January 2015 - tor-dev - lists.torproject.org

Re: [tor-dev] [Cryptography] traffic analysis
by grarpamp 27 Jan '15

27 Jan '15

On Tue, Jan 27, 2015 at 3:23 PM, Ben Laurie <benl(a)google.com> wrote: > Yeah, but ... who can realistically afford that bandwidth? One can afford what they wish to give to and thus expect to get from the network in return, no more, no less, as always. (Be it literally from the physical NIC network, or the logical networks created by their applications riding over and within the physical.) > To every possible recipient? Clearly you have to make a tradeoff. Full meshing of chaff addressed to all participants seems unnecessary. > grarpamp wrote: > Is there so much (possibly far less than correct) thought out there > that fill bandwidth is evil, untolerable, unmanageable, and blocking > of usability such that these networks are moot to even try coding > for general deployment? On Tue, Jan 27, 2015 at 1:35 PM, Jerry Leichter <leichter(a)lrw.com> wrote: > Google Fiber offers 1Gb/second - but how many customers running all > out will overload any possible backbone behind the single link from the > house to the concentrator? > > If everyone starts sending constant cover traffic, links will be quickly > overloaded all over the place. At which point the providers will start > charging [...] nobody will be happy That's the simple man's kneejerk response when initially contemplating chaffed networks. > There's room to do much better. For one thing, you don't need to saturate your link with cover traffic - you need to send enough cover traffic so that a listener can't tell the difference between cover and real traffic. This depends on if you're network is a low latency one, or if it uses a store and forward model. Even that is tricky due to needs to hide the size of data each endpoint exchanges from passive adversaries. It begins to approach constant higher rate the more you data wish to pass securely. > If your cover traffic rate equals your average rate over some period of time, > you're not adding more traffic - you're simply replacing some of your cover > messages with real messages. But ... what happens when you have a > peak demand way above your average? Then you must wait until you can pass your wheat. Or plan your needs according to the give and get model. > As Stealthmonger has commented concerning anonymity, if you want > security against traffic analysis, you have to accept delays: Set your > cover traffic rate somewhat higher than your average rate, and you'll > *eventually* catch up with peaks (though as with any queueing system, > the delays can grow without bound - requiring unbounded memory > *somewhere*). Delays (trading latency) are not the only way to achieve security. You may also elect to trade available throughput bandwidth in a wheat/chaff system. > I'm not aware of any open research on these kinds of questions - though > it may well be out there. What's the optimum cover traffic rate under > various assumptions about the real traffic rate and distribution? When > is it safe to use the traffic other users present as cover for your own? > Clearly if there's only one other user sending traffic, you can't use him > for cover as *he* can tell which of the packets are yours. But is there a > way to mix traffic from multiple users in a way that requires large numbers > of them to conspire to reveal anything? The mixmaster stuff looks at this > specifically from the point of view of a store-and-forward node - is there > some suitable useful analogue on a single link? Can we somehow get > the same guarantees without storage inside the network? There were some research references posted in the threads below. > we're now going to have to change our attitudes toward traffic analysis. Yes, a lot of oppurtunity exists to create new working networks in this area that utilize fill traffic and/or delay. You may want to review the recent guardian-dev and tor-dev side threads below on this exact subject of link padding, latency and analysis. Relavent papers and talk have been posted. https://lists.mayfirst.org/pipermail/guardian-dev/2014-November/004040.html https://lists.mayfirst.org/pipermail/guardian-dev/2014-November/004069.html https://lists.torproject.org/pipermail/tor-dev/2014-November/007741.html https://lists.torproject.org/pipermail/tor-dev/2014-December/007934.html https://lists.torproject.org/pipermail/tor-dev/2015-January/008039.html http://www.metzdowd.com/pipermail/cryptography/2015-January/024479.html https://lists.torproject.org/pipermail/tor-dev/2015-January/008099.html [Copied a few places simply to include these ongoing links as reference for anyone interested.]

1 0

Regarding contributing to torproject
by Vipul Sharma 27 Jan '15

27 Jan '15

Hello developers, I have some experience in Python/Django and looking to contribute to torproject. I've read about many projects mentioned at: https://www.torproject.org/getinvolved/volunteer.html.en#Projects but still I need your help and advice to pick a project. Please suggest me which project should I look for, considering that I am new to torproject :) Apart from this, there are few questions I would like to ask: - Which is the best place to ask questions: mailing list or irc(#tor-dev) (I don't want to spam with my questions in this mailing list) ? - How should I communicate or notify before sending a PR ? - Is it necessary to issue a ticket before sending a PR ? (Supposing that I've found an issue) I know these are pretty novice questions but I need your help :) Regards, Vipul Sharma

1 0

Reminder for weekly OONI dev meeting Monday 2015-01-26 18:00 UTC (19:00 CET)
by Arturo Filastò 26 Jan '15

26 Jan '15

Hello Oonitarians, This is a reminder that today there will be the weekly OONI meeting. It will happen as usual on the #ooni channel on irc.oftc.net at 18:00 UTC (19:00 CET, 13:00 EST, 10:00 PST). Everybody is welcome to join us and bring their questions and feedback. See you later, ~ Arturo

1 0

Stem descriptor lazy loading
by Damian Johnson 25 Jan '15

25 Jan '15

I've been wanting to do this for years. Just a quick announcement that Stem now lazy-loads descriptors, giving it a nice performance boost... Server descriptors: 27% faster Extrainfo descriptors: 71% faster Microdescriptors: 43% faster Consensus: 37% faster For details see... https://gitweb.torproject.org/stem.git/commit/?id=3dac7c5 Note that descriptor validation is now opt-in rather than opt-out, so if you'd prefer validation over performance you'll now need to include 'validate = True'. This is a pretty big overhaul so please let me know if you run into any issues. Cheers! -Damian

1 0

Error while deploying tor-weather
by Vipul Sharma 25 Jan '15

25 Jan '15

Hello developers, I am trying to deploy tor-weather by following the installation instructions (given in INSTALL) and the steps given in its README. But it is giving an error: *IOError: Failed to read authentication cookie (permission denied): /var/run/tor/control.authcookie* Please can anyone help me. I am a student and new here :) Also, can anyone please tell me how should I communicate or notify before sending a PR ? Regards, Vipul Sharma

3 2

RFC: Tor Messenger Alpha
by Sukhbir Singh 25 Jan '15

25 Jan '15

Hi, Tor Messenger is an instant messaging client currently under development. It is designed to make connections using the Tor network and will therefore be a valuable piece in the privacy-enhancing software toolkit (web: Tor Browser, email: Thunderbird + TorBirdy, chat: Tor Messenger.) Based on the Instantbird IM client [0], Tor Messenger: - sends all traffic over Tor, - uses Off-the-Record (OTR) encryption [1] of conversations by default, - can be used with a wide variety of chat networks, - has an easy-to-use graphical user interface localized into multiple languages. Some more information about Tor Messenger (and why we picked Instantbird) can be found on the wiki [2]. Current Status We have Tor Messenger bundles for Linux (32-bit and 64-bit) with OTR (using ctypes-otr [4]) and Tor support (Tor binary and Tor Launcher included), among other privacy settings. We are doing automated builds of Tor Messenger using rbm [5] (thanks to Nicolas Vigier). @@@ WARNING: NOT READY FOR PUBLIC USE. DO NOT DISTRIBUTE. @@@ Bundles Linux (32-bit) https://people.torproject.org/~sukhbir/tor-messenger-0.0.4/tor-messenger-0.… Linux (64-bit) https://people.torproject.org/~sukhbir/tor-messenger-0.0.4/tor-messenger-0.… sha256sum https://people.torproject.org/~sukhbir/tor-messenger-0.0.4/sha256sums.txt https://people.torproject.org/~sukhbir/tor-messenger-0.0.4/sha256sums.txt.a… The bundles are signed with my key (Sukhbir Singh; 0xB297B391). Extract the bundles and then run: ./start-tor-messenger. This is an early release and there may be serious privacy leaks and other issues -- please DO NOT recommend Tor Messenger to end users; this release is only for developers and advanced users who would like to help us with testing but understand the risks involved with using alpha software. Do not ignore this warning. We will try to have a monthly release cycle leading up to a stable release by July 2015. @@@ WARNING: NOT READY FOR PUBLIC USE. DO NOT DISTRIBUTE. @@@ Feedback With this release, we invite feedback not limited to anonymity leaks, usability issues, feature requests and suggestions for improvement. Please submit your feedback using the bug tracker [3] (select the "Tor Messenger" component). You can also talk to us on this mailing list or on IRC. (No seriously, don't use the bundles for any serious communication yet.) [0] - http://instantbird.com/ [1] - https://otr.cypherpunks.ca/ [2] - https://trac.torproject.org/projects/tor/wiki/doc/TorMessenger [3] - https://trac.torproject.org/projects/tor/newticket [4] - https://github.com/arlolra/ctypes-otr [5] - http://rbm.boklm.eu/ Thanks, Arlo Breault and Sukhbir Singh

5 5

onionoo protocol changes for 'details' documents ?
by Frédéric CORNU 25 Jan '15

25 Jan '15

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 Hi Since today 15:30:00 (GMT+2), {guard,middle,exit}_probability fields are missing from any returned "details" document, but I cannot see anything related to this in the protocols docs [1] Any clues ? [1] : https://onionoo.torproject.org/protocol.html#details - -- Frédéric CORNU http://wardsback.org -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.12 (GNU/Linux) iF4EAREIAAYFAlTDsw4ACgkQieXg+ErX/wN63QD/Vf22duhpcQ/kSB1kDYz8fn5G g5oZLH6FVClZjBsSelgA/AuVDsKNecN4enQObntrzltMXVtcyferxZGKyhpemitz =mNst -----END PGP SIGNATURE-----

3 2

Event at NEXA center and next OONI dev meeting
by Arturo Filastò 23 Jan '15

23 Jan '15

Hello Oonitarians! We skipped this weeks meeting due to a lot of us being busy with an event at the NEXA center. It was a very interesting opportunity to meet a lot of great network measurement and network neutrality researchers and discuss possible areas of collaboration. I will give a brief summary of some of the most relevant things WRT OONI. # Libight hackfest On the first day we did a hackfest on libight. At the end of it we were able to produce a build of libight for iOS [1] as well as a mockup of the GUI [2]. We also finished the integration of the SOCKS client [3] that will allow us to use tor from libight. Overall we are quite close to having a working prototype for iOS and soon also for Android. # NNTools meeting Enrico Gregori and Valerio Luconi from Italian National Research Council presented their work on Portolan, that is trying to map BGP interconnections with traceroutes. They have developed a desktop and mobile application that is very cool and works well! Later we discussed about possible collaborations, in particular deploying their tests as part of our raspberry pi deployment. For the full schedule of events see: http://nexa.polito.it/nntools2015 Regarding the next developer meeting I am going to suggest we do it as usual on Monday at 19:00 CET (18:00 UTC). That's it, until next week! Have fun! ~ Arturo [1] https://github.com/alemela/libight_iOS [2] https://people.torproject.org/~art/ooni/mockups/ooni-ight-assets.zip [3] https://github.com/TheTorProject/libight/pull/71

1 0

Obfsproxy Address Translation
by Alfredo Palhares 23 Jan '15

23 Jan '15

Hello, Recently I've been fighting censorship[1] in the form of deep packet inspection. Between the OpenVPN I an obfsproxy server outside the country and a client inside the country. But what I've found out is that Obfsproxy server needs to be running as the OpenVPN server and Obfsproxy client needs to be on the same machine as the OpenVPN client. This makes stuff work but its not really optimal, since there are area of the country where internation traffic is really hard, having proper address translation would save the hassle of setting another proxy between obfsproxy and the clients would not need anything more than the OpenVPN client that they already have. I opened issue #14217[2] and would like to provide a patch for it. But I am not Python and Twisted expert, so I will be firing a few questions: - How do I debug twisted ? Given the event-diven nature of the library, how do I debug incoming packets ? - How do you write server client tests? - What part of the code is reponsible from translating the incoming packeets on the server back to the client ? Thanks in advance ! [1] https://forums.openvpn.net/topic17960.html [2] https://trac.torproject.org/projects/tor/ticket/14217 -- Regards, Alfredo Palhares

2 4

[PATCH] Fix clang warning in test code
by Tim Ruehsen 23 Jan '15

23 Jan '15

There are still 5 reports from clang analyzer. They are either false positives or (in the test code) 'easy-to-read' programming by purpose (easy to get rid of, but absolutely no need to do). Tim

1 0