March 2014 - tor-dev - lists.torproject.org

[draft]: Proposal xxx: Pluggable transport SOCKS5 extensions
by Yawning Angel 08 Mar '14

08 Mar '14

Hello all, To address bug #10671: "Pluggable Transports: Improve method of transferring parameters to client-side transports", I submit the enclosed proposal for consideration. --- Begin proposal body --- Filename: xxx-pt-socks5-extensions.txt Title: Pluggable transport SOCKS5 extensions Author: Yawning Angel Created: 25-Feb-2014 Status: Draft 0. Abstract We propose extending the SOCKS5 protocol when communicating with pluggable transports to allow passing more per-bridge meta-data to the transport and returning more meaningful connection failure response codes back to Tor. 1. Introduction To allow for more sophisticated pluggable transports, it would be useful to support more than 510 bytes of per-connection data, while using the SOCKS5 pluggable transport interface. Additionally as pluggable transports increase in sophistication, it is useful for the pluggable transport to be able to return well defined errors back to Tor if the connection establishment fails. 2. Proposal 2.1. Tor Pluggable Transport Username/Password Authentication We introduce a new authentication method to the SOCKS5 protocol based on the existing RFC 1929 Username/Password Authentication that pluggable SHOULD support. The METHOD number to be returned to indicate support for or select this method is X'80', which belongs to the "RESERVED FOR PRIVATE METHODS" range in RFC 1928. After the authentication method has been negotiated following the standard SOCKS5 protocol, the actual authentication phase begins. Tor will send a Username/Password/Extended Data request: 0 1 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Version | Username Len | +---------------+---------------+ \ Username \ / ... / \ (Username Len bytes) \ +---------------+---------------+ | Password Len | \ +---------------+ / \ Password \ / ... / \ (Password Len bytes) \ +---------------+---------------+ | Extended Data Len | +---------------+---------------+ \ Extended Data \ / ... / \ (Extended Data Len bytes) \ +---------------+---------------+ Version: 8 bits (unsigned integer) This field specifies the version of the authentication method. It MUST be set to X'01'. Username Len: 8 bits (unsigned integer) This field specifies the length of the Username field in bytes. It MAY be X'00', in which case the Username field is omitted. Username: variable length, optional The Username to use when authenticating. Password Len: 8 bits (unsigned integer) This field specifies the length of the Password field in bytes. It MAY be X'00', in which case the Password field is omitted. Password: variable length, optional The Password to use when authenticating. Extended Data Len: 16 bits (unsigned integer) This field specifies the length of the Extended Data field in bytes. It MAY be X'0000', in which case the Extended Data field is omitted. The Extended Data Len field MUST be transmitted in network byte order. The pluggable transport verifies the supplied Username, Password, and Extended Data and sends the following response: 0 1 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Version | Status | +---------------+---------------+ Version: 8 bits (unsigned integer) This field specifies the version of the authentication method. It MUST be set to X'01'. Status: 8 bits (unsigned integer) This field specifies the status of the authentication request. A Status of X'00' indicates 'success'. If the pluggable transport returns a 'failure' (Status value other than X'00'), it MUST close the connection. 2.2. Tor Pluggable Transport SOCKS5 Reply Codes We introduce the following additional SOCKS5 reply codes to be sent in the REP field of a SOCKS5 reply message. Where: * X'F0' Temporary failure, retry immediately Pluggable transports SHOULD return this status code if the connection attempt failed, but the pluggable transport believes that subsequent connections with the same parameters are likely to succeed. Example: The ScrambleSuit Session Ticket handshake failed, but reconnecting is likely to succeed as it will use the UniformDH handshake. * X'F1' Pluggable transport protocol failure, invalid bridge Pluggable transports MUST return this status code if the connection attempt failed in a manner that indicates that the remote peer is not likely to accept connections at a later time. Example: The obfs3 handshake failed. * X'F2' Pluggable transport internal error Pluggable transports SHOULD return this status code if the connection attempt failed due to an internal error in the pluggable transport implementation. Tor might wish to restart the pluggable transport executable, or retry after a delay. 3. Compatibility SOCKS5 negotiates authentication methods so backward and forward compatibility is obtained for free, assuming a non-broken SOCKS5 implementation in the pluggable transport side that ignores unrecognised authentication methods in the negotiation phase. The extended status codes are informative clarifications of a failure state, so existing Tor binaries will continue existing behavior for a general failure. 4. Security Considerations Identical security considerations to RFC 1929 Username/Password authentication applies. As the Username/Password fields are carried in cleartext, this authentication method MUST NOT be used in scenarios where sniffing is possible. The authors of this proposal note that pluggable transports bind to the loopback address, so in the current model this is believed to be acceptable. 5. Open Questions Is 65535 bytes of per-bridge/per-connection data sufficient? Pluggable transports currently have no notion of authentication due to the Username/Password fields of the RFC 1929 authentication method being hijacked to convey extended data. Is this a feature that will be implemented in the future? 6. References Leech, M., Ganis, M., Lee, Y., Kuris, R., Koblas, D., Jones L., "SOCKS Protocol Version 5", RFC 1928, March 1996. Leech, M. "Username/Password Authentication for SOCKS V5", RFC 1929, March 1996. Appelbaum, J., Mathewson, N., "Pluggable Transport Specification", June 2012. --- End proposal body --- Questions, comments, feedback appreciated. -- Yawning Angel

5 11

Guard node security: ways forward (An update from the dev meeting)
by George Kadianakis 08 Mar '14

08 Mar '14

A main theme in the recent Tor development meeting was guard node security as discussed in Roger's blog post and in Tariq's et al. paper [0]. Over the course of the meeting we discussed various guard-related subjects. Here are some of them: a) Reducing the number of guards to 1 or 2 (#9273). b) Increasing the guard rotation period (to 9 months or so) (#8240). c) The fact that your set of guard nodes can act as a network fingerprint even if you switch to different networks (#10969). d) The fact that authorities assign flags based on knowledge they acquired while they were up. They don't use historical data to assign flags, which means that an authority thas has been up for 1 month, only knows 1 month worth of information about each relay (#10968). e) We discussed introducing a weight parameter that makes guards that have been guards for a long time, be more likely to be used as guards. f) We discussed how guards and circuit isolation should work together. Maybe each isolation profile should have a different set of guards. But what if we have hundreds of isolation profiles (we are the gateway of a network)? g) Should we refuse to add new guards after a certain number of circuits have been killed (maybe it's an attack). But won't that drive our users to simply reinstall Tor because they think it's broken? h) We discussed chaining consensus documents together as in a block chain. This could help against targetted attacks where a set of bad authorities give a poisoned consensus to a user. This design has many problems though (how much data do we have to keep forever each consensus? what happens in periods where no consensuses were published?) i) If we restrict the number of guards to 1, what happens to the unlucky users that pick a slow guard? What's the probability of being an unlucky user? Should we bump up the bandwidth threshold for being a guard node? How does that change the diversity of our guard selection process? j) How do the above influence the security of Hidden Services? Guard security is essential for the well-being of Hidden Services, but how does increasing the guard rotation period combine with guard enumeration attacks (#9001)? We discussed more topics too. You can find Nick's raw notes at: https://trac.torproject.org/projects/tor/wiki/org/meetings/2014WinterDevMee… To move forward, we decided that proposals should be written for (a) and (b). We also decided that we should first evaluate whether doing (a) and (b) are good ideas at all, especially with regards to (i). [0]: https://blog.torproject.org/blog/improving-tors-anonymity-changing-guard-pa… http://freehaven.net/anonbib/#wpes12-cogs

5 13

Hidden service search engine (GSoC)
by Rémi 08 Mar '14

08 Mar '14

Hy, I am currently a master student with a focus on natural language processing, machine learning, information retrieval and data mining. The Tor website lists a bunch of ideas, one of which is "Search Engine for Hidden Services"[1]. This project suits me well given my education and skill set and I would really enjoy it. Does tor-dev think this would be a good project? There are already many hidden search engines, although non are open source. I have done two smaller information retrieval projects in university this year, and I have a strong background in search engine algorithms. The components of the system that I am currently thinking of are: - index and features in a nosql database (possibly CodernityDB) - hidden service crawler - simple search using BM25, but recording click through and many features other than BM25. - Basic front-end. - A component for 'Learning to rank' based on more features, which should be used once there is significant click-through data. This should be an easy to use program that performs search engine optimization. The recording of the click through is done in order to learn to search better. This is important because there is no known search ranker that will give excellent results out of the box. Click through recording can be done by only recording feature weights. I would work in Python because I am very comfortable working with it. What are your thoughts? R. P.S. I would also love to do the traffic confirmation attack, but as far as I understand there is no good data set that is readily available, and making + using one will be beyond the scope of GSoC. [1] https://www.torproject.org/getinvolved/volunteer.html.en#Coding

2 1

Accessing hidden services with TAP or ntor
by Jens Kubieziel 07 Mar '14

07 Mar '14

Hi, we had some discussions during the dev meeting regarding hidden services and why users sometimes report that the access to them fails. The general problem might be that the specific hidden service doesn't exist anymore. However in some cases the HS exists (see <URL:http://tor.stackexchange.com/q/1442/88> as an example). So one theory was that the transistion from TAP to ntor might cause problems. I tried to test it and found no evidence so far. What did I do? I checked out the current Tor source from git and the tor-0.2.3.25 tagged version. I built both versions and gave them a minimal torrc (SocksPort, Log, DataDir, ControlPort). After the Tor process built a circuit I used a random page from the hidden wiki and tried to access it. If it failed, I tried either the HS from TorProject or DDG. If it succeeded, I built a new circuit and tried another HS. During the first tests I used the hotel network, which was kind of flaky. With a more stable connection I tested nearly 20 hidden services and found no difference in the behaviour of both Tor versions. Both failed on one random HS and opened all other reasonably fast. While this is no final proof it is good evidence that there is no connection between failing hidden services and TAP/ntor. So maybe we need another theory to test. ;) -- Jens Kubieziel http://www.kubieziel.de I just found out that the brain is like a computer. If that's true, then there really aren't any stupid people. Just people running Windows.

3 3

Some initial analysis on the new "Triple Handshake Attack" and Tor
by Nick Mathewson 07 Mar '14

07 Mar '14

Hi, all. It looks like there was a new attack on the TLS protocol this morning. I think it doesn't affect Tor. But I should walk you through my reasoning to see if you agree. I. The Triple Handshake attack. Go read https://www.imperialviolet.org/2014/03/03/triplehandshake.html and then read https://secure-resumption.com/ . They explain the attack more carefully than I can do here. Do *not* believe the part that says "renegotiation plus client certs" == doom until you have read the next part of this message. II. The results of Triple Handshake on the v2 link protocol Up until Tor 0.2.3, the preferred way for two servers to initiate a connection with one another was the "v2 link protocol", which uses both client certificates and renegotiation. Fortunately, we do not support session renegotiation in Tor. So I believe we're in the clear there. III. Implications for the v3 link protocol As part of the V3 link protocol, the client (C) may authenticate to a server (S) by sending a signed authentication statement saying, among other things, "Here's your identity key $S, here's a hash of the link certificate you used, here's my identity key $C, here's a hash of everything we've said to each other, here's the challenge message you just gave me, and I'm binding this assertion to this TLS connection using the master secret $foo". This all gets signed with the client's key $C. (Note that the "client" in this case is another Tor server. Regular users don't authenticate at all.) Now, when we made that protocol [see proposal 176], we assumed that master secrets were unique to a single TLS connection. That assumption isn't true: the enabling part of the "Triple Handshake" attack is that the attacker (A) can arrange it so that C is connected to A, A is connected to S, and the TLS connections between A and S will share the same master secret. Fortunately, I don't think this assumption can't be used to attack the v3 link protocol, since before the client will sent any such signed authentication statement, it insists on getting authentication from the server, in the form of a certificate chain leading from the server's identity key $S to the the key used for the TLS connection. So the client won't send a message containing the identity key "$S" to A, since A can't do a TLS handshake that is signed with any key that is signed with "$"S. Also, we built some redundancy into our design. From proposal 176: Even if the protocol didn't contain the TLSSECRET component, the server could [trust] the client's authentication, but it's a little trickier. The server knows that it is not getting a replayed AUTHENTICATE cell, since the cell authenticates (among other stuff) the server's AUTH_CHALLENGE cell, which it has never used before. The server knows that it is not getting a MITM'd AUTHENTICATE cell, since the cell includes a hash of the server's link certificate, which nobody else should have been able to use in a successful TLS negotiation. Because the link certificate hash is part of the signed message, the attacker A can't actually get the client to give it a message that the server S will accept, even if the client *did* send the message before checking the server's entire certificate chain. IV. Conclusions 1. Looks like we dodged another protocol bullet here. 2a. We should alter tor-spec.txt to make it clear that disabling TLS session resumption is even more necessary for security than we had thought. 2b. We should make it clear in tor spec that the client MUST NOT send an AUTHENTICATE cell before checking the CERTS cell and authenticating the server. 3. We should be sure to retire the v2 handshake nice and fast once 0.2.2 is unsupported. Renegotiation is an ugly corner of TLS that we should count ourselves glad to stumble out of. 4. We should look for more things to shove into the AUTHENTICATE cells in future versions of our protocol. The server certificate hash is a good start, but perhaps we can find more things to add. 5. We should revisit proposals to have Tor server <-> server communication use the v1 link protocol again. (That's the one where both sides present a certificate chain in their TLS handshake. We moved away from it because of protocol fingerprinting issues, before we'd hit upon pluggable transports as a better means for protocol obfuscation.) Due to our messed-up use of ciphersuites for signalling, we will have some tricky times designing this compatibly with existing Tors. But it might be our best long-term option if we can make it work. (IIRC Robert Ransom was advocating this.) V. Acknowledgements Thanks to Adam Langley for explaining some of the issues in this attack to me. Thanks to Steven Murdoch, Nicholas Hopper, and Adam Langley for reviewing an earlier draft of this mail. (At least one of them only had time for a cursory look, so please don't blame them for any mistakes here.)

4 5

GSoC - Profile UDP transport protocols
by Danilo Carvalho 06 Mar '14

06 Mar '14

Hello I am interested in profiling the UDP transport protocols, I think using a different underlying protocol could significantly improve Tor's performance and I would like to be part of that. At first, I thought that the project consisted of profiling existing udp transport code. However, I could not find existing implementation of the protocols described in the pdf[1] or the bug tracker[2]. The newest reference to the project was Murdoch's blog post, but even that's 3 year dated, and I couldn't find any followup. So, is changing Tor to udp still a thing? I see that the ecosystem now is far more complex than it was 3 years ago, and a change of the underlying protocol would be much cumbersome to implement across all the applications that currently interact with the Tor network. Another issue, is this project suitable for a GSoC project? I believe that only implementation and testing of the designs proposed in the pdf[1] would take longer than a summer. To finish it up, if this project is still kicking, could some pointers to it be given to me? I'd like to start working on my GSoC proposal asap. Cheers, Danilo (knorr) [1] https://research.torproject.org/techreports/datagram-comparison-2011-11-07.… [2]https://trac.torproject.org/projects/tor/ticket/1855 [3]https://blog.torproject.org/blog/moving-tor-datagram-transport

2 1

GSOC Proposal - Orbot and Orfox
by Amogh Pradeep 06 Mar '14

06 Mar '14

Hi all, I, Amogh Pradeep, of International Institute of Information Technology, Hyderabad, India, plan to participate in Google Summer of Code this time. Here a link to my proposal(just a mock up), https://github.com/amoghbl1/Orfox/blob/master/GSOC.txt please take a look at it and feel free to give me a few pointers. A short introduction of me and what I have been working on- As I like to develop on Android, I work with the guardian project on mainly Orbot and recently on Orfox too. I hope to continue working on Orbot throughout the summer and therefore wish to do my project on the same. Please refer to the proposal for further information. Best, Amogh Pradeep, Developer, Student.

1 0

globe compass integration
by Christian 05 Mar '14

05 Mar '14

Hi, in the last couple of days I thought about a topic for a gsoc application. After getting ideas from Karsten and Sathya, I started making a rough roadmap of things that I want to do for globe, in the next couple of months (and maybe use it as a idea for a gsoc topic). - add new onionoo features to globe - add compass functionality + open compass tickets to globe - improve/add help documentation The central point would be to add compass functionality to globe. This has the advantage that the user can use the same application to search for relay/bridge details and do queries with grouped results. This could be accomplished by changing the UI and modify advanced search filters, add options for grouping and grouped search results. Another suggestion was to add a group detail page that displays aggregated data for multiple details. Currently compass pulls all onionoo relay details and queries them locally. Karsten suggested that globe could use the same method and load the onionoo data every hour or so and do the currently supported search and compass functionality on it. The idea is that globe could store the dump in a db (e.g. mongodb) and use its features for searching, grouping and aggregating data. This would be a major rewrite away from calling the Onionoo-API, to querying the locally available dump. I would like to know, if you think that integrating Compass into globe would be a good idea? Do you think that the compass integration would be a reasonable project for the gsoc? Do you have other ideas on how to improve globe? Thanks, Christian

4 3

Tor HS DHT Research
by Gareth Owen 05 Mar '14

05 Mar '14

Dear all Sorry if this is the wrong list (please tell me if it is). I'm undertaking research into the tor HS DHT and have a couple of questions. I know at present, a node must be on for 25 hours to participate in the DHT; however, periodically I wish to make small code changes to Tor and restart the node (aka fairly instantly/within minutes) but this causes me to lose the HSDir flag. So my questions are: 1) Is there anyway to restart Tor without losing the HSDir flag? 2) Is uptime self reporting - e.g. is a node's self reported uptime trusted or is it obtained elsewhere - I couldn't find the answer in the code. I guess what I'm getting at, is can I fake the uptime to get the HSDir flag? Best Gareth --- Dr Gareth Owen School of Computing University of Portsmouth

2 2

Coordination of censorship analysis tool
by sarnicki＠student.agh.edu.pl 05 Mar '14

05 Mar '14

Hi everyone, could you provide some information about your progress on the project? I am interested in developing the tool, but I don't want to duplicate your work. Thanks, Piotr

2 2