8da7ef3..7010275 100644 --- a/src/common/compat.c +++ b/src/common/compat.c @@ -67,6 +67,9 @@ #ifdef HAVE_CRT_EXTERNS_H #include <crt_externs.h> #endif +#ifdef HAVE_READPASSPHRASE_H +#include <readpassphrase.h> +#endif #ifndef HAVE_GETTIMEOFDAY #ifdef HAVE_FTIME @@ -3242,3 +3245,33 @@ tor_sleep_msec(int msec) } #endif +/** Emit the password prompt prompt, then read up to buflen + * characters of passphrase into output. */ +ssize_t +tor_getpass(const char *prompt, char *output, size_t buflen) +{ + tor_assert(buflen <= SSIZE_MAX); +#if defined(HAVE_READPASSPHRASE) + char *pwd = readpassphrase(prompt, output, buflen, RPP_ECHO_OFF); + if (pwd == NULL) + return -1; + return strlen(pwd); +#elif defined(HAVE_GETPASS) + /* XXX We shouldn't actually use this; it's deprecated to hell and back */ + memset(output, 0, buflen); + char *pwd = getpass(prompt); + if (pwd == NULL) + return -1; + ssize_t len = (ssize_t)strlen(pwd); + strlcpy(output, pwd, buflen); + memset(pwd, 0, len); + return len; +#else + /* XXX This is even worse. */ + puts(prompt); + ssize_t n = read(STDIN_FILENO, output, buflen); + if (n < 0) + return -1; + return n; +#endif +} diff --git a/src/common/compat.h b/src/common/compat.h index 5189b7e..549ed82 100644 --- a/src/common/compat.h +++ b/src/common/compat.h @@ -708,6 +708,8 @@ STATIC int tor_ersatz_socketpair(int family, int type, int protocol, #endif #endif +ssize_t tor_getpass(const char *prompt, char *output, size_t buflen); + /* This needs some of the declarations above so we include it here. */ #include "compat_threads.h"

1 0

[tor/master] Support encrypted offline master keys with a new --keygen flag
by nickm＠torproject.org 17 Jun '15

17 Jun '15

commit b6eee531bb546683387fb471b754f24bc40580d0 Author: Nick Mathewson <nickm(a)torproject.org> Date: Sun Mar 1 16:40:02 2015 +0100 Support encrypted offline master keys with a new --keygen flag When --keygen is provided, we prompt for a passphrase when we make a new master key; if it is nonempty, we store the secret key in a new crypto_pwbox. Also, if --keygen is provided and there *is* an encrypted master key, we load it and prompt for a passphrase unconditionally. We make a new signing key unconditionally when --keygen is provided. We never overwrite a master key. --- src/or/config.c | 5 +- src/or/main.c | 3 ++ src/or/or.h | 3 +- src/or/routerkeys.c | 149 +++++++++++++++++++++++++++++++++++++++++++++++++-- src/or/routerkeys.h | 6 +++ 5 files changed, 161 insertions(+), 5 deletions(-) diff --git a/src/or/config.c b/src/or/config.c index ef249a6..d81bc53 100644 --- a/src/or/config.c +++ b/src/or/config.c @@ -1909,6 +1909,7 @@ static const struct { { "--hash-password", ARGUMENT_NECESSARY }, { "--dump-config", ARGUMENT_OPTIONAL }, { "--list-fingerprint", TAKES_NO_ARGUMENT }, + { "--keygen", TAKES_NO_ARGUMENT }, { "--verify-config", TAKES_NO_ARGUMENT }, { "--ignore-missing-torrc", TAKES_NO_ARGUMENT }, { "--quiet", TAKES_NO_ARGUMENT }, @@ -4434,7 +4435,9 @@ options_init_from_torrc(int argc, char **argv) command = CMD_RUN_TOR; for (p_index = cmdline_only_options; p_index; p_index = p_index->next) { - if (!strcmp(p_index->key,"--list-fingerprint")) { + if (!strcmp(p_index->key,"--keygen")) { + command = CMD_KEYGEN; + } else if (!strcmp(p_index->key,"--list-fingerprint")) { command = CMD_LIST_FINGERPRINT; } else if (!strcmp(p_index->key, "--hash-password")) { command = CMD_HASH_PASSWORD; diff --git a/src/or/main.c b/src/or/main.c index bbee8e0..d9ef88b 100644 --- a/src/or/main.c +++ b/src/or/main.c @@ -3162,6 +3162,9 @@ tor_main(int argc, char *argv[]) #endif result = do_main_loop(); break; + case CMD_KEYGEN: + result = load_ed_keys(get_options(), time(NULL)); + break; case CMD_LIST_FINGERPRINT: result = do_list_fingerprint(); break; diff --git a/src/or/or.h b/src/or/or.h index 81e1c1c..230bc47 100644 --- a/src/or/or.h +++ b/src/or/or.h @@ -3405,7 +3405,8 @@ typedef struct { /** What should the tor process actually do? */ enum { CMD_RUN_TOR=0, CMD_LIST_FINGERPRINT, CMD_HASH_PASSWORD, - CMD_VERIFY_CONFIG, CMD_RUN_UNITTESTS, CMD_DUMP_CONFIG + CMD_VERIFY_CONFIG, CMD_RUN_UNITTESTS, CMD_DUMP_CONFIG, + CMD_KEYGEN } command; char *command_arg; /**< Argument for command-line option. */ diff --git a/src/or/routerkeys.c b/src/or/routerkeys.c index 556ab45..63d61c3 100644 --- a/src/or/routerkeys.c +++ b/src/or/routerkeys.c @@ -4,9 +4,130 @@ #include "or.h" #include "config.h" #include "router.h" +#include "crypto_pwbox.h" #include "routerkeys.h" #include "torcert.h" +#define ENC_KEY_HEADER "Boxed Ed25519 key" +#define ENC_KEY_TAG "master" + +int +read_encrypted_secret_key(ed25519_secret_key_t *out, + const char *fname) +{ + int r = -1; + uint8_t *secret = NULL; + size_t secret_len = 0; + char pwbuf[256]; + uint8_t encrypted_key[256]; + char *tag = NULL; + + ssize_t encrypted_len = crypto_read_tagged_contents_from_file(fname, + ENC_KEY_HEADER, + &tag, + encrypted_key, + sizeof(encrypted_key)); + if (encrypted_len < 0) { + log_info(LD_OR, "%s is missing", fname); + return 0; + } + if (strcmp(tag, ENC_KEY_TAG)) + return -1; + + while (1) { + ssize_t pwlen = + tor_getpass("Enter pasphrase for master key:", pwbuf, sizeof(pwbuf)); + if (pwlen < 0) + goto done; + + const int r = crypto_unpwbox(&secret, &secret_len, + encrypted_key, encrypted_len, + pwbuf, pwlen); + if (r == UNPWBOX_CORRUPTED) { + log_err(LD_OR, "%s is corrupted.", fname); + goto done; + } else if (r == UNPWBOX_OKAY) { + break; + } + /* Otherwise, passphrase is bad, so try again till user does ctrl-c or gets + * it right. */ + } + + + if (secret_len != ED25519_SECKEY_LEN) { + log_err(LD_OR, "%s is corrupted.", fname); + goto done; + } + memcpy(out->seckey, secret, ED25519_SECKEY_LEN); + r = 1; + + done: + memwipe(encrypted_key, 0, encrypted_len); + memwipe(pwbuf, 0, sizeof(pwbuf)); + if (secret) { + memwipe(secret, 0, secret_len); + tor_free(secret); + } + return r; +} + +int +write_encrypted_secret_key(const ed25519_secret_key_t *key, + const char *fname) +{ + int r = -1; + char pwbuf0[256], pwbuf1[256]; + uint8_t *encrypted_key = NULL; + size_t encrypted_len = 0; + + while (1) { + if (tor_getpass("Enter passphrase:", pwbuf0, sizeof(pwbuf0)) < 0) + return -1; + if (tor_getpass(" One more time:", pwbuf1, sizeof(pwbuf1)) < 0) + return -1; + + if (!strcmp(pwbuf0, pwbuf1)) + break; + fprintf(stderr, "That didn't match.\n"); + } + if (0 == strlen(pwbuf0)) + return 0; + if (crypto_pwbox(&encrypted_key, &encrypted_len, + key->seckey, sizeof(key->seckey), + pwbuf0, strlen(pwbuf0), 0) < 0) { + log_warn(LD_OR, "crypto_pwbox failed!?"); + goto done; + } + if (crypto_write_tagged_contents_to_file(fname, + ENC_KEY_HEADER, + ENC_KEY_TAG, + encrypted_key, encrypted_len) < 0) + goto done; + r = 1; + done: + if (encrypted_key) { + memwipe(encrypted_key, 0, encrypted_len); + tor_free(encrypted_key); + } + memwipe(pwbuf0, 0, sizeof(pwbuf0)); + memwipe(pwbuf1, 0, sizeof(pwbuf1)); + return r; +} + +static int +write_secret_key(const ed25519_secret_key_t *key, int encrypted, + const char *fname, + const char *fname_tag, + const char *encrypted_fname) +{ + if (encrypted) { + int r = write_encrypted_secret_key(key, encrypted_fname); + if (r != 0) + return r; + } + return ed25519_seckey_write_to_file(key, fname, fname_tag); +} + /** * Read an ed25519 key and associated certificates from files beginning with * fname, with certificate type cert_type. On failure, return @@ -38,6 +159,9 @@ * * If INIT_ED_KEY_OMIT_SECRET is set in flags, do not even try to * load or return a secret key (but create and save on if needed). + * + * If INIT_ED_KEY_TRY_ENCRYPTED is set, we look for an encrypted secret key + * and consider encrypting any new secret key. */ ed25519_keypair_t * ed_key_init_from_file(const char *fname, uint32_t flags, @@ -49,10 +173,12 @@ ed_key_init_from_file(const char *fname, uint32_t flags, struct tor_cert_st **cert_out) { char *secret_fname = NULL; + char *encrypted_secret_fname = NULL; char *public_fname = NULL; char *cert_fname = NULL; int created_pk = 0, created_sk = 0, created_cert = 0; const int try_to_load = ! (flags & INIT_ED_KEY_REPLACE); + const int encrypt_key = (flags & INIT_ED_KEY_TRY_ENCRYPTED); char tag[8]; tor_snprintf(tag, sizeof(tag), "type%d", (int)cert_type); @@ -62,15 +188,26 @@ ed_key_init_from_file(const char *fname, uint32_t flags, ed25519_keypair_t *keypair = tor_malloc_zero(sizeof(ed25519_keypair_t)); tor_asprintf(&secret_fname, "%s_secret_key", fname); + tor_asprintf(&encrypted_secret_fname, "%s_secret_key_encrypted", fname); tor_asprintf(&public_fname, "%s_public_key", fname); tor_asprintf(&cert_fname, "%s_cert", fname); /* Try to read the secret key. */ - const int have_secret = try_to_load && + int have_secret = try_to_load && !(flags & INIT_ED_KEY_OMIT_SECRET) && ed25519_seckey_read_from_file(&keypair->seckey, &got_tag, secret_fname) == 0; + /* Should we try for an encrypted key? */ + if (!have_secret && try_to_load && encrypt_key) { + int r = read_encrypted_secret_key(&keypair->seckey, + encrypted_secret_fname); + if (r > 0) { + have_secret = 1; + got_tag = tor_strdup(tag); + } + } + if (have_secret) { if (strcmp(got_tag, tag)) { tor_log(severity, LD_OR, "%s has wrong tag", secret_fname); @@ -115,7 +252,9 @@ ed_key_init_from_file(const char *fname, uint32_t flags, } created_pk = created_sk = created_cert = 1; - if (ed25519_seckey_write_to_file(&keypair->seckey, secret_fname, tag) < 0 + if (write_secret_key(&keypair->seckey, + encrypt_key, + secret_fname, tag, encrypted_secret_fname) < 0 || (split && ed25519_pubkey_write_to_file(&keypair->pubkey, public_fname, tag) < 0) @@ -214,6 +353,7 @@ ed_key_init_from_file(const char *fname, uint32_t flags, unlink(cert_fname); cleanup: + tor_free(encrypted_secret_fname); tor_free(secret_fname); tor_free(public_fname); tor_free(cert_fname); @@ -324,7 +464,8 @@ load_ed_keys(const or_options_t *options, time_t now) const int need_new_signing_key = NULL == use_signing || - EXPIRES_SOON(check_signing_cert, 0); + EXPIRES_SOON(check_signing_cert, 0) || + options->command == CMD_KEYGEN; const int want_new_signing_key = need_new_signing_key || EXPIRES_SOON(check_signing_cert, options->TestingSigningKeySlop); @@ -337,6 +478,8 @@ load_ed_keys(const or_options_t *options, time_t now) flags |= INIT_ED_KEY_MISSING_SECRET_OK; if (! want_new_signing_key) flags |= INIT_ED_KEY_OMIT_SECRET; + if (options->command == CMD_KEYGEN) + flags |= INIT_ED_KEY_TRY_ENCRYPTED; id = ed_key_init_from_file( options_get_datadir_fname2(options, "keys", "ed25519_master_id"), diff --git a/src/or/routerkeys.h b/src/or/routerkeys.h index b45a22a..1e0199e 100644 --- a/src/or/routerkeys.h +++ b/src/or/routerkeys.h @@ -14,6 +14,7 @@ #define INIT_ED_KEY_EXTRA_STRONG (1u<<5) #define INIT_ED_KEY_INCLUDE_SIGNING_KEY_IN_CERT (1u<<6) #define INIT_ED_KEY_OMIT_SECRET (1u<<7) +#define INIT_ED_KEY_TRY_ENCRYPTED (1u<<8) struct tor_cert_st; ed25519_keypair_t *ed_key_init_from_file(const char *fname, uint32_t flags, @@ -61,6 +62,11 @@ int should_make_new_ed_keys(const or_options_t *options, const time_t now); int generate_ed_link_cert(const or_options_t *options, time_t now); +int read_encrypted_secret_key(ed25519_secret_key_t *out, + const char *fname); +int write_encrypted_secret_key(const ed25519_secret_key_t *out, + const char *fname); + void routerkeys_free_all(void); #endif

1 0