- tor-dev - lists.torproject.org

Proposal 245: Deprecating and removing the TAP circuit extension protocol
by Nick Mathewson 02 Jun '15

02 Jun '15

Filename: 245-tap-out.txt Title: Deprecating and removing the TAP circuit extension protocol Author: Nick Mathewson Created: 2015-06-02 Status: Draft 0. Introduction This proposal describes a series of steps necessary for deprecating TAP without breaking functionality. TAP is the original protocol for one-way authenticated key negotiation used by Tor. Before Tor version 0.2.4, it was the only supported protocol. Its key length is unpleasantly short, however, and it had some design warts. Moreover, it had no name, until Ian Goldberg wrote a paper about the design warts. Why deprecate and remove it? Because ntor is better in basically every way. It's actually got a proper security proof, the key strength seems to be 20th-century secure, and so on. Meanwhile, TAP is lingering as a zombie, taking up space in descriptors and microdescriptors. 1. TAP is still in (limited) use today for hidden service hops. The original hidden service protocol only describes a way to tell clients and servers about an introduction point's or a rendezvous point's TAP onion key. We can do a bit better (see section 4), but we can't break TAP completely until current clients and hidden services are obsolete. 2. The step-by-step process. Step 1. Adjust the parsing algorithm for descriptors and microdescriptors on servers so that it accepts MDs without a TAP key. See section 3 below. Target: 0.2.7. Step 1b. Optionally, when connecting to a known IP/RP, extend by ntor. (See section 4 below.) Step 2. Wait until proposal 224 is implemented. (Clients and hidden services implementing 224 won't need TAP for anything.) Step 3. Begin throttling TAP answers even more aggressively at relays. Target: prop224 is stable. Step 4. Wait until all versions of Tor without prop224 support are obsolete/deprecated. Step 5. Stop generating TAP keys; stop answering TAP requests; stop advertising TAP keys in descriptors; stop including them in microdescriptors. Target: prop224 has been stable for 12-18 months, and 0.2.7 has been stable for 2-3 years. 3. Accepting descriptors without TAP keys. (Step 1) Our microdescriptor parsing code uses the string "onion-key" at the start of the line to identify the boundary between microdescriptors, so we can't remove it entirely. Instead, we will make the body optional. We will make the following changes to dir-spec: - In router descriptors, make the onion-key field "at most once" instead of "exactly once." - In microdescriptors, make the body of "onion-key" optional. Until Step 4, authorities MUST still reject any descriptor without a TAP key. If we do step 1 before proposal 224 is implemented, we'll need to make sure that we never choose a relay without a TAP key as an introduction point or a rendezvous point. 4. Avoiding TAP earlier for HS usage (Step 1b) We could begin to move more circuits off TAP now by adjusting our behavior for extending circuits to Introduction Points and Rendezvous Points. The new rule would be: If you've been told to extend to an IP/RP, and you know a directory entry for that relay (matching by identity), you extend using the node_t you have instead. This would improve cryptographic security a bit, at the expense of making it possible to probe for whether a given hidden service has an up-to-date consensus or not, and learn whether each client has an up-to-date consensus or not. We need to figure out whether that enables an attack. (For reference, the functions to patch would be rend_client_get_random_intro_impl and find_rp_for_intro.)

1 0

Re: [tor-dev] Quick logjam/Tor analysis.
by teor 02 Jun '15

02 Jun '15

> Date: Tue, 26 May 2015 09:25:22 -0400 > From: Nick Mathewson <nickm(a)torproject.org> > > I posted this on a blog comment, but others may be interested too. > > > As near as I can tell, the "logjam"/"weakdh" attacks should not affect > current Tor software very much, for a few reasons: > > * All currently supported Tor versions, when built with OpenSSL 1.0 or > later, prefer 256-bit elliptic-curve Diffie Hellman for their TLS > connections, not the 1024-bit Diffie Hellman over Z_p as discussed in > this paper. > > … > > Recommendations: > > … > > * If you're running OpenSSL 0.9.8 or earlier, you should consider upgrading > to 1.0.0 or later. (Mac) OS X Yosemite 10.10 and earlier ship with OpenSSL 0.9.8 and 0.9.7. For Yosemite 10.10.3 (14D136) in particular, these are: $ ls -l /usr/lib/libssl.* -rwxr-xr-x 1 root wheel 400608 10 Sep 2014 /usr/lib/libssl.0.9.7.dylib -rwxr-xr-x 1 root wheel 616512 20 Mar 13:16 /usr/lib/libssl.0.9.8.dylib lrwxr-xr-x 1 root wheel 18 28 Jan 23:16 /usr/lib/libssl.dylib -> libssl.0.9.8.dylib $ strings /usr/lib/libssl.0.9.8.dylib | grep "OpenSSL 0.9.8" OpenSSL 0.9.8zd 8 Jan 2015 … $ strings /usr/lib/libssl.0.9.7.dylib | grep "OpenSSL 0.9.7" … OpenSSL 0.9.7l 28 Sep 2006 … (As an aside, please avoid running strings on any untrusted binaries.) While it's possible to build or install OpenSSL 1.0 or 1.1 on OS X, it's not the default. How does this affect Tor and/or Tor Browser on OS X? teor teor2345 at gmail dot com pgp 0xABFED1AC https://gist.github.com/teor2345/d033b8ce0a99adbc89c5 teor at blah dot im OTR D5BE4EC2 255D7585 F3874930 DB130265 7C9EBBC7

2 1

Did GuardFraction stuff break bandwidth weights?
by Karsten Loesing 01 Jun '15

01 Jun '15

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hi asn, hi weasel, could it be that the recently added GuardFraction stuff broke something that led to removing the "bandwidth-weights" line? All the best, Karsten $ grep -c bandwidth-weights 2015-05-31-* 2015-05-31-00-00-00-consensus:1 2015-05-31-01-00-00-consensus:1 2015-05-31-02-00-00-consensus:1 2015-05-31-03-00-00-consensus:1 2015-05-31-04-00-00-consensus:1 2015-05-31-05-00-00-consensus:1 2015-05-31-06-00-00-consensus:1 2015-05-31-07-00-00-consensus:1 2015-05-31-08-00-00-consensus:1 2015-05-31-09-00-00-consensus:1 2015-05-31-10-00-00-consensus:1 2015-05-31-11-00-00-consensus:1 2015-05-31-12-00-00-consensus:1 2015-05-31-13-00-00-consensus:0 2015-05-31-14-00-00-consensus:0 2015-05-31-15-00-00-consensus:0 2015-05-31-16-00-00-consensus:0 2015-05-31-17-00-00-consensus:0 2015-05-31-18-00-00-consensus:0 2015-05-31-19-00-00-consensus:0 2015-05-31-20-00-00-consensus:0 2015-05-31-21-00-00-consensus:0 2015-05-31-22-00-00-consensus:0 2015-05-31-23-00-00-consensus:0 $ grep -c GuardFraction 2015-05-31-* 2015-05-31-00-00-00-consensus:0 2015-05-31-01-00-00-consensus:0 2015-05-31-02-00-00-consensus:0 2015-05-31-03-00-00-consensus:0 2015-05-31-04-00-00-consensus:0 2015-05-31-05-00-00-consensus:0 2015-05-31-06-00-00-consensus:0 2015-05-31-07-00-00-consensus:0 2015-05-31-08-00-00-consensus:0 2015-05-31-09-00-00-consensus:0 2015-05-31-10-00-00-consensus:0 2015-05-31-11-00-00-consensus:0 2015-05-31-12-00-00-consensus:0 2015-05-31-13-00-00-consensus:1587 2015-05-31-14-00-00-consensus:1588 2015-05-31-15-00-00-consensus:1584 2015-05-31-16-00-00-consensus:1574 2015-05-31-17-00-00-consensus:1573 2015-05-31-18-00-00-consensus:1574 2015-05-31-19-00-00-consensus:1571 2015-05-31-20-00-00-consensus:1572 2015-05-31-21-00-00-consensus:1568 2015-05-31-22-00-00-consensus:1568 2015-05-31-23-00-00-consensus:1569 -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 Comment: GPGTools - http://gpgtools.org iQEcBAEBAgAGBQJVbDmWAAoJEJD5dJfVqbCrKMQH/28Li11R/z+JmP1pxUwN0tgB rUWlxJSmMNBWUWnASeIlMNy/QJyR/gvVINxiT6YbsesyLZMg+0Unxqs95h20QMLc taa+Du/z936uw7b+O190C1HwEPbReqjoXtGuUGYSmGety4ycm7d9dQwvIxvbWoEi Vc/qrRGL7K0JJoZTJpKxYzWgq4HWlFTW0NFmBPk6rG1/3uFAc7wS3wJ3ycJo2T31 Ye/lC6HsGx2y5nSgsgsZ9w+Iyg39lkxLEX5KnRS+LEdrGBhh9PBfQ3HL3E5jCau4 t58z1i1CPrCaoXIlX/C/J28+2gwT7I21eDGyGeMDSsB70/5+8zWHthEMm62yiuk= =mGTz -----END PGP SIGNATURE-----

2 1

Tor Browser IsolateSOCKSAuth behavior questions.
by Yawning Angel 01 Jun '15

01 Jun '15

Hello, I've been working on a dumb hack that lets me do things like this: https://imgur.com/3mah244 (Yes, that's a single Tor Browser instance, separate windows used for illustrative purposes.) It's still very raw and doesn't do everything I want it to do, so I'm not really releasing the code yet, but I have some questions regarding how Tor Browser behaves when setting the SOCKS username for isolation purposes. Ideally I want my shim to enforce isolation between the various upstreams (Tor, I2P, whatever) correctly to avoid cross-protocol probing (and to shield the I2P administration interface from eeevil websites). This appears to be straight forward if the application is Tor Browser because IsolateSOCKSAuth is always used at first glance (I will assume for now that if users decide to use things like torsocks that do not use isolation this way that they know what they are doing). My question is, what causes Tor Browser to set the SOCKS username to "--unknown--" and what the behavior should be in that case if: * The destination is a ".onion" address. * The destination is a ".i2p" address. * The destination is the I2P management console. I'm fairly sure this should be "deny". * The destination is any other address (will be dispatched over Tor if running, I don't think I will attempt to support I2P outproxies because they suck). (I think allow because things break otherwise?) For destinations that are ".onion"/".i2p", I plan to be fairly strict about making sure the SOCKS5 target and the username matches (I need to be more relaxed for sites on the regular intertubes since cross-site resources are loaded (I may make this behavior configurable...). Is this dumb? Is it common for "foo.onion" to load resources off "bar.onion"? How about in I2P land? The final form of my shim will support running with any combination of "nothing" (Tor Browser just for the "privacy benefits", probably unsafe, I may reconsider this), I2P, and Tor (Though the most useful configuration is probably I2P + Tor). Thanks in advance, -- Yawning Angel

2 2

Re: [tor-dev] valid MyFamily syntax variations ('$FP=nick' ?)
by l.m 31 May '15

31 May '15

Hi again, Although, as you've noticed, the the node you mention, Konata lists *itself* in the Family Members. That would be a bug. At least compared to the other possibilities. Onionoo checks for the bidirectional relationship and, in other cases, excludes the current node being viewed. If the current node being viewed lists itself... --leeroy

1 0

valid MyFamily syntax variations ('$FP=nick' ?)
by nusenu 31 May '15

31 May '15

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Hi, according to the spec [1] relay ops can choose between fingerprint (with and without $ prefix) and nicknames when constructing their MyFamily configs. The man page recommends fingerprints. Now I'm faced with [2][3] families that use a combination: $fp=nick Are they actually valid or is this a bug or can one actually specify arbitrary strings there? (dir auths and onionoo apparently accept them) thanks [1] https://gitweb.torproject.org/torspec.git/tree/dir-spec.txt#n504 [2] https://atlas.torproject.org/#details/2B76359D3AAA94CA107F447D2D14E481A99EB… (search for KosakaKirino) [3] https://collector.torproject.org/recent/relay-descriptors/server-descriptor… (this url has a lifetime) -----BEGIN PGP SIGNATURE----- iQIcBAEBCgAGBQJVa2WkAAoJEFv7XvVCELh0jEwQAJqdeZaFpRWPfI9/17o7aEKI Jx8Lp811GGwr4STO41ixwOIQ69hjNuav47apcmR4AsUVAq8zkSnzljKyYtVnp7qH 4EHx0kqIop92s9de1AFKg2XDnZ3u4eSN6z53VXeO2+/jFl2CgMVarzLYPHNBBF/x ev3zMk8gYsGA7K5TowZ+HnMalXhHLpTvO+iPPzNF6eY3/pG31hImFfHvhkJ5nrzB gex9wmCTXigM6I1mcT8mK8OH/2+MkNFra2h4tcEmqzmzRdWx1UWDTgl97Jp2injL UxuHL1RkoGLqlZ/MDiMiZPa4JurNRKgBXdZNsASOvcX8ZiPiCzqbbCm4hN4Rsidi ROWR8AcadA/9a5Ovi0z8IhxUiF8Ks2Wadeovp4w+E2NuYvFNmUpvkH0jVSViSE8n v+XClj0DX8oHirRqp80M0o5GpOB2hsRzT0+QhRFKYbikW2CRziM1ECWknw3aj3/z VPohoo6bkkLLBfrrXdgqclvgtoG/zPl8Ef203pmyTjPCFEdx4mJTLzq+hmjoaPsI h+RweF+HvDc0qM+6fiYeHExQl7YMNuT6GbG58lK6V8c+r++FIrPwfyOepAddoE0p dTAHfqYMYhDL952z916tmNNPnHXsUu8hVaIVuB9RvYjAU9FpPAz5Q5CDaIu+F4TY kb9dxHK1c8IHOGamYMOD =tbZE -----END PGP SIGNATURE-----

3 3

Damian's Status Report - May 2015
by Damian Johnson 31 May '15

31 May '15

Squirrels! Five newborn squirrels are in our tree! And they... oh right, code. Talk about code, Damian, like a professional. ... awww, but damn they're cute. -------------------------------------------------------------------------------- Stem Release 1.4.1 -------------------------------------------------------------------------------- Though not as adorable as baby squirrels the new release of Stem is still pretty sweet. Ephemeral hidden services, substantially faster descriptor parsing, and a host of other improvements can all be yours with a simple upgrade! https://blog.torproject.org/blog/stem-release-14 -------------------------------------------------------------------------------- Nyx Log Panel Rewrite -------------------------------------------------------------------------------- No, Nyx isn't done but its log panel is! This is the third major curses component to be rewritten, and I'm delighted to say it now sucks less! How did it suck, you ask? Though casual users may not have noticed arm had a laughably inefficient O(n^3) approach to log deduplication. This was in fact so terrible arm simply turned off deduplication when it started bogging down the system too much. This is just one of they myriad of improvements, but in Nyx deduplication is O(n^2) and can easily be made linear (... though fuzzy matching makes this grosser than I'd like so first seeing if further improvement is warranted). -------------------------------------------------------------------------------- Few other noteworthy things were... * Thanks to DonnchaC Stem's tor message parsing is now a dramatic 300x faster when using python3! https://github.com/DonnchaC/stem/pull/1 * Wrote a simple bandwidth scanner to exemplify manual circuit construction for our tutorials... https://stem.torproject.org/tutorials/to_russia_with_love.html#custom-path-… * Sambuddha both made our tutorial examples downloadable (#10411) and more easily testable (#16191)! Cheers! -Damian

1 0

Visualising similarities between relay descriptors
by Philipp Winter 31 May '15

31 May '15

Visualising the similarity between two Tor relay descriptors helps with finding Sybil attacks. I added code to sybilhunter [0] that takes as input relay descriptors, determines all (n^2)/2 pairwise similarities, and outputs DOT code (part of Graphviz) that illustrates relay clusters and what makes them similar. For now, this functionality is just a set of hard-coded rules that determine, e.g.: - Do the relays have the same, non-default exit policy? - Do the relays have a similar uptime? - Do the relays run on the same platform? To give you an idea of what this looks like, I took all relay descriptors archived by CollecTor [1] for 2015-05-30 and calculated similarities by running: $ sybilhunter -data 2015-05-30/ -cumulative -matrix -threshold 6 -visualise > sim.dot $ dot -o sim.svg -Tsvg sim.dot The resulting graph is online [2]. Vertices are relays (nickname in the first line, followed by the first eight hex digits), and the edge labels show the similarities. Unsurprisingly, there are several relay clusters that probably should be in a family, but aren't. For example, the "startor*", "torpids*", "manningsnowden*", and "Montharkan*" relays. There are, however, also several relay clusters, often named "default", that share the first two hex digits of their fingerprint. This is unlikely to be a coincidence, so they might have wanted to position themselves in the DHT. Please let me know if you have any suggestions on how to improve the tool or its visualisation. [0] <https://gitweb.torproject.org/user/phw/sybilhunter.git/> [1] <https://collector.torproject.org/recent/relay-descriptors/server-descriptor…> [2] <https://www.nymity.ch/sybilhunting/svg/2015-05-30_similarities.svg> Cheers, Philipp

1 0

How to connect test tor network from remote host.
by Mohiuddin Ebna Kawsar 30 May '15

30 May '15

Hi, I setup Tor Test-Network in my laptop using chutney with basic-min configuration and i also configured tor-browser with this test network to browse internet. But now i want to bootstrap Test Tor-Network inside Virtual Machine. (Virtual Machine 1 = (3 AUTHORITY + 1 RELAY) IP= *10.0.2.11* (Virtual Machine 2 = (tor-browser) IP= *10.0.2.9* But this time tor-browser is not bootstrapping. I can ping from (11 to 9) torbrowser torrc config () ############################################### AllowSingleHopExits 1 CircuitIdleTimeout 100 DataDirectory tor-browser_en-US/Browser/TorBrowser/Data/Tor DirReqStatistics 0 DirAuthority test000a orport=5000 no-v2 hs v3ident=32D2EB75473AB923F63D0D3C4B6929FC1BB658AE *10.0.2.11*:7000 1DB6AEADE945A2EE1722A203CFED30478D0C8C82 DirAuthority test001a orport=5001 no-v2 hs v3ident=0D6042A1C288C7891888248CDDAA58D9B907ECF1 *10.0.2.11* :7001 84B06F3CF268D941CD11E725AACA287152C90C70 DirAuthority test002a orport=5002 no-v2 hs v3ident=AD22661D7D85F72D3D24B789092F8BE4454EFFAC *10.0.2.11* :7002 2AFD392AC496045351CCF8CBF148944FEF0AEAE4 DisableDebuggerAttachment 0 ExitNodes test000a GeoIPFile tor-browser_en-US/Browser/TorBrowser/Data/Tor/geoip GeoIPv6File tor-browser_en-US/Browser/TorBrowser/Data/Tor/geoip6 KeepalivePeriod 100 TestingTorNetwork 1 ProtocolWarnings 1 SafeLogging 0 StrictNodes 1 ########################################################################### Please help..

2 7

Adding a NotDir router status flag
by Matthew Finkel 29 May '15

29 May '15

Sadly it took a few months for me to get back to prop 237 (All relays are directory servers), but now I have a revised version of the proposal and updated tor[0] and torspec[1][2] branches. These will benefit from your review. Previously, proposal 237 took advantage of the V2Dir flag because Authorities already vote on it and it accomplished 90% of what we need. But I realized that's not exactly what we want. Now the proposal introduces a new status flag, NotDir. The reasoning for this is the V2Dir flag indicates a router (is expected to) respond to directory requests, usually, because the operator configured the router's DirPort. But, in a network where nearly all relays are directory servers, why are relays with the V2Dir flag special? Basically, after this proposal is implemented nearly every relay should receive the V2Dir flag, so the NotDir flag is the complement of V2Dir. This allows the V2Dir be deprecated at some time in the future. Thoughts? Thanks, Matt [0] https://git.torproject.org/user/sysrqb/tor.git, feature12538_rebased_6 [1] https://git.torproject.org/user/sysrqb/torspec.git, prop237_update [2] feature12538

2 1

Is it okay to use Debian Jessie for development?
by l.m 28 May '15

28 May '15

Hello, I probably should have asked this sooner. How quickly does tor project upgrade to the latest Debian stable on development machines [0] ? Thanks in advance. --leeroy [0] https://db.torproject.org/machines.cgi

1 0

[RELEASE] Torsocks 2.1.0
by David Goulet 28 May '15

28 May '15

Hi everyone! This is the release for version 2.1.0 of Torsocks. Special thanks to Yawning that helped a lot with the new features, finding bugs and providing patches! Also, thanks to all contributors and users out there providing us with feedbacks! :) Changes that are worth mentionning: - Support for TCP fast open. - AllowOutboundLocalhost option allows torsocks to connect to a localhost address. - IsolatePID is a new option that will make torsocks set the SOCKS5 username and password automatically to provide isolation on Tor side. You can use this with the -i,--isolate command added or TORSOCKS_ISOLATE_PID env. variable. - Fix initialization phase when used with C++. - Way less annoying warnings of syscall being denied. Most of them were harmless so we let them pass now. - Multiple fixes! (see changelog below) Here is the change log for this version. 2015-05-27 torsocks 2.1.0 * Fix: socks5 resolve wasn't sending data correctly * Fix: wrong label when auth_socks5 fail * Move SOCKS5 auth in a seperate function * Send the SOCKS5 authentication for RESOLVE/RESOLVE_PTR requests. * Change IsolatePID password from 42 to 0 * Add automatic per process isolation (IsolatePID) * Ensure that torsocks initializes itself in the presence of C++. * Merge remote-tracking branch 'yawning/getaddrinfo' into getaddrinfo * Fix: indentation in getpeername test * Merge remote-tracking branch 'yawning/getpeername' * Add support for the various inotify routines when invoked via syscall(). * Support the eventfd2(2) syscall. * Support the various epoll routines when invoked via syscall(). * Handle accept4(2) when invoked via syscall(). * Fix getaddrinfo() to respect AI_NUMERICHOST. * Fix the broken getpeername() implementation. * Support certain Linux specific syscalls. * Allow TCP Fast Open clients go through tor * Test: support out of tree make check * configure.ac: avoid tests which have both -pie and -static * Fix error messages about setuid/setgid executables * Fix: switch back to a syscall whitelist scheme * Add AllowOutboundLocalhost. * Fix: syscall mmap for NetBSD * Fix: use getsockname instead of getsockopt to get socket family * Stop denying syscall() and add dangerous ones * Fix: typo in the listen macro declaration * Fix: improve getpeername to actually works * Fix: improve Unix socket passing detection * Test: add missing connection destroy * Test: possible double free in onion test * Test: fix memory leak in DNS test * Add accept as an accepted value through syscall() * Add cscope files to gitignore Again, as usual, and forever! *please* code review, test and most importantly report any issues. Contribution ftw! :) Thanks to everyone! Git: https://gitweb.torproject.org/torsocks.git Tarball: https://people.torproject.org/~dgoulet/torsocks/torsocks-2.1.0.tar.bz2 (sig: https://people.torproject.org/~dgoulet/torsocks/torsocks-2.1.0.tar.bz2.asc) Cheers! David

4 4

Re: [tor-dev] [tor-talk] [RELEASE] Torsocks 2.1.0
by David Goulet 28 May '15

28 May '15

On 27 May (18:14:37), Yuri wrote: > On 05/27/2015 12:19, David Goulet wrote: > >Hi everyone! > > > >This is the release for version 2.1.0 of Torsocks. Special thanks to > >Yawning that helped a lot with the new features, finding bugs and > >providing patches! Also, thanks to all contributors and users out there > >providing us with feedbacks!:) > > Hi David, > > Why didn't you merge all pull requests for the release? Hello! What other pull requests are you talking about? There are a couple of open tickets that need more time and thinking so I released this one because of the amount of fixes that has been accumulating. Cheers! David > > Yuri

1 0

(Draft) Proposal 224: Next-Generation Hidden Services in Tor
by Nick Mathewson 28 May '15

28 May '15

Hi, all! I've been trying to fill in all the cracks and corners for a revamp of the hidden services protocol, based on earlier writings by George Kadianakis and other discussions on the mailing list. (See draft acknowledgments section below.) After a bunch of comments, I'm ready to give this a number and call it (draft) proposal 224. I'd like to know what doesn't make sense, what I need to explain better, and what I need to design better. I'd like to fill in the gaps and turn this into a more full document. I'd like to answer the open questions. Comments are most welcome, especially if they grow into improvements. FWIW, I am likely to be offline for most of the current weekend, because of Thanksgiving, so please be patient with my reply speed; I hope to catch up with emails next week. Filename: 224-rend-spec-ng.txt Title: Next-Generation Hidden Services in Tor Author: Nick Mathewson Created: 2013-11-29 Status: Draft -1. Draft notes This document describes a proposed design and specification for hidden services in Tor version 0.2.5.x or later. It's a replacement for the current rend-spec.txt, rewritten for clarity and for improved design. Look for the string "TODO" below: it describes gaps or uncertainties in the design. Change history: 2013-11-29: Proposal first numbered. Some TODO and XXX items remain. 0. Hidden services: overview and preliminaries. Hidden services aim to provide responder anonymity for bidirectional stream-based communication on the Tor network. Unlike regular Tor connections, where the connection initiator receives anonymity but the responder does not, hidden services attempt to provide bidirectional anonymity. Other features include: * [TODO: WRITE ME once there have been some more drafts and we know what the summary should say.] Participants: Operator -- A person running a hidden service Host, "Server" -- The Tor software run by the operator to provide a hidden service. User -- A person contacting a hidden service. Client -- The Tor software running on the User's computer Hidden Service Directory (HSDir) -- A Tor node that hosts signed statements from hidden service hosts so that users can make contact with them. Introduction Point -- A Tor node that accepts connection requests for hidden services and anonymously relays those requests to the hidden service. Rendezvous Point -- A Tor node to which clients and servers connect and which relays traffic between them. 0.1. Improvements over previous versions. [TODO write me once there have been more drafts and we know what the summary should say.] 0.2. Notation and vocabulary Unless specified otherwise, all multi-octet integers are big-endian. We write sequences of bytes in two ways: 1. A sequence of two-digit hexadecimal values in square brackets, as in [AB AD 1D EA]. 2. A string of characters enclosed in quotes, as in "Hello". These characters in these string are encoded in their ascii representations; strings are NOT nul-terminated unless explicitly described as NUL terminated. We use the words "byte" and "octet" interchangeably. We use the vertical bar | to denote concatenation. We use INT_N(val) to denote the network (big-endian) encoding of the unsigned integer "val" in N bytes. For example, INT_4(1337) is [00 00 05 39]. 0.3. Cryptographic building blocks This specification uses the following cryptographic building blocks: * A stream cipher STREAM(iv, k) where iv is a nonce of length S_IV_LEN bytes and k is a key of length S_KEY_LEN bytes. * A public key signature system SIGN_KEYGEN()->seckey, pubkey; SIGN_SIGN(seckey,msg)->sig; and SIGN_CHECK(pubkey, sig, msg) -> { "OK", "BAD" }; where secret keys are of length SIGN_SECKEY_LEN bytes, public keys are of length SIGN_PUBKEY_LEN bytes, and signatures are of length SIGN_SIG_LEN bytes. This signature system must also support key blinding operations as discussed in appendix [KEYBLIND] and in section [SUBCRED]: SIGN_BLIND_SECKEY(seckey, blind)->seckey2 and SIGN_BLIND_PUBKEY(pubkey, blind)->pubkey2 . * A public key agreement system "PK", providing PK_KEYGEN()->seckey, pubkey; PK_VALID(pubkey) -> {"OK", "BAD"}; and PK_HANDHAKE(seckey, pubkey)->output; where secret keys are of length PK_SECKEY_LEN bytes, public keys are of length PK_PUBKEY_LEN bytes, and the handshake produces outputs of length PK_OUTPUT_LEN bytes. * A cryptographic hash function H(d), which should be preimage and collision resistant. It produces hashes of length HASH_LEN bytes. * A cryptographic message authentication code MAC(key,msg) that produces outputs of length MAC_LEN bytes. * A key derivation function KDF(key data, salt, personalization, n) that outputs n bytes. As a first pass, I suggest: * Instantiate STREAM with AES128-CTR. [TODO: or ChaCha20?] * Instantiate SIGN with Ed25519 and the blinding protocol in [KEYBLIND]. * Instantiate PK with Curve25519. * Instantiate H with SHA256. [TODO: really?] * Instantiate MAC with HMAC using H. * Instantiate KDF with HKDF using H. For legacy purposes, we specify compatibility with older versions of the Tor introduction point and rendezvous point protocols. These used RSA1024, DH1024, AES128, and SHA1, as discussed in rend-spec.txt. Except as noted, all RSA keys MUST have exponent values of 65537. As in [proposal 220], all signatures are generated not over strings themselves, but over those strings prefixed with a distinguishing value. 0.4. Protocol building blocks [BUILDING-BLOCKS] In sections below, we need to transmit the locations and identities of Tor nodes. We do so in the link identification format used by EXTEND2 cells in the Tor protocol. NSPEC (Number of link specifiers) [1 byte] NSPEC times: LSTYPE (Link specifier type) [1 byte] LSLEN (Link specifier length) [1 byte] LSPEC (Link specifier) [LSLEN bytes] Link specifier types are as described in tor-spec.txt. Every set of link specifiers MUST include at minimum specifiers of type [00] (TLS-over-TCP, IPv4) and [02] (legacy node identity). We also incorporate Tor's circuit extension handshakes, as used in the CREATE2 and CREATED2 cells described in tor-spec.txt. In these handshakes, a client who knows a public key for a server sends a message and receives a message from that server. Once the exchange is done, the two parties have a shared set of forward-secure key material, and the client knows that nobody else shares that key material unless they control the secret key corresponding to the server's public key. 0.5. Assigned relay cell types These relay cell types are reserved for use in the hidden service protocol. 32 -- RELAY_COMMAND_ESTABLISH_INTRO Sent from hidden service host to introduction point; establishes introduction point. Discussed in [REG_INTRO_POINT]. 33 -- RELAY_COMMAND_ESTABLISH_RENDEZVOUS Sent from client to rendezvous point; creates rendezvous point. Discussed in [EST_REND_POINT]. 34 -- RELAY_COMMAND_INTRODUCE1 Sent from client to introduction point; requests introduction. Discussed in [SEND_INTRO1] 35 -- RELAY_COMMAND_INTRODUCE2 Sent from client to introduction point; requests introduction. Same format as INTRODUCE1. Discussed in [FMT_INTRO1] and [PROCESS_INTRO2] 36 -- RELAY_COMMAND_RENDEZVOUS1 Sent from introduction point to rendezvous point; attempts to join introduction point's circuit to client's circuit. Discussed in [JOIN_REND] 37 -- RELAY_COMMAND_RENDEZVOUS2 Sent from introduction point to rendezvous point; reports join of introduction point's circuit to client's circuit. Discussed in [JOIN_REND] 38 -- RELAY_COMMAND_INTRO_ESTABLISHED Sent from introduction point to hidden service host; reports status of attempt to establish introduction point. Discussed in [INTRO_ESTABLISHED] 39 -- RELAY_COMMAND_RENDEZVOUS_ESTABLISHED Sent from rendezvous point to client; acknowledges receipt of ESTABLISH_RENDEZVOUS cell. Discussed in [EST_REND_POINT] 40 -- RELAY_COMMAND_INTRODUCE_ACK Sent form introduction point to client; acknowledges receipt of INTRODUCE1 cell and reports success/failure. Discussed in [INTRO_ACK] 0.5. Acknowledgments [TODO reformat these once the lists are more complete.] This design includes ideas from many people, including Christopher Baines, Daniel J. Bernstein, Matthew Finkel, Ian Goldberg, George Kadianakis, Aniket Kate, Tanja Lange, Robert Ransom, It's based on Tor's original hidden service design by Roger Dingledine, Nick Mathewson, and Paul Syverson, and on improvements to that design over the years by people including Tobias Kamm, Thomas Lauterbach, Karsten Loesing, Alessandro Preite Martinez, Robert Ransom, Ferdinand Rieger, Christoph Weingarten, Christian Wilms, We wouldn't be able to do any of this work without good attack designs from researchers including Alex Biryukov, Lasse Øverlier, Ivan Pustogarov, Paul Syverson Ralf-Philipp Weinmann, See [ATTACK-REFS] for their papers. Several of these ideas have come from conversations with Christian Grothoff, Brian Warner, Zooko Wilcox-O'Hearn, And if this document makes any sense at all, it's thanks to editing help from Matthew Finkel George Kadianakis, Peter Palfrader, [XXX Acknowledge the huge bunch of people working on 8106.] [XXX Acknowledge the huge bunch of people working on 8244.] Please forgive me if I've missed you; please forgive me if I've misunderstood your best ideas here too. 1. Protocol overview In this section, we outline the hidden service protocol. This section omits some details in the name of simplicity; those are given more fully below, when we specify the protocol in more detail. 1.1. View from 10,000 feet A hidden service host prepares to offer a hidden service by choosing several Tor nodes to serve as its introduction points. It builds circuits to those nodes, and tells them to forward introduction requests to it using those circuits. Once introduction points have been picked, the host builds a set of documents called "hidden service descriptors" (or just "descriptors" for short) and uploads them to a set of HSDir nodes. These documents list the hidden service's current introduction points and describe how to make contact with the hidden service. When a client wants to connect to a hidden service, it first chooses a Tor node at random to be its "rendezvous point" and builds a circuit to that rendezvous point. If the client does not have an up-to-date descriptor for the service, it contacts an appropriate HSDir and requests such a descriptor. The client then builds an anonymous circuit to one of the hidden service's introduction points listed in its descriptor, and gives the introduction point an introduction request to pass to the hidden service. This introduction request includes the target rendezvous point and the first part of a cryptographic handshake. Upon receiving the introduction request, the hidden service host makes an anonymous circuit to the rendezvous point and completes the cryptographic handshake. The rendezvous point connects the two circuits, and the cryptographic handshake gives the two parties a shared key and proves to the client that it is indeed talking to the hidden service. Once the two circuits are joined, the client can send Tor RELAY cells to the server. RELAY_BEGIN cells open streams to an external process or processes configured by the server; RELAY_DATA cells are used to communicate data on those streams, and so forth. 1.2. In more detail: naming hidden services [NAMING] A hidden service's name is its long term master identity key. This is encoded as a hostname by encoding the entire key in Base 32, and adding the string ".onion" at the end. (This is a change from older versions of the hidden service protocol, where we used an 80-bit truncated SHA1 hash of a 1024 bit RSA key.) The names in this format are distinct from earlier names because of their length. An older name might look like: unlikelynamefora.onion yyhws9optuwiwsns.onion And a new name following this specification might look like: a1uik0w1gmfq3i5ievxdm9ceu27e88g6o7pe0rffdw9jmntwkdsd.onion Note that since master keys are 32 bytes long, and 52 bytes of base 32 encoding can hold 260 bits of information, we have four unused bits in each of these names. [TODO: Alternatively, we could require that the first bit of the master key always be zero, and use a 51-byte encoding. Or we could require that the first two bits be zero, and use a 51-byte encoding and reserve the first bit. Or we could require that the first nine bits, or ten bits be zero, etc.] 1.3. In more detail: Access control [IMD:AC] Access control for a hidden service is imposed at multiple points through the process above. In order to download a descriptor, clients must know which blinded signing key was used to sign it. (See the next section for more info on key blinding.) This blinded signing key is derived from the service's public key and, optionally, an additional secret that is not part of the hidden service's onion address. The public key and this secret together constitute the service's "credential". When the secret is in use, the hidden service gains protections equivalent to the "stealth mode" in previous designs. To learn the introduction points, the clients must decrypt the body of the hidden service descriptor. The encryption key for these is derived from the service's credential. In order to make an introduction point send a request to the server, the client must know the introduction point and know the service's per-introduction-point authentication key from the hidden service descriptor. The final level of access control happens at the server itself, which may decide to respond or not respond to the client's request depending on the contents of the request. The protocol is extensible at this point: at a minimum, the server requires that the client demonstrate knowledge od the contents of the encrypted portion of the hidden service descriptor. The service may additionally require a user- or group-specific access token before it responds to requests. 1.4. In more detail: Distributing hidden service descriptors. [IMD:DIST] Periodically, hidden service descriptors become stored at different locations to prevent a single directory or small set of directories from becoming a good DoS target for removing a hidden service. For each period, the Tor directory authorities agree upon a collaboratively generated random value. (See section 2.3 for a description of how to incorporate this value into the voting practice; generating the value is described in other proposals, including [TODO: add a reference]) That value, combined with hidden service directories' public identity keys, determines each HSDirs' position in the hash ring for descriptors made in that period. Each hidden service's descriptors are placed into the ring in positions based on the key that was used to sign them. Note that hidden service descriptors are not signed with the services' public keys directly. Instead, we use a key-blinding system [KEYBLIND] to create a new key-of-the-day for each hidden service. Any client that knows the hidden service's credential can derive these blinded signing keys for a given period. It should be impossible to derive the blinded signing key lacking that credential. The body of each descriptor is also encrypted with a key derived from the credential. To avoid a "thundering herd" problem where every service generates and uploads a new descriptor at the start of each period, each descriptor comes online at a time during the period that depends on its blinded signing key. The keys for the last period remain valid until the new keys come online. 1.5. In more detail: Scaling to multiple hosts [THIS SECTION IS UNFINISHED] In order to allow multiple hosts to provide a single hidden service, I'm considering two options. * We can have each server build an introduction circuit to each introduction point, and have the introduction points responsible for round-robining between these circuits. One service host is responsible for picking the introduction points and publishing the descriptors. * We can have servers choose their introduction points independently, and build circuits to them. One service host is responsible for combining these introduction points into a single descriptor. If we want to avoid having a single "master" host without which the whole service goes down (the "one service host" in the description above), we need a way to fail over from one host to another. We also need a way to coordinate between the hosts. This is as yet undesigned. Maybe it should use a hidden service? See [SCALING-REFS] for discussion on this topic. [TODO: Finalize this design.] 1.6. In more detail: Backward compatibility with older hidden service protocols This design is incompatible with the clients, server, and hsdir node protocols from older versions of the hidden service protocol as described in rend-spec.txt. On the other hand, it is designed to enable the use of older Tor nodes as rendezvous points and introduction points. 1.7. In more detail: Offline operation In this design, a hidden service's secret identity key may be stored offline. It's used only to generate blinded identity keys, which are used to sign descriptor signing keys. In order to operate a hidden service, the operator can generate a number of descriptor signing keys and their certifications (see [DESC-OUTER] and [ENCRYPTED-DATA] below), and their corresponding descriptor encryption keys, and export those to the hidden service hosts. 1.8. In more detail: Encryption Keys And Replay Resistance To avoid replays of an introduction request by an introduction point, a hidden service host must never accept the same request twice. Earlier versions of the hidden service design used a authenticated timestamp here, but including a view of the current time can create a problematic fingerprint. (See proposal 222 for more discussion.) 1.9. In more detail: A menagerie of keys [In the text below, an "encryption keypair" is roughly "a keypair you can do Diffie-Hellman with" and a "signing keypair" is roughly "a keypair you can do ECDSA with."] Public/private keypairs defined in this document: Master (hidden service) identity key -- A master signing keypair used as the identity for a hidden service. This key is not used on its own to sign anything; it is only used to generate blinded signing keys as described in [KEYBLIND] and [SUBCRED]. Blinded signing key -- A keypair derived from the identity key, used to sign descriptor signing keys. Changes periodically for each service. Clients who know a 'credential' consisting of the service's public identity key and an optional secret can derive the public blinded identity key for a service. This key is used as an index in the DHT-like structure of the directory system. Descriptor signing key -- A key used to sign hidden service descriptors. This is signed by blinded signing keys. Unlike blinded signing keys and master identity keys, the secret part of this key must be stored online by hidden service hosts. Introduction point authentication key -- A short-term signing keypair used to identify a hidden service to a given introduction point. A fresh keypair is made for each introduction point; these are used to sign the request that a hidden service host makes when establishing an introduction point, so that clients who know the public component of this key can get their introduction requests sent to the right service. No keypair is ever used with more than one introduction point. (previously called a "service key" in rend-spec.txt) Introduction point encryption key -- A short-term encryption keypair used when establishing connections via an introduction point. Plays a role analogous to Tor nodes' onion keys. A fresh keypair is made for each introduction point. Symmetric keys defined in this document: Descriptor encryption keys -- A symmetric encryption key used to encrypt the body of hidden service descriptors. Derived from the current period and the hidden service credential. Public/private keypairs defined elsewhere: Onion key -- Short-term encryption keypair (Node) identity key Symmetric key-like things defined elsewhere: KH from circuit handshake -- An unpredictable value derived as part of the Tor circuit extension handshake, used to tie a request to a particular circuit. 2. Generating and publishing hidden service descriptors [HSDIR] Hidden service descriptors follow the same metaformat as other Tor directory objects. They are published anonymously to Tor servers with the HSDir3 flag. (Authorities should assign this flag as they currently assign the HSDir flag, except that they should restrict it to Tor versions implementing the HSDir parts of this specification.) 2.1. Deriving blinded keys and subcredentials [SUBCRED] In each time period (see [TIME-PERIOD] for a definition of time periods), a hidden service host uses a different blinded private key to sign its directory information, and clients use a different blinded public key as the index for fetching that information. For a candidate for a key derivation method, see Appendix [KEYBLIND]. Additionally, clients and hosts derive a subcredential for each period. Knowledge of the subcredential is needed to decrypt hidden service descriptors for each period and to authenticate with the hidden service host in the introduction process. Unlike the credential, it changes each period. Knowing the subcredential, even in combination with the blinded private key, does not enable the hidden service host to derive the main credential--therefore, it is safe to put the subcredential on the hidden service host while leaving the hidden service's private key offline. The subcredential for a period is derived as: H("subcredential" | credential | blinded-public-key). 2.2. Locating, uploading, and downloading hidden service descriptors [HASHRING] To avoid attacks where a hidden service's descriptor is easily targeted for censorship, we store them at different directories over time, and use shared random values to prevent those directories from being predictable far in advance. Which Tor servers hosts a hidden service depends on: * the current time period, * the daily subcredential, * the hidden service directories' public keys, * a shared random value that changes in each time period, * a set of network-wide networkstatus consensus parameters. Below we explain in more detail. 2.2.1. Dividing time into periods [TIME-PERIODS] To prevent a single set of hidden service directory from becoming a target by adversaries looking to permanently censor a hidden service, hidden service descriptors are uploaded to different locations that change over time. The length of a "time period" is controlled by the consensus parameter 'hsdir-interval', and is a number of minutes between 30 and 14400 (10 days). The default time period length is 1500 (one day plus one hour). Time periods start with the Unix epoch (Jan 1, 1970), and are computed by taking the number of whole minutes since the epoch and dividing by the time period. So if the current time is 2013-11-12 13:44:32 UTC, making the seconds since the epoch 1384281872, the number of minutes since the epoch is 23071364. If the current time period length is 1500 (the default), then the current time period number is 15380. It began 15380*1500*60 seconds after the epoch at 2013-11-11 20:00:00 UTC, and will end at (15380+1)*1500*60 seconds after the epoch at 2013-11-12 21:00:00 UTC. 2.2.2. Overlapping time periods to avoid thundering herds [TIME-OVERLAP] If every hidden service host were to generate a new set of keys and upload a new descriptor at exactly the start of each time period, the directories would be overwhelmed by every host uploading at the same time. Instead, each public key becomes valid at its new location at a deterministic time somewhat _before_ the period begins, depending on the public key and the period. The time at which a key might first become valid is determined by the consensus parameter "hsdir-overlap-begins", which is an integer in range [1,100] with default value 80. This parameter denotes a percentage of the interval for which no overlap occurs. So for the default interval (1500 minutes) and default overlap-begins value (80%), new keys do not become valid for the first 1200 minutes of the interval. The new shared random value must be published *before* the start of the next overlap interval by at least enough time to ensure that clients all get it. [TODO: how much earlier?] The time at which a key from the next interval becomes valid is determined by taking the first two bytes of OFFSET = H(Key | INT_8(Next_Period_Num)) as a big-endian integer, dividing by 65536, and treating that as a fraction of the overlap interval. For example, if the period is 1500 minutes long, and overlap interval is 300 minutes long, and OFFSET begins with [90 50], then the next key becomes valid at 1200 + 300 * (0x9050 / 65536) minutes, or approximately 22 hours and 49 minutes after the beginning of the period. Hidden service directories should accept descriptors at least [TODO: how much?] minutes before they would become valid, and retain them for at least [TODO: how much?] minutes after the end of the period. When a client is looking for a service, it must calculate its key both for the current and for the subsequent period, to decide whether the next period's key is valid yet. 2.2.3. Where to publish a service descriptor The following consensus parameters control where a hidden service descriptor is stored; hsdir_n_replicas = an integer in range [1,16] with default value 2. hsdir_spread_fetch = an integer in range [1,128] with default value 3. hsdir_spread_store = an integer in range [1,128] with default value 3. hsdir_spread_accept = an integer in range [1,128] with default value 8. To determine where a given hidden service descriptor will be stored in a given period, after the blinded public key for that period is derived, the uploading or downloading party calculate for replicanum in 1...hsdir_n_replicas: hs_index(replicanum) = H("store-at-idx" | blinded_public_key | replicanum | periodnum) where blinded_public_key is specified in section KEYBLIND, and periodnum is defined in section TIME-PERIODS. where n_replicas is determined by the consensus parameter "hsdir_n_replicas". Then, for each node listed in the current consensus with the HSDir3 flag, we compute a directory index for that node as: hsdir_index(node) = H(node_identity_digest | shared_random | INT_8(period_num) ) where shared_random is the shared value generated by the authorities in section PUB-SHAREDRANDOM. Finally, for replicanum in 1...hsdir_n_replicas, the hidden service host uploads descriptors to the first hsdir_spread_store nodes whose indices immediately follow hs_index(replicanum). When choosing an HSDir to download from, clients choose randomly from among the first hsdir_spread_fetch nodes after the indices. (Note that, in order to make the system better tolerate disappearing HSDirs, hsdir_spread_fetch may be less than hsdir_spread_store.) An HSDir should rejects a descriptor if that HSDir is not one of the first hsdir_spread_accept HSDirs for that node. [TODO: Incorporate the findings from proposal 143 here. But watch out: proposal 143 did not analyze how much the set of nodes changes over time, or how much client and host knowledge might diverge.] 2.2.4. URLs for anonymous uploading and downloading Hidden service descriptors conforming to this specification are uploaded with an HTTP POST request to the URL /tor/rendezvous3/publish relative to the hidden service directory's root, and downloaded with an HTTP GET request for the URL /tor/rendezvous3/<z> where z is a base-64 encoding of the hidden service's blinded public key. [TODO: raw base64 is not super-nice for URLs, since it can have slashes. We already use it for microdescriptor URLs, though. Do we care here?] These requests must be made anonymously, on circuits not used for anything else. 2.3. Publishing shared random values [PUB-SHAREDRANDOM] Our design for limiting the predictability of HSDir upload locations relies on a shared random value that isn't predictable in advance or too influenceable by an attacker. The authorities must run a protocol to generate such a value at least once per hsdir period. Here we describe how they publish these values; the procedure they use to generate them can change independently of the rest of this specification. For one possible (somewhat broken) protocol, see Appendix [SHAREDRANDOM]. We add a new line in votes and consensus documents: "hsdir-shared-random" PERIOD-START VALUE PERIOD-START = YYYY-MM-DD HH:MM:SS VALUE = A base-64 encoded 256-bit value. To decide which hsdir-shared-random line to include in a consensus for a given PERIOD-START, we choose whichever line appears verbatim in the most votes, so long as it is listed by at least three authorities. Ties are broken in favor of the lower value. More than one PERIOD-START is allowed per vote, and per consensus. The same PERIOD-START must not appear twice in a vote or in a consensus. [TODO: Need to define a more robust algorithm. Need to cover cases where multiple cluster of authorities publish a different value, etc.] The hs-dir-shared-random lines appear, sorted by PERIOD-START, in the consensus immediately after the "params" line. The authorities should publish the shared random value for the current period, and, at a time at least three voting periods before the overlap interval begins, the shared random value for the next period. [TODO: find out what weasel doesn't like here.] 2.4. Hidden service descriptors: outer wrapper [DESC-OUTER] The format for a hidden service descriptor is as follows, using the meta-format from dir-spec.txt. "hs-descriptor" SP "3" SP public-key SP certification NL [At start, exactly once.] public-key is the blinded public key for the service, encoded in base 64. Certification is a certification of a short-term ed25519 descriptor signing key using the public key, in the format of proposal 220. "time-period" SP YYYY-MM-DD HH:MM:SS NUM NL [Exactly once.] The time period for which this descriptor is relevant, including its starting time and its period number. "revision-counter" SP Integer NL [Exactly once.] The revision number of the descriptor. If an HSDir receives a second descriptor for a key that it already has a descriptor for, it should retain and serve the descriptor with the higher revision-counter. (Checking for monotonically increasing revision-counter values prevents an attacker from replacing a newer descriptor signed by a given key with a copy of an older version.) "encrypted" NL encrypted-string [Exactly once.] An encrypted blob, whose format is discussed in [ENCRYPTED-DATA] below. The blob is base-64 encoded and enclosed in -----BEGIN MESSAGE---- and ----END MESSAGE---- wrappers. "signature" SP signature NL [exactly once, at end.] A signature of all previous fields, using the signing key in the hs-descriptor line. We use a separate key for signing, so that the hidden service host does not need to have its private blinded key online. 2.5. Hidden service descriptors: encryption format [ENCRYPTED-DATA] The encrypted part of the hidden service descriptor is encrypted and authenticated with symmetric keys generated as follows: salt = 16 random bytes secret_input = nonce | blinded_public_key | subcredential | INT_4(revision_counter) keys = KDF(secret_input, salt, "hsdir-encrypted-data", S_KEY_LEN + S_IV_LEN + MAC_KEY_LEN) SECRET_KEY = first S_KEY_LEN bytes of keys SECRET_IV = next S_IV_LEN bytes of keys MAC_KEY = last MAC_KEY_LEN bytes of keys The encrypted data has the format: SALT (random bytes from above) [16 bytes] ENCRYPTED The plaintext encrypted with S [variable] MAC MAC of both above fields [32 bytes] The encryption format is ENCRYPTED = STREAM(SECRET_IV,SECRET_KEY) xor Plaintext Before encryption, the plaintext must be padded to a multiple of ??? bytes with NUL bytes. The plaintext must not be longer than ??? bytes. [TODO: how much? Should this be a parameter? What values in practice is needed to hide how many intro points we have, and how many might be legacy ones?] The plaintext format is: "create2-formats" SP formats NL [Exactly once] A space-separated list of integers denoting CREATE2 cell format numbers that the server recognizes. Must include at least TAP and ntor as described in tor-spec.txt. See tor-spec section 5.1 for a list of recognized handshake types. "authentication-required" SP types NL [At most once] A space-separated list of authentication types. A client that does not support at least one of these authentication types will not be able to contact the host. Recognized types are: 'password' and 'ed25519'. See [INTRO-AUTH] below. At least once: "introduction-point" SP link-specifiers NL [Exactly once per introduction point at start of introduction point section] The link-specifiers is a base64 encoding of a link specifier block in the format described in BUILDING-BLOCKS. "auth-key" SP "ed25519" SP key SP certification NL [Exactly once per introduction point] Base-64 encoded introduction point authentication key that was used to establish introduction point circuit, cross-certifying the blinded public key key using the certification format of proposal 220. "enc-key" SP "ntor" SP key NL [At most once per introduction point] Base64-encoded curve25519 key used to encrypt request to hidden service. [TODO: I'd like to have a cross-certification here too.] "enc-key" SP "legacy" NL key NL [At most once per introduction point] Base64-encoded RSA key, wrapped in "----BEGIN RSA PUBLIC KEY-----" armor, for use with a legacy introduction point as described in [LEGACY_EST_INTRO] and [LEGACY-INTRODUCE1] below. Exactly one of the "enc-key ntor" and "enc-key legacy" elements must be present for each introduction point. [TODO: I'd like to have a cross-certification here too.] Other encryption and authentication key formats are allowed; clients should ignore ones they do not recognize. 3. The introduction protocol The introduction protocol proceeds in three steps. First, a hidden service host builds an anonymous circuit to a Tor node and registers that circuit as an introduction point. [Between these steps, the hidden service publishes its introduction points and associated keys, and the client fetches them as described in section [HSDIR] above.] Second, a client builds an anonymous circuit to the introduction point, and sends an introduction request. Third, the introduction point relays the introduction request along the introduction circuit to the hidden service host, and acknowledges the introduction request to the client. 3.1. Registering an introduction point [REG_INTRO_POINT] 3.1.1. Extensible ESTABLISH_INTRO protocol. [EST_INTRO] When a hidden service is establishing a new introduction point, it sends a ESTABLISH_INTRO cell with the following contents: AUTH_KEY_TYPE [1 byte] AUTH_KEY_LEN [1 byte] AUTH_KEY [AUTH_KEY_LEN bytes] Any number of times: EXT_FIELD_TYPE [1 byte] EXT_FIELD_LEN [1 byte] EXT_FIELD [EXTRA_FIELD_LEN bytes] ZERO [1 byte] HANDSHAKE_AUTH [MAC_LEN bytes] SIGLEN [1 byte] SIG [SIGLEN bytes] The AUTH_KEY_TYPE field indicates the type of the introduction point authentication key and the type of the MAC to use in for HANDSHAKE_AUTH. Recognized types are: [00, 01] -- Reserved for legacy introduction cells; see [LEGACY_EST_INTRO below] [02] -- Ed25519; HMAC-SHA256. [FF] -- Reserved for maintenance messages on existing circuits; see MAINT_INTRO below. [TODO: Should this just be a new relay cell type? Matthew and George think so.] The AUTH_KEY_LEN field determines the length of the AUTH_KEY field. The AUTH_KEY field contains the public introduction point authentication key. The EXT_FIELD_TYPE, EXT_FIELD_LEN, EXT_FIELD entries are reserved for future extensions to the introduction protocol. Extensions with unrecognized EXT_FIELD_TYPE values must be ignored. The ZERO field contains the byte zero; it marks the end of the extension fields. The HANDSHAKE_AUTH field contains the MAC of all earlier fields in the cell using as its key the shared per-circuit material ("KH") generated during the circuit extension protocol; see tor-spec.txt section 5.2, "Setting circuit keys". It prevents replays of ESTABLISH_INTRO cells. SIGLEN is the length of the signature. SIG is a signature, using AUTH_KEY, of all contents of the cell, up to but not including SIG. These contents are prefixed with the string "Tor establish-intro cell v1". Upon receiving an ESTABLISH_INTRO cell, a Tor node first decodes the key and the signature, and checks the signature. The node must reject the ESTABLISH_INTRO cell and destroy the circuit in these cases: * If the key type is unrecognized * If the key is ill-formatted * If the signature is incorrect * If the HANDSHAKE_AUTH value is incorrect * If the circuit is already a rendezvous circuit. * If the circuit is already an introduction circuit. [TODO: some scalability designs fail there.] * If the key is already in use by another circuit. Otherwise, the node must associate the key with the circuit, for use later in INTRODUCE1 cells. [TODO: The above will work fine with what we do today, but it will do quite badly if we ever freak out and want to go back to RSA2048 or bigger. Do we care?] 3.1.2. Registering an introduction point on a legacy Tor node [LEGACY_EST_INTRO] Tor nodes should also support an older version of the ESTABLISH_INTRO cell, first documented in rend-spec.txt. New hidden service hosts must use this format when establishing introduction points at older Tor nodes that do not support the format above in [EST_INTRO]. In this older protocol, an ESTABLISH_INTRO cell contains: KEY_LENGTH [2 bytes] KEY [KEY_LENGTH bytes] HANDSHAKE_AUTH [20 bytes] SIG [variable, up to end of relay payload] The KEY_LENGTH variable determines the length of the KEY field. The KEY field is a ASN1-encoded RSA public key. The HANDSHAKE_AUTH field contains the SHA1 digest of (KH | "INTRODUCE"). The SIG field contains an RSA signature, using PKCS1 padding, of all earlier fields. Note that since the relay payload itself may be no more than 498 bytes long, the KEY_LENGTH field can never have a first byte other than [00] or [01]. These values are used to distinguish legacy ESTABLISH_INTRO cells from newer ones. Older versions of Tor always use a 1024-bit RSA key for these introduction authentication keys. Newer hidden services MAY use RSA keys up 1904 bits. Any more than that will not fit in a RELAY cell payload. 3.1.3. Managing introduction circuits [MAINT_INTRO] If the first byte of an ESTABLISH_INTRO cell is [FF], the cell's body contains an administrative command for the circuit. The format of such a command is: Any number of times: SUBCOMMAND_TYPE [2 bytes] SUBCOMMAND_LEN [2 bytes] SUBCOMMAND [COMMAND_LEN bytes] Recognized SUBCOMMAND_TYPE values are: [00 01] -- update encryption keys [TODO: Matthew says, "This can be used to fork an intro point to balance traffic over multiple hidden service servers while maintaining the criteria for a valid ESTABLISH_INTRO cell. -MF". Investigate.] Unrecognized SUBCOMMAND_TYPE values should be ignored. 3.1.3.1. Updating encryption keys (subcommand 0001) [UPDATE-KEYS-SUBCMD] Hidden service hosts send this subcommand to set their initial encryption keys or update the configured public encryption keys associated with this circuit. This message must be sent after establishing an introduction point, before the circuit can be advertised. These keys are given in the form: NUMKEYS [1 byte] NUMKEYS times: KEYTYPE [1 byte] KEYLEN [1 byte] KEY [KEYLEN bytes] COUNTER [4 bytes] SIGLEN [1 byte] SIGNATURE [SIGLEN bytes.] The KEYTYPE value [01] is for Curve25519 keys. The COUNTER field is a monotonically increasing value across a given introduction point authentication key. The SIGNATURE must be generated with the introduction point authentication key, and must cover the entire subcommand body, prefixed with the string "Tor hidden service introduction encryption keys v1". [TODO: Nothing is done here to prove ownership of the encryption keys. Does that matter?] [TODO: The point here is to allow encryption keys to change while maintaining an introduction point and not forcing a client to download a new descriptor. I'm not sure if that's worth it. It makes clients who have seen a key before distinguishable from ones who have not.] [Matthew says: "Repeat-client over long periods of time will always be distinguishable. It may be better to simply expire intro points than try to preserve forward-secrecy, though". Must find out what he meant.] Setting the encryption keys for a given circuit replaces the previous keys for that circuit. Clients who attempt to connect using the old key receive an INTRO_ACK cell with error code [00 02] as described in section [INTRO_ACK] below. 3.1.4. Acknowledging establishment of introduction point [INTRO_ESTABLISHED] After setting up an introduction circuit, the introduction point reports its status back to the hidden service host with an empty INTRO_ESTABLISHED cell. [TODO: make this cell type extensible. It should be able to include data if that turns out to be needed.] 3.2. Sending an INTRODUCE1 cell to the introduction point. [SEND_INTRO1] In order to participate in the introduction protocol, a client must know the following: * An introduction point for a service. * The introduction authentication key for that introduction point. * The introduction encryption key for that introduction point. The client sends an INTRODUCE1 cell to the introduction point, containing an identifier for the service, an identifier for the encryption key that the client intends to use, and an opaque blob to be relayed to the hidden service host. In reply, the introduction point sends an INTRODUCE_ACK cell back to the client, either informing it that its request has been delivered, or that its request will not succeed. 3.2.1. INTRODUCE1 cell format [FMT_INTRO1] An INTRODUCE1 cell has the following contents: AUTH_KEYID [32 bytes] ENC_KEYID [8 bytes] Any number of times: EXT_FIELD_TYPE [1 byte] EXT_FIELD_LEN [1 byte] EXT_FIELD [EXTRA_FIELD_LEN bytes] ZERO [1 byte] ENCRYPTED [Up to end of relay payload] [TODO: Should we have a field to determine the type of ENCRYPTED, or should we instead assume that there is exactly one encryption key per encryption method? The latter is probably safer.] Upon receiving an INTRODUCE1 cell, the introduction point checks whether AUTH_KEYID and ENC_KEYID match a configured introduction point authentication key and introduction point encryption key. If they do, the cell is relayed; if not, it is not. The AUTH_KEYID for an Ed25519 public key is the public key itself. The ENC_KEYID for a Curve25519 public key is the first 8 bytes of the public key. (This key ID is safe to truncate, since all the keys are generated by the hidden service host, and the ID is only valid relative to a single AUTH_KEYID.) The ENCRYPTED field is as described in 3.3 below. To relay an INTRODUCE1 cell, the introduction point sends an INTRODUCE2 cell with exactly the same contents. 3.2.2. INTRODUCE_ACK cell format. [INTRO_ACK] An INTRODUCE_ACK cell has the following fields: STATUS [2 bytes] Any number of times: EXT_FIELD_TYPE [1 byte] EXT_FIELD_LEN [1 byte] EXT_FIELD [EXTRA_FIELD_LEN bytes] Recognized status values are: [00 00] -- Success: cell relayed to hidden service host. [00 01] -- Failure: service ID not recognzied [00 02] -- Failure: key ID not recognized [00 03] -- Bad message format Recognized extension field types: [00 01] -- signed set of encryption keys The extension field type 0001 is a signed set of encryption keys; its body matches the body of the key update command in [UPDATE-KEYS-CMD]. Whenever sending status [00 02], the introduction point MUST send this extension field. 3.2.3. Legacy formats [LEGACY-INTRODUCE1] When the ESTABLISH_INTRO cell format of [LEGACY_EST_INTRO] is used, INTRODUCE1 cells are of the form: AUTH_KEYID_HASH [20 bytes] ENC_KEYID [8 bytes] Any number of times: EXT_FIELD_TYPE [1 byte] EXT_FIELD_LEN [1 byte] EXT_FIELD [EXTRA_FIELD_LEN bytes] ZERO [1 byte] ENCRYPTED [Up to end of relay payload] Here, AUTH_KEYID_HASH is the hash of the introduction point authentication key used to establish the introduction. Because of limitations in older versions of Tor, the relay payload size for these INTRODUCE1 cells must always be at least 246 bytes, or they will be rejected as invalid. 3.3. Processing an INTRODUCE2 cell at the hidden service. [PROCESS_INTRO2] Upon receiving an INTRODUCE2 cell, the hidden service host checks whether the AUTH_KEYID/AUTH_KEYID_HASH field and the ENC_KEYID fields are as expected, and match the configured authentication and encryption key(s) on that circuit. The service host then checks whether it has received a cell with these contents before. If it has, it silently drops it as a replay. (It must maintain a replay cache for as long as it accepts cells with the same encryption key.) If the cell is not a replay, it decrypts the ENCRYPTED field, establishes a shared key with the client, and authenticates the whole contents of the cell as having been unmodified since they left the client. There may be multiple ways of decrypting the ENCRYTPED field, depending on the chosen type of the encryption key. Requirements for an introduction handshake protocol are described in [INTRO-HANDSHAKE-REQS]. We specify one below in section [NTOR-WITH-EXTRA-DATA]. The decrypted plaintext must have the form: REND_TOKEN [20 bytes] Any number of times: EXT_FIELD_TYPE [1 byte] EXT_FIELD_LEN [1 byte] EXT_FIELD [EXTRA_FIELD_LEN bytes] ZERO [1 byte] ONION_KEY_TYPE [2 bytes] ONION_KEY [depends on ONION_KEY_TYPE] NSPEC (Number of link specifiers) [1 byte] NSPEC times: LSTYPE (Link specifier type) [1 byte] LSLEN (Link specifier length) [1 byte] LSPEC (Link specifier) [LSLEN bytes] PAD (optional padding) [up to end of plaintext] Upon processing this plaintext, the hidden service makes sure that any required authentication is present in the extension fields, and then extends a rendezvous circuit to the node described in the LSPEC fields, using the ONION_KEY to complete the extension. As mentioned in [BUILDING-BLOCKS], the "TLS-over-TCP, IPv4" and "Legacy node identity" specifiers must be present. The hidden service SHOULD NOT reject any LSTYPE fields which it doesn't recognize; instead, it should use them verbatim in its EXTEND request to the rendezvous point. The ONION_KEY_TYPE field is one of: [01] TAP-RSA-1024: ONION_KEY is 128 bytes long. [02] NTOR: ONION_KEY is 32 bytes long. The ONION_KEY field describes the onion key that must be used when extending to the rendezvous point. It must be of a type listed as supported in the hidden service descriptor. Upon receiving a well-formed INTRODUCE2 cell, the hidden service host will have: * The information needed to connect to the client's chosen rendezvous point. * The second half of a handshake to authenticate and establish a shared key with the hidden service client. * A set of shared keys to use for end-to-end encryption. 3.3.1. Introduction handshake encryption requirements [INTRO-HANDSHAKE-REQS] When decoding the encrypted information in an INTRODUCE2 cell, a hidden service host must be able to: * Decrypt additional information included in the INTRODUCE2 cell, to include the rendezvous token and the information needed to extend to the rendezvous point. * Establish a set of shared keys for use with the client. * Authenticate that the cell has not been modified since the client generated it. Note that the old TAP-derived protocol of the previous hidden service design achieved the first two requirements, but not the third. 3.3.2. Example encryption handshake: ntor with extra data [NTOR-WITH-EXTRA-DATA] This is a variant of the ntor handshake (see tor-spec.txt, section 5.1.4; see proposal 216; and see "Anonymity and one-way authentication in key-exchange protocols" by Goldberg, Stebila, and Ustaoglu). It behaves the same as the ntor handshake, except that, in addition to negotiating forward secure keys, it also provides a means for encrypting non-forward-secure data to the server (in this case, to the hidden service host) as part of the handshake. Notation here is as in section 5.1.4 of tor-spec.txt, which defines the ntor handshake. The PROTOID for this variant is "hidden-service-ntor-curve25519-sha256-1". Define the tweak value t_hsenc, and the tag value m_hsexpand as: t_hsenc = PROTOID | ":hs_key_extract" m_hsexpand = PROTOID | ":hs_key_expand" To make an INTRODUCE cell, the client must know a public encryption key B for the hidden service on this introduction circuit. The client generates a single-use keypair: x,X = KEYGEN() and computes: secret_hs_input = EXP(B,x) | AUTH_KEYID | X | B | PROTOID info = m_hsexpand | subcredential hs_keys = HKDF(secret_hs_input, t_hsenc, info, S_KEY_LEN+MAC_LEN) ENC_KEY = hs_keys[0:S_KEY_LEN] MAC_KEY = hs_keys[S_KEY_LEN:S_KEY_LEN+MAC_KEY_LEN] and sends, as the ENCRYPTED part of the INTRODUCE1 cell: CLIENT_PK [G_LENGTH bytes] ENCRYPTED_DATA [Padded to length of plaintext] MAC [MAC_LEN bytes] Substituting those fields into the INTRODUCE1 cell body format described in [FMT_INTRO1] above, we have AUTH_KEYID [32 bytes] ENC_KEYID [8 bytes] Any number of times: EXT_FIELD_TYPE [1 byte] EXT_FIELD_LEN [1 byte] EXT_FIELD [EXTRA_FIELD_LEN bytes] ZERO [1 byte] ENCRYPTED: CLIENT_PK [G_LENGTH bytes] ENCRYPTED_DATA [Padded to length of plaintext] MAC [MAC_LEN bytes] (This format is as documented in [FMT_INTRO1] above, except that here we describe how to build the ENCRYPTED portion. If the introduction point is running an older Tor that does not support this protocol, the first field is replaced by a 20-byte AUTH_KEYID_HASH field as described in [LEGACY-INTRODUCE1].) Here, the encryption key plays the role of B in the regular ntor handshake, and the AUTH_KEYID field plays the role of the node ID. The CLIENT_PK field is the public key X. The ENCRYPTED_DATA field is the message plaintext, encrypted with the symmetric key ENC_KEY. The MAC field is a MAC of all of the cell from the AUTH_KEYID through the end of ENCRYPTED_DATA, using the MAC_KEY value as its key. To process this format, the hidden service checks PK_VALID(CLIENT_PK) as necessary, and then computes ENC_KEY and MAC_KEY as the client did above, except using EXP(CLIENT_PK,b) in the calculation of secret_hs_input. The service host then checks whether the MAC is correct. If it is invalid, it drops the cell. Otherwise, it computes the plaintext by decrypting ENCRYPTED_DATA. The hidden service host now completes the service side of the extended ntor handshake, as described in tor-spec.txt section 5.1.4, with the modified PROTOID as given above. To be explicit, the hidden service host generates a keypair of y,Y = KEYGEN(), and uses its introduction point encryption key 'b' to computes: xb = EXP(X,b) secret_hs_input = xb | AUTH_KEYID | X | B | PROTOID info = m_hsexpand | subcredential hs_keys = HKDF(secret_hs_input, t_hsenc, info, S_KEY_LEN+MAC_LEN) HS_DEC_KEY = hs_keys[0:S_KEY_LEN] HS_MAC_KEY = hs_keys[S_KEY_LEN:S_KEY_LEN+MAC_KEY_LEN] (The above are used to check the MAC and then decrypt the encrypted data.) ntor_secret_input = EXP(X,y) | xb | ID | B | X | Y | PROTOID NTOR_KEY_SEED = H(secret_input, t_key) verify = H(secret_input, t_verify) auth_input = verify | ID | B | Y | X | PROTOID | "Server" (The above are used to finish the ntor handshake.) The server's handshake reply is: SERVER_PK Y [G_LENGTH bytes] AUTH H(auth_input, t_mac) [H_LENGTH bytes] These faileds can be send to the client in a RENDEZVOUS1 cell. (See [JOIN_REND] below.) The hidden service host now also knows the keys generated by the handshake, which it will use to encrypt and authenticate data end-to-end between the client and the server. These keys are as computed in tor-spec.txt section 5.1.4. 3.4. Authentication during the introduction phase. [INTRO-AUTH] Hidden services may restrict access only to authorized users. One mechanism to do so is the credential mechanism, where only users who know the credential for a hidden service may connect at all. For more fine-grained conntrol, a hidden service can be configured with password-based or public-key-based authentication. 3.4.1. Password-based authentication. To authenticate with a password, the user must include an extension field in the encrypted part of the INTRODUCE cell with an EXT_FIELD_TYPE type of [01] and the contents: Username [00] Password. The username may not include any [00] bytes. The password may. On the server side, the password MUST be stored hashed and salted, ideally with scrypt or something better. 3.4.2. Ed25519-based authentication. To authenticate with an Ed25519 private key, the user must include an extension field in the encrypted part of the INTRODUCE cell with an EXT_FIELD_TYPE type of [02] and the contents: Nonce [16 bytes] Pubkey [32 bytes] Signature [64 bytes] Nonce is a random value. Pubkey is the public key that will be used to authenticate. [TODO: should this be an identifier for the public key instead?] Signature is the signature, using Ed25519, of: "Hidserv-userauth-ed25519" Nonce (same as above) Pubkey (same as above) AUTH_KEYID (As in the INTRODUCE1 cell) ENC_KEYID (As in the INTRODUCE1 cell) The hidden service host checks this by seeing whether it recognizes and would accept a signature from the provided public key. If it would, then it checks whether the signature is correct. If it is, then the correct user has authenticated. Replay prevention on the whole cell is sufficient to prevent replays on the authentication. Users SHOULD NOT use the same public key with multiple hidden services. 4. The rendezvous protocol Before connecting to a hidden service, the client first builds a circuit to an arbitrarily chosen Tor node (known as the rendezvous point), and sends an ESTABLISH_RENDEZVOUS cell. The hidden service later connects to the same node and sends a RENDEZVOUS cell. Once this has occurred, the relay forwards the contents of the RENDEZVOUS cell to the client, and joins the two circuits together. 4.1. Establishing a rendezvous point [EST_REND_POINT] The client sends the rendezvous point a RELAY_COMMAND_ESTABLISH_RENDEZVOUS cell containing a 20-byte value. RENDEZVOUS_COOKIE [20 bytes] Rendezvous points MUST ignore any extra bytes in an ESTABLISH_RENDEZVOUS message. (Older versions of Tor did not.) The rendezvous cookie is an arbitrary 20-byte value, chosen randomly by the client. The client SHOULD choose a new rendezvous cookie for each new connection attempt. If the rendezvous cookie is already in use on an existing circuit, the rendezvous point should reject it and destroy the circuit. Upon receiving a ESTABLISH_RENDEZVOUS cell, the rendezvous point associates the cookie with the circuit on which it was sent. It replies to the client with an empty RENDEZVOUS_ESTABLISHED cell to indicate success. [TODO: make this extensible] The client MUST NOT use the circuit which sent the cell for any purpose other than rendezvous with the given location-hidden service. The client should establish a rendezvous point BEFORE trying to connect to a hidden service. 4.2. Joining to a rendezvous point [JOIN_REND] To complete a rendezvous, the hidden service host builds a circuit to the rendezvous point and sends a RENDEZVOUS1 cell containing: RENDEZVOUS_COOKIE [20 bytes] HANDSHAKE_INFO [variable; depends on handshake type used.] If the cookie matches the rendezvous cookie set on any not-yet-connected circuit on the rendezvous point, the rendezvous point connects the two circuits, and sends a RENDEZVOUS2 cell to the client containing the contents of the RENDEZVOUS1 cell. Upon receiving the RENDEZVOUS2 cell, the client verifies that the HANDSHAKE_INFO correctly completes a handshake, and uses the handshake output to derive shared keys for use on the circuit. [TODO: Should we encrypt HANDSHAKE_INFO as we did INTRODUCE2 contents? It's not necessary, but it could be wise. Similarly, we should make it extensible.] 4.3. Using legacy hosts as rendezvous points The behavior of ESTABLISH_RENDEZVOUS is unchanged from older versions of this protocol, except that relays should now ignore unexpected bytes at the end. Old versions of Tor required that RENDEZVOUS cell payloads be exactly 168 bytes long. All shorter rendezvous payloads should be padded to this length with [00] bytes. 5. Encrypting data between client and host A successfully completed handshake, as embedded in the INTRODUCE/RENDEZVOUS cells, gives the client and hidden service host a shared set of keys Kf, Kb, Df, Db, which they use for sending end-to-end traffic encryption and authentication as in the regular Tor relay encryption protocol, applying encryption with these keys before other encryption, and decrypting with these keys before other encryption. The client encrypts with Kf and decrypts with Kb; the service host does the opposite. 6. Open Questions: Scaling hidden services is hard. There are on-going discussions that you might be able to help with. See [SCALING-REFS]. How can we improve the HSDir unpredictability design proposed in [SHAREDRANDOM]? See [SHAREDRANDOM-REFS] for discussion. How can hidden service addresses become memorable while retaining their self-authenticating and decentralized nature? See [HUMANE-HSADDRESSES-REFS] for some proposals; many more are possible. Hidden Services are pretty slow. Both because of the lengthy setup procedure and because the final circuit has 6 hops. How can we make the Hidden Service protocol faster? See [PERFORMANCE-REFS] for some suggestions. References: [KEYBLIND-REFS]: https://trac.torproject.org/projects/tor/ticket/8106 https://lists.torproject.org/pipermail/tor-dev/2012-September/004026.html [SHAREDRANDOM-REFS]: https://trac.torproject.org/projects/tor/ticket/8244 https://lists.torproject.org/pipermail/tor-dev/2013-November/005847.html https://lists.torproject.org/pipermail/tor-talk/2013-November/031230.html [SCALING-REFS]: https://lists.torproject.org/pipermail/tor-dev/2013-October/005556.html [HUMANE-HSADDRESSES-REFS]: https://gitweb.torproject.org/torspec.git/blob/HEAD:/proposals/ideas/xxx-on… http://archives.seul.org/or/dev/Dec-2011/msg00034.html [PERFORMANCE-REFS]: "Improving Efficiency and Simplicity of Tor circuit establishment and hidden services" by Overlier, L., and P. Syverson [TODO: Need more here! Do we have any? :( ] [ATTACK-REFS]: "Trawling for Tor Hidden Services: Detection, Measurement, Deanonymization" by Alex Biryukov, Ivan Pustogarov, Ralf-Philipp Weinmann "Locating Hidden Servers" by Lasse Øverlier and Paul Syverson [ED25519-REFS]: "High-speed high-security signatures" by Daniel J. Bernstein, Niels Duif, Tanja Lange, Peter Schwabe, and Bo-Yin Yang. http://cr.yp.to/papers.html#ed25519 Appendix A. Signature scheme with key blinding [KEYBLIND] As described in [IMD:DIST] and [SUBCRED] above, we require a "key blinding" system that works (roughly) as follows: There is a master keypair (sk, pk). Given the keypair and a nonce n, there is a derivation function that gives a new blinded keypair (sk_n, pk_n). This keypair can be used for signing. Given only the public key and the nonce, there is a function that gives pk_n. Without knowing pk, it is not possible to derive pk_n; without knowing sk, it is not possible to derive sk_n. It's possible to check that a signature make with sk_n while knowing only pk_n. Someone who sees a large number of blinded public keys and signatures made using those public keys can't tell which signatures and which blinded keys were derived from the same master keypair. You can't forge signatures. [TODO: Insert a more rigorous definition and better references.] We propose the following scheme for key blinding, based on Ed25519. (This is an ECC group, so remember that scalar multiplication is the trapdoor function, and it's defined in terms of iterated point addition. See the Ed25519 paper [Reference ED25519-REFS] for a fairly clear writeup.) Let the basepoint be written as B. Assume B has prime order l, so lB=0. Let a master keypair be written as (a,A), where a is the private key and A is the public key (A=aB). To derive the key for a nonce N and an optional secret s, compute the blinding factor h as H(A | s, B, N), and let: private key for the period: a' = h a public key for the period: A' = h' A = (ha)B Generating a signature of M: given a deterministic random-looking r (see EdDSA paper), take R=rB, S=r+hash(R,A',M)ah mod l. Send signature (R,S) and public key A'. Verifying the signature: Check whether SB = R+hash(R,A',M)A'. (If the signature is valid, SB = (r + hash(R,A',M)ah)B = rB + (hash(R,A',M)ah)B = R + hash(R,A',M)A' ) See [KEYBLIND-REFS] for an extensive discussion on this scheme and possible alternatives. I've transcribed this from a description by Tanja Lange at the end of the thread. [TODO: We'll want a proof for this.] (To use this with Tor, set N = INT_8(period-number) | INT_8(Start of period in seconds since epoch).) Appendix B. Selecting nodes [PICKNODES] Picking introduction points Picking rendezvous points Building paths Reusing circuits (TODO: This needs a writeup) Appendix C. Recommendations for searching for vanity .onions [VANITY] EDITORIAL NOTE: The author thinks that it's silly to brute-force the keyspace for a key that, when base-32 encoded, spells out the name of your website. It also feels a bit dangerous to me. If you train your users to connect to llamanymityx4fi3l6x2gyzmtmgxjyqyorj9qsb5r543izcwymle.onion I worry that you're making it easier for somebody to trick them into connecting to llamanymityb4sqi0ta0tsw6uovyhwlezkcrmczeuzdvfauuemle.onion Nevertheless, people are probably going to try to do this, so here's a decent algorithm to use. To search for a public key with some criterion X: Generate a random (sk,pk) pair. While pk does not satisfy X: Add the number 1 to sk Add the scalar B to pk Return sk, pk. This algorithm is safe [source: djb, personal communication] [TODO: Make sure I understood correctly!] so long as only the final (sk,pk) pair is used, and all previous values are discarded. To parallelize this algorithm, start with an independent (sk,pk) pair generated for each independent thread, and let each search proceed independently. Appendix D. Numeric values reserved in this document [TODO: collect all the lists of commands and values mentioned above]

8 22

Listen to Tor
by Kenneth Freeman 26 May '15

26 May '15

I recently had a brainstorm at Feast VI, a locally crowd sourced micro-grant catered dinner where ten artists each pitch their projects for ten or twelve minutes. The diners vote, and the winner takes home the gate; this time around it was approximately $1,300. http://www.feastboise.com/ I edit Wikipedia a lot, and thus am delighted by the ambient music of Listen to Wikipedia. http://listen.hatnote.com/#en So, why not Listen to Tor? More specifically, to a Tor exit node? I'm a bit surprised that this music of anonymity (so to speak) hasn't, AFAIK, occurred to anyone else. I recall that Vidalia, long since deprecated, offered several options for exit node traffic... So if anyone wants to make aleatoric music from Tor, keep me informed... Feast VII is, I believe, in September. If you want to pitch generating art from Tor, that's one venue. And if the basic idea isn't technically or otherwise feasible, kick it around until it is!

5 9

Quick logjam/Tor analysis.
by Nick Mathewson 26 May '15

26 May '15

I posted this on a blog comment, but others may be interested too. As near as I can tell, the "logjam"/"weakdh" attacks should not affect current Tor software very much, for a few reasons: * All currently supported Tor versions, when built with OpenSSL 1.0 or later, prefer 256-bit elliptic-curve Diffie Hellman for their TLS connections, not the 1024-bit Diffie Hellman over Z_p as discussed in this paper. * We have never enabled "Export" crypto server-side or client-side. * All currently supported Tor versions perform their circuit handshakes using the Curve25519-based "ntor" protocol, not the old "TAP" protocol which used 1024-bit DH. * Actually, I think even the TAP protocol might be safe, since it sends an encrypted g^x, so even if you can take the discrete log of g^y, you don't even have g^x to use it with unless you can also break RSA1024. * The TLS encryption in Tor is, for the most part, redundant with the layer of forward secrecy in the circuit handshakes, so that if either one is secure, Tor traffic should not be decryptable. Recommendations: * If you've ignored all our requests to upgrade to a recent Tor version (0.2.6 stable would be best), please do so soon. Anything older than 0.2.4 is NOT supported. * If you're running OpenSSL 0.9.8 or earlier, you should consider upgrading to 1.0.0 or later. * Make sure to apply vendor patches for your non-Tor software as they become available.

2 1

OpenWrt cross compile build error in 0.2.6.8
by Lars Boegild Thomsen 24 May '15

24 May '15

Hi Everybody, I have for a while been maintaining an up-to-date Tor package for OpenWrt. In the latest stable 0.2.6.8 I get a build error (see below). I suspect this is actually autoconf related and I must admit I am not too familiar with autoconf. I have been trying to compare things with 0.2.5.12 (which compiled cleanly) but I have not been able to spot or fix the problem. Any ideas? I am sure I miss something blatantly obvious. ccache_cc -DHAVE_CONFIG_H -I. -I./src/ext -Isrc/ext -I./src/ext/trunnel -I./src/trunnel -I./src/common -Isrc/common -I./src/ext/trunnel -I./src/trunnel -I./src/or -Isrc/or -DSHARE_DATADIR="\"/usr/share\"" -DLOCALSTATEDIR="\"/var\"" -DBINDIR="\"/usr/bin\"" -I/home/lth/ionic-router/staging_dir/target-mips_34kc_uClibc-0.9.33.2/usr/include -I/home/lth/ionic-router/staging_dir/target-mips_34kc_uClibc-0.9.33.2/include -I/home/lth/ionic-router/staging_dir/toolchain-mips_34kc_gcc-4.8-linaro_uClibc-0.9.33.2/usr/include -I/home/lth/ionic-router/staging_dir/toolchain-mips_34kc_gcc-4.8-linaro_uClibc-0.9.33.2/include -I./src/common -I/home/lth/ionic-router/staging_dir/target-mips_34kc_uClibc-0.9.33.2/usr/include -I/home/lth/ionic-router/staging_dir/target-mips_34kc_uClibc-0.9.33.2/usr/include -Os -pipe -mno-branch-likely -mips32r2 -mtune=34kc -fno-caller-saves -fhonour-copts -Wno-error=unused-but-set-variable -msoft-float -mips16 -minterlink-mips16 -std=c99 -MT src/common/address.o -MD -MP -MF $depbase.Tpo -c -o src/common/address.o src/common/address.c &&\ mv -f $depbase.Tpo $depbase.Po src/common/address.c: In function 'tor_addr_lookup': src/common/address.c:250:21: error: storage size of 'hints' isn't known struct addrinfo hints; ^ src/common/address.c:255:5: warning: implicit declaration of function 'getaddrinfo' [-Wimplicit-function-declaration] err = sandbox_getaddrinfo(name, NULL, &hints, &res); ^ src/common/address.c:260:45: error: dereferencing pointer to incomplete type for (res_p = res; res_p; res_p = res_p->ai_next) { ^ src/common/address.c:262:20: error: dereferencing pointer to incomplete type if (res_p->ai_family == AF_INET) { ^ src/common/address.c:265:27: error: dereferencing pointer to incomplete type } else if (res_p->ai_family == AF_INET6 && !best) { ^ src/common/address.c:268:35: error: dereferencing pointer to incomplete type } else if (family == res_p->ai_family) { ^ src/common/address.c:275:15: error: dereferencing pointer to incomplete type if (best->ai_family == AF_INET) { ^ src/common/address.c:276:65: error: dereferencing pointer to incomplete type tor_addr_from_in(addr, ^ src/common/address.c:279:22: error: dereferencing pointer to incomplete type } else if (best->ai_family == AF_INET6) { ^ src/common/address.c:281:55: error: dereferencing pointer to incomplete type &((struct sockaddr_in6*)best->ai_addr)->sin6_addr); ^ src/common/address.c:284:7: warning: implicit declaration of function 'freeaddrinfo' [-Wimplicit-function-declaration] sandbox_freeaddrinfo(res); ^ src/common/address.c:287:20: error: 'EAI_AGAIN' undeclared (first use in this function) return (err == EAI_AGAIN) ? 1 : -1; ^ src/common/address.c:287:20: note: each undeclared identifier is reported only once for each function it appears in src/common/address.c: In function 'tor_addr_parse_PTR_name': src/common/address.c:519:5: warning: implicit declaration of function 'strcasecmp' [-Wimplicit-function-declaration] if (strcasecmp(cp, "ip6.arpa")) ^ src/common/address.c: In function 'ifaddrs_to_smartlist': src/common/address.c:1243:26: error: 'IFF_UP' undeclared (first use in this function) if ((i->ifa_flags & (IFF_UP | IFF_RUNNING)) != (IFF_UP | IFF_RUNNING)) ^ src/common/address.c:1243:35: error: 'IFF_RUNNING' undeclared (first use in this function) if ((i->ifa_flags & (IFF_UP | IFF_RUNNING)) != (IFF_UP | IFF_RUNNING)) ^ src/common/address.c: In function 'ifreq_to_smartlist': src/common/address.c:1404:35: error: dereferencing pointer to incomplete type const struct sockaddr *sa = &r->ifr_addr; ^ src/common/address.c:1414:19: error: dereferencing pointer to incomplete type buf += _SIZEOF_ADDR_IFREQ(*r); ^ src/common/address.c: In function 'get_interface_addresses_ioctl': src/common/address.c:1429:17: error: storage size of 'ifc' isn't known struct ifconf ifc; ^ Makefile:2962: recipe for target 'src/common/address.o' failed make[4]: *** [src/common/address.o] Error 1 -- Lars Boegild Thomsen https://reclaim-your-privacy.com Jabber/XMPP: lth(a)reclaim-your-privacy.com

5 9

Simple Relay Scanner Example
by Damian Johnson 23 May '15

23 May '15

Hi Roger, earlier this week you asked me for a simple bandwidth-authority style scanner. This dovetailed nicely with a task that's been on my todo list for ages to make a tutorial for manual path selection so here ya go! https://stem.torproject.org/tutorials/to_russia_with_love.html#custom-path-… Cheers! -Damian

1 0

Re: [tor-dev] The Onion Name System (OnioNS)
by OnioNS Dev 23 May '15

23 May '15

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 On 05/20/2015 12:18 AM, tor-dev-request(a)lists.torproject.org wrote: > Furthermore, there is the question of time. As .tor-names are pinned (if you have a name, you get to keep it 'forever', right?), an adversary may invest into the required resources to make the attack succeed* **briefly* (i.e. get the required majority), then re-assign names to himself. New honest nodes would pick up this hacked consensus, and thus it would persist even after the adversary lost the majority required to establish it. This is relevant, as an attack against Tor user's anonymity only impacts the users as long as the attack itself lasts, so the gains between the two attacks (temporary vs. "forever") change the economic incentives for performing them. > > So I'm not sure it is such an "obvious" choice to just rely on an honest majority of (long-term/etc.) Tor routers. I'm not saying it is bad; however, simply saying that if those routers are compromised all is lost anyway is not quite correct. To carry out the attack you describe, they would need to have control of enough colluding Tor nodes so that they control the largest agreeing subset in the Quorum. It's not about PoW to control the Quorum, the Quorum is a group of Tor routers. My design also assumes that there is no dynamic compromise of Tor routers (there's no incentive for an attacker to target Tor routers because of OnioNS) so we can consider a static level of compromise. As I've shown in my analysis, if the Quorum is large enough, the chances of selecting a malicious Quorum, either per-selection or cumulatively, is extremely low even at Tor-crippling levels of collusion. > Ok, let's assume a c4.xlarge EC2 instance (which is ~i7) takes 4h to do this (on all cores). For one month, the price is USD 170, which means the registration cost is 70 cents/name (for eternity, or do I have to do this repeatedly? Don't recall if you require a fresh PoWs). Anyway, 4h sounds pretty inconvenient to a user, but as you can see is still nothing for a professional domain name squatter who today pays closer to 100x that to squat for a year. I predict most 'short' names will be taken in no time if this is deployed. > > With Namecoin, you have an inherent limit on the rate at which names can be registered. Now, once people start squatting tons of .tor names, maybe even your bandwidth advantage disappears as the consensus may become rather large. That's a fair point. It's a hard problem to solve. It's subtle, but I also put in a requirement that the network must also ensure that the registration points to an available hidden service. Thus it forces innocent users and attackers to also spin up a hidden service. It's not foolproof, but it's better than nothing. I've also been thinking about a proof-of-stake solution wherein the network only accepts a registration if the destination HS has been up for > X days. Another idea is to have the Quorum select a random time during the week, test for the availability of the hidden service, and then sign whether they saw the HS or not. Then the next Quorum could repeat this test, check the results from the previous Quorum, and void the Record if they also observed that the hidden service was down. I like both of these ideas, but I have not yet solidified their implementation so I was not ready to announce them in the paper. > Well, I prefer my hidden services to be really hidden and not public. I understand that this weakness is somewhat inherent in the design, but you should state it explicitly. Too late, your hidden services are already leaking across Tor's distributed hash table. There are even Tor technical reports and graphs on metrics.torproject.org which count them, which I assume also implies that they are enumerated. I can't remember where I read it, but I do recall reading some report about how the researcher spun up a number of hidden services, didn't tell anyone about them, but then observed that someone connected to them anyway from time to time. Someone out there is enumerating HSs. Tor's HS protocol isn't designed to hide the existence of HSs, my system isn't either. I can state it explicitly, but there's no practical way around it as far as I can see. > See, that's the point: Namecoin (and your system) assume a different adversary model than what Zooko intended to imply when he formulated his triangle. When Zooko said "secure", he meant "against an adversary that does have more CPU power than all of the network combined and unlimited identities". When you say "secure", you talk about Namecoin's adversary model where the adversary is in the minority (CPU and identity/bandwidth-wise). > > Thus, it is unfair for you to say that your system 'solves' Zooko's triangle, as you simply lowered the bar. As you say, Namecoin assumes that it has more CPU power than adversaries. Perhaps I should have clarified more explicitly: even with unlimited CPU power, (setting aside the potential for cryptographic breaks) an attacker would not be able to compromise the Quorum and thus OnioNS as a whole. I am assuming that more Tor routers are controlled by honest sysadmins than by adversaries. An adversary could spin up many new Tor routers in an attempt to increases his chances of controlling the Quorum, but he also has to earn the required router flags, which is costly. Anyone who remembers the Lizard Squad incident recalls how quickly Sybil attacks are dealt with. I can theoretically extend the size of the Quorum to the size of the Tor network, so then the attacker has to gain control of the Tor network such that his colluding nodes form the largest group of Tor routers signing the same Page. It's not about CPU power, it's about the honesty of nodes in the Tor network. That gives me the globally collision-free property. Perhaps I have lowered the bar, but I do think it's a bit higher than Namecoin because OnioNS is only dependent on the distribution of identities, and not the distribution of CPU power. > So if this is successfully deployed and massively used, I could see the NSA/FBI/CIA team up, buy up computing and network resources globally for a month (or however long it takes) to take control of _all_ established high-profile hidden service sites. At least that's plausible enough for me. As I said, to break OnioNS they would have to introduce many routers into the Tor network in order to increase their chances of gaining control of the Quorum. You can think of hidden services here like owners in Namecoin; they just control their information, which is orthogonal to the actual functionality of the system. > Could we please make the protocol a bit more general than this? Yes, I will look into it. Your description is helpful, but if you want to write up a protocol describing what you want on your end, I'll merge it into my protocol, and then we'll have a protocol that is compatible with both of our needs. I would be happy to modify my software accordingly. -----BEGIN PGP SIGNATURE----- Version: GnuPG v2.0.22 (GNU/Linux) Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/ iQEcBAEBCAAGBQJVYKpIAAoJEK2XNk/CC+yA6osIAKNoLUKNU1b2T6mafePb+Tv+ 9NtZzG88bzqBv077mQE+UVPAuma/dibYocLNdqQo+9NHSxR/E1XWT4RdlxLnkhXN 5iXVjFXSqzXzgAEiVHXCzjMsii+4JBP50Dz5bqOGy2yxiXw4qD5aSMnegpTpJx7W r5gxkf9wOqA72iFECigAPRlRZKvAgZ1C/nFAB1oDQd2fY9n7A159Dky1YmJB+JnC c3f3j50NxvfXnuaBYwKkl956cb7YRSEPqdg8y7pCQ9CEpwZc3AXZY5xZlDNUknJ9 EMY64j0krJLFwPgSaRRnNNdyTXPydrAO6j7i7WcOK2rOnEj6+y3VtswzK27ZAdc= =AcK+ -----END PGP SIGNATURE-----

2 1

shipping with fallbackdir sources
by l.m 22 May '15

22 May '15

Hi, a couple questions about fallback directories. On 4/17/15, Peter Palfrader wrote: > We want them to have been around and using their current key, address, > and port for a while now (120 days), and have been running, a guard, and > a v2 directory mirror for most of that time. In the script (and proposal 206) a candidate for fallback uses the orport. When is the http directory connection used? Is it just for backwards compatibility? Does the directory address being different not matter? A candidate can only be or-address+orport? If the document is signed why is bootstrapping using the or-address+or-port for candidates a key consideration? Aren't the clients going to switch to guards and tunneled dir-connections anyway? (Unless configured otherwise) In a worst-case the client would still use bridges if tor is blocked--and it doesn't look like the fallback-dir are being considered for this case anyway. Is there more documentation somewhere? Thank-you --leeroy

1 0

Quantifying the similarity between Tor relays
by Philipp Winter 22 May '15

22 May '15

It is often helpful to determine the similarity between relay descriptors. For example, to detect Sybil attacks, or to find partners in crime once we found a malicious relay. I recently added code to sybilhunter that can automate this task. Now to the underlying theory. The algorithm makes use of a vantage point tree (vp-tree), which enables O(log n) search for nearest neighbours. We then take a file as input -- for example a consensus document -- and add every relay to the vp-tree. For node comparison, vp-trees require a distance metric in the mathematical sense, i.e., the metric has to satisfy the triangle inequality. For now, I use the Levenshtein distance. It takes as input two strings and returns the number of character edit operations (replace, insert, remove) that are necessary to turn descriptor A into descriptor B. While easy to understand and use, the Levenshtein distance cannot easily incorporate our domain-specific knowledge. I hope to find something more suitable. Before comparing relay descriptor, I preprocess them. For network status documents, I consider nickname, ports, publication time, flags, version, and bandwidth. I believe this is a good start, but there is much room for improvement and feedback is very welcome. Now here's how you can give it a shot. The commands below find the 10 closest relays to the relay we run at Karlstad University: $ go get git.torproject.org/user/phw/sybilhunter.git $ wget https://www.nymity.ch/~phw/sample-consensus -O /tmp/consensus $ sybilhunter -data /tmp/consensus -neighbours 10 -rootrelay 9B94CD0B7B8057EAF21BA7F023B7A1C8CA9CE645 On my laptop, it takes approximately 10 seconds to generate the vp-tree. The output then consists of 10 blocks that represent the most similar relay descriptors. The first two lines of each block show the input to the Levenshtein distance. The third line shows the distance and a link to the relay's Atlas page. Cheers, Philipp

1 0

[PATCH] Defences against the recent hidden service DoS attacks
by George Kadianakis 21 May '15

21 May '15

Hello, we recently received more reports of Denial of Service attacks on hidden services. You can find our ticket here: https://trac.torproject.org/projects/tor/ticket/16052 After some debugging, we found the attack vector and identified a few ways to fix or mitigate it. In this attack, the adversary forces a hidden service to create thousands of connections to its underlying application (e.g. the webserver), which overwhelms both Tor and the underlying application. It's worth noting that Tor is a small network, and even simple DoS attacks can be quite effective against it. Consider that there are botnets out there with more bandwidth than the whole Tor network. Hence, completely solving DoS attacks on Tor is still an open problem; a few long-term defense ideas were stated on the trac ticket. In any case, we have prepared an experimental short-term fix for this vulnerability that hidden service operators can deploy. It seems to mitigate the attack in our lab tests, so maybe it helps others too. The fix, allows the hidden service operator to ignore hidden service circuits that try to open tons of connections. This is possible since normal clients will only open a few such connections, whereas the attacker was opening like 5000 connections per circuit. Here are some instructions for the short-term fix: == Instructions == Our patch is not in an official Tor release yet, so you will need to use an unofficial git branch: https://trac.torproject.org/projects/tor/ticket/16052#comment:18 First, use one of the provided branches or apply the commits directly to your tor, and recompile your tor. You need to do this. The instructions below *won't* work with stock tor. Next, an operator who wants to deploy this experimental fix, should first figure out how many simultaneous TCP connections a normal client would establish. For example, an IRC server would probably not need more than 1 simultaneous connection per user. A web server, depending on the use, might need something between 6 to 12 (?) simultaneous connections. To proceed, as an example, let's say that a client of your hidden service can work fine with 20 simultaneous TCP connections. Then add the following to your torrc, as part of the per-hidden service configuration: HiddenServiceMaxStreams 20 and start up your new Tor. See if that helps out for you. You might still get 100% CPU when under attack, but other clients should work normally. If that doesn't stop the attack, there is a more aggressive solution that might work. In your torrc also add the following line HiddenServiceMaxStreamsCloseCircuit 1 That will make your hidden service *kill* the attacker's circuit, which will reduce CPU load even more. However, if you have picked a small max streams number, it might also kill normal users' connections. So be careful! Also, please don't set max streams to a tiny value while this is enabled; forcing the attacker to build tons of circuits to you is not good for your HS or for the network. ==== In any case, let us know if this works for you, by sending an email to this list, or commenting on the trac ticket. If it works for people, we might incorporate to a Tor release soon.

2 1

Draft of proposal "Direct Onion Services: Fast-but-not-hidden services"
by George Kadianakis 21 May '15

21 May '15

Hello, I inline a proposal for Direct Onion Services. It's heavily based on the "encrypted services" proposal of Roger, but I refined it, made it more proposaley and enabled a few more optimizations. You can find the original piece here: https://gitweb.torproject.org/torspec.git/tree/proposals/ideas/xxx-encrypte… Feedback would be greatly appreciated. Here are some specific points that I would like help with: - Should we require a specially compiled version of Tor to enable this feature? Like we do for tor2web mode? In this proposal, I didn't require any special compilation flags. I don't have strong opinions here. - We really really need a better name for this feature. I decided to go with "Direct Onion Services" which is the one that the NRL people suggested here: https://lists.torproject.org/pipermail/tor-dev/2015-February/008256.html I'm not super happy with it, but I can't think of better ones myself. Here are some candidates: 1 Way Anonymous Hidden Services Fast Onion Service Short-circuited Onion Services Fast-but-not-hidden Services - We also need a better torrc option. If the name of this feature does not portray its dangers, then the torrc option should be a bit terrifying. That's why I went 'DangerousDirectOnionService' which I actually don't like at all. BTW, it's unclear whether this mailing list is the best place to brainstorm for names. Here goes proposal: ---- Filename: 244-direct-services.txt Title: Direct Onion Services: Fast-but-not-hidden services Author: Roger Dingledine, George Kadianakis Created: 2011-01-12 Status: Draft 1. Motivation Hidden services can cover multiple use cases and threat models. They offer server-side anonymity by default because that's the most common use case, but there also hidden service users who don't really need service-side anonymity. This proposal aims to satisfy those users by introducing an optional opt-in feature that *sacrifices server-side anonymity* *for better performance*. Client-side anonymity will still be preserved as normal. Here are some use cases that this idea addresses: 1) Indymedia wants to run an exit enclave that provides end-to-end authentication and encryption. They tried running an exit relay that just exits to themselves (#800) but * it handles lots of other traffic too since it's a relay * exit enclaves don't actually work consistently, because the first connection from the user doesn't realize it should use the exit enclave. 2) Wikileaks uses Tor hidden services not to hide their service, but because the hidden service address provides a type of usability we didn't think much about: unlike a more normal address, a Tor hidden service address either works (meaning you get your end-to-end authentication and encryption) or it fails hard. With a hidden service address there's no way a user could accidentally submit their documents to Wikileaks without using Tor, but with normal Tor it's possible. 3) The Freenode IRC network wants to provide end-to-end encryption and authentication to its users, a) to handle the fact that the IRC protocol doesn't really provide much of that by default, and b) to funnel all their Tor users into a single location so they can handle the anonymous users better. They don't mind the fact that their service is hidden, but they'd rather have better performance for their users given the choice. As a side-effect, by optimizing for performance in this feature, it allows us to lean more heavily towards security decisions for regular onion services. 2. Design We suggest the following changes to be implemented: i. Add a way in the torrc file to specify that this service wants to be an encrypted service rather than a hidden service. [TORRC] ii. An encrypted service SHOULD establish 1-hop circuits to its introduction points. [ONEHOP] iii. An encrypted service SHOULD establish 1-hop circuits to rendezvous points [ONEHOP]. iv. An encrypted service MAY NOT use static guard nodes [NOGUARDS]. More information about these steps can be found in the next section. 3. Specification 3.1. Torrc configuration parameter [TORRC] To enable this optional feature, we introduce the boolean DangerousDirectOnionService torrc option. The option MUST be *disabled by default*. Because of the grave consequences of misconfiguration here, we have prepended the torrc option with 'Dangerous'. Furthermore, Tor MUST issue a startup warning message to operators of the hidden service if this feature is enabled. 3.2. One-hop circuits [ONEHOP] When in this mode, the onion service establishes 1-hop circuits to introduction and rendezvous points. The onion service SHOULD also ignore cannibalizable 3-hop circuits when creating such circuits. This looks like this for the rendezvous point case: |direct onion service| -> RP <- client middle <- client guard <- |client| This change allows greater speeds when establishing a hidden service circuit and reduces round-trip times. As a side-effect, busy onion services with this feature cause less damage to the rest of the network, since their traffic gets passed around less. 3.3. Disable guard nodes [NOGUARDS] Entry guards are a security measure against Sybil attacks. Unfortunately, they also act as the bottleneck of busy hidden services and overload those Tor relays. This proposal suggests disabling the entry guard feature entirely when this mode is enabled. This allows the hidden service to split its traffic out to multiple relays on the network. 4. Security implications There's a possible second-order effect here since both encrypted services and hidden services will have foo.onion addresses and it's not clear based on the address whether the service will be hidden -- if *some* .onion addresses are easy to track down, are we encouraging adversaries to attack all rendezvous points just in case? 5. Future Here are some thoughts on things we could look in the future to further optimize performance when this mode is enabled: - We should look whether we can optimize further the preemptive circuits that Tor makes as a hidden service. - We could also make hidden services determine the number of introduction points based on their popularity, to allow greater load balancing. This has the potential for leaking the popularity of hidden services (#4862), but maybe this is not a concern when this mode is enabled. - For this mode, we could look into alternative designs where a rendezvous step is not needed, and the traffic gets routed through the introduction points (as in Valet nodes [0]). [0]: http://freehaven.net/anonbib/#valet:pet2006

12 26

Namecoin .onion to .bit linking
by Jeremy Rand 21 May '15

21 May '15

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 Hello Tor-Dev, One of the criticisms of Namecoin which seems to be raised sometimes is that the current domain namespace spec doesn't have a method for a .bit domain owner to prove that they are in control of a .onion. (This is also an issue for .bit domains that point to .i2p.) I'm interested in improving this situation, and am looking for feedback. First off, I'm curious what the various use cases are for this. The main use case I'm aware of is if a user is aware of a .onion domain already, and is trying to find a human-memorable way to access it. (As far as I can tell, the reverse is not a use case, because if you already trust the .bit domain by name but don't know what .onion you're looking for, presumably Namecoin already does what you want.) Is this correct? Am I missing any other significant use cases? Second, I'm looking for feedback on my rough approach. The approach I'm looking at right now is to have a Namecoin namespace for .onion backlinks to .bit domains, which is separate from the Namecoin namespace for .bit domains. The backlink namespace would have a name field whose prefix is the .onion domain. We can't prevent a squatter from registering an exact match of the .onion in Namecoin, but by using a prefix and checking the signature on all matches, we can avoid the impact of squatters. (The cost of obtaining new names would be a deterrent for someone trying to flood a .onion prefix with invalid backlinks as a DoS.) The value field would contain a signature of the domain name being pointed to, signed by the .onion key. The .onion key could also sign revocations of an endorsement of a .bit domain; these would also be in that namespace. Is this generally a good approach? I'm aware that cross-protocol attacks need to be carefully considered when signing things with a .onion key -- do you have suggestions on how I can sign a short JSON string of the rough form {"name": "d/domain", "rev": 0} (which corresponds to endorsing domain.bit, and not being a revocation of that .bit domain) in a way that won't open up attacks on the .onion key's normal protocol usage? I'll write up a more formal spec after feedback is received, just to make sure I'm not missing some important details. Cheers, - -Jeremy Rand https://namecoin.org -----BEGIN PGP SIGNATURE----- Version: GnuPG v2 iQIcBAEBCAAGBQJVW0v7AAoJEAHN/EbZ1y06C+AP/3RxO99cPoBQ6eRcY9cefqlC HGnfUtxfAa7Ao2Ea2ZatHjA36ordtz6vo9UpJKDXXLPuQFMnsW/Xf6m2ePCKPssG uivWnAqoZ/zFaJFXf6RqgADrbUei7jW75DFmJfwhPka3kh76mF/B3mMIRx9bCOIq r8XcKRlmbFv55j0srg2Z6SBpq8aMumxGjStjyzsW8L6bVtBvz4DwN5rAZG958Hm3 ji7b6r+v05s4dIbJ6ZAqerOVmy6PA+sAZ0cqwzCBBttdIoVzGiuc9S6aAn8+XjWa ycx7wUi3YM27Kyor8N2+pYDgECmMYEC9QBKN6XwtsW6Lwz9UCNaZ4BQR5JWIxwLg FTZ1uV/E7o3cKdiPzlCkzoQetifom8la6ezPOpr4XhVuzLWqHJBm4eA+qEwEPSFC DA4k/HEgJKNUZGFWuXpIyEAl3Nvyy3cxTYyrzzMmbvBJnzMGM18Sa+D9N78ih3Sw GgXIET336wnvd+HqcVT85io7Ee3Wj+05IOyH4mhV06AXJuP1RvFAKJk6d1i5lOKC Sr2GrJNnP8zP1uq57XQxpKg7fkVqBMzjFY9JJ6HIkffLsGzLpZ8CUSU2+8tPGeDt T3MAT3GKqXCIjIiQy39Ban27ixeJyxzq8dN3T2HvnUNna0M9v3VhxQjeauNzjHTk 9ekMPDGGT7X9TmLOvSXq =WbCd -----END PGP SIGNATURE-----

3 4

Re: [tor-dev] The Onion Name System (OnioNS)
by OnioNS Dev 20 May '15

20 May '15

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 On 05/19/2015 03:20 AM, tor-dev-request(a)lists.torproject.org wrote: > Subject: > Re: [tor-dev] The Onion Name System (OnioNS) > From: > Christian Grothoff <grothoff(a)gnunet.org> > Date: > 05/19/2015 03:24 AM > > To: > tor-dev(a)lists.torproject.org > > > Please write an IETF draft asking for ".tor" to be reserved for Tor under RFC 6761 referencing your documentation. Should take no time if you base it on Jake's ".onion" draft. Send it to dnsop, they really love to discuss this topic and alternative DNS protocol ideas right now. ^_^. I will put that on the to-do list. > Also, GNS is not a hierarchical zone of names (no hierarchy, just a directed graph). Thanks, I'll make those corrections. Good to hear from someone who is part of that system. > I'm not sure how your proposal significantly improves on NameCoin, except that it is specialized to Tor (and thus doesn't attempt to be as compatible with DNS as Namecoin): for security, you still rely on a PoW-supported consensus, so an adversary with sufficient computational power can register important names first (who gets facebook.tor first?). Given that you probably don't want to double the electicity bill of 'normal' users when they want to register names, my prediction is that if this is adopted, trolls (and name squatters) will have a field day registering interesting names. My scheme is better than Namecoin in several key ways: 1) No miners. I'm relying on the existing trust of the Tor network and purposely did not create a new network. 2) Minimal networking costs. Namecoin typically requires users to hold the blockchain, and has very little client-side security when users rely on name servers to hold it for them. I require clients to check a set of signatures from Tor routers. Most of the attack vectors for OnioNS also results in a compromise of Tor, which makes the whole thing moot. Hence it makes sense to rely on Tor. The PoW is only for registration, no one else does it. Yes, it is first-come-first-serve, but so is Namecoin. On the Internet DNS, someone with lots of money could buy up domains too (ISPs do this all the time). For well-known hidden services (such as DuckDuckGo) we could mark those names as reserved such that only the owner of that hidden service could register it on OnioNS, and let all other names be first-come-first-serve. I'm thinking of setting the proof-of-work relatively high, say four hours on an i7 or so. The reliance on scrypt and the complex of the domain registration should restrict this to CPUs. > I didn't see a mechanism to transition a name from one RSA key/.onion address to another. Is that intentionally missing? Will users loose control over their .tor names when they rotate keys? I only have 12 pages, there wasn't enough space for that protocol. However, I have already created protocols for deleting, transferring, and updating Records. Domain registration uses the same private key as hidden services, so if the key is compromised, both are compromised and the security of the Record is moot. > It also seems you are unconcerned about zone enumeration. Both your protocol on authenticated denial-of-existence and the entire consensus system suggest that it should be easy for a peer to enumerate all names in the .tor zone. I'm considering that all OnioNS data is public. There's no way to hide information in the Pagechain as Mirrors need to verify it. An attacker could also spin up a machine, synchronize with the network, and enumerate them anyway. Clients must also see the domain names in the leaves of the Merkle tree in order to authenticate Records or verify that the domain does not exist by finding two domains that alphabetically span it. I also can't hide the domain names in the Merkle trees via hashes because then I'm mapping unique names to a binary space that may have collisions. It's far easier to just consider the information public. Fortunately, there's no personally-identifiable information in the Pagechain, so there's no advantage in hiding the data. > Why do you limit names to 128 characters, when DNS supports 253? For space reasons. Longer names introduce more storage and networking demands. The smaller choice shouldn't make any practical difference; I have yet to see a domain name on the Internet with a 253-character second-level domain. > With respect to Zooko's triangle, I would point out that you define it differently than GNS does (and we checked with Zooko about the definition at the time). In particular, you assume that the adversary has limited computational power and doesn't dominate the consensus. For GNS, we assume that PoW is useless (adversary can do PoW for all memorable names) and that consensus is useless (adversary has majority). This is because in practice, governments do have more computational power than citizens, and when it comes to censorship it is important to protect minorities and their opinions, not majorities. (see also http://grothoff.org/christian/fps2013wachs.pdf) Thus, you might want to make it clearer in your paper that you 'square' Zooko's triangle under exactly the same conditions as Namecoin: a weaker adversary model / definition of 'secure'. I think you may misunderstand. Computational power (PoW) here has nothing to do with Zooko's Triangle. With Namecoin, the network is assumed to have more CPU power than adversaries and thus they can achieve all three properties. Here, PoW is only used to increase the difficulty of claiming a domain name, and I get the uniqueness property because I assume that Tor routers are generally honest. This is a safe assumption as if Tor routers weren't honest, Tor circuits would not provide privacy and again the whole system breaks and becomes moot. So, I assume that Tor routers follow the rules and reject duplicate domain names, therefore the network as a whole prevents collisions. An attacker could win here by Sybil attack by spinning up many new Tor routers and gaining control of the Quorum by placing the statistics in their favor. My analysis shows that this is extremely unlikely for L_Q >= 127. > All that being said, I'm not at all against this: We should have MANY ways (protocols!) to assign names, some more usable, some more secure, especially as the current dominant method is just broken (DNS). Glad to have your support. I agree that the Internet DNS is broken. It was never designed with security in mind in the first place; there was no need to because originally everyone knew each other. :) > So maybe Tor can plan to incorporate ".tor", ".bit" (namecoin), ".onion" and ".gnu". After all, each solution has interesting advantages and drawbacks. (The problem then only becomes educating the user about those.) Regardless, good luck with ".gnu" and I look forward to the resulting discussions on dnsop (IETF mailinglist), where you really should launch a discussion on this as well. Yawning mentioned this. It's easy enough to create a spec that defines the protocol for handling other pseudo-TLDs. Currently Tor writes "*.tor" to a named pipe, reads "*.onion", and finishes the lookup. It's easy to use that protocol for any alternative DNS. It's outside Tor's scope to care how the *.tor -> *.onion map is accomplished. Jesse V. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/ iQEcBAEBCAAGBQJVW26lAAoJEK2XNk/CC+yA+1MH/3HNANFFzhCs567B8XkcHu0M VijH8dD6f+ClxuxVFmjKb5c9jlgK5vW9E+LsFiUFbT3vHdjZxh4nH4zNv1FnVIxc RnkNvuhXGYpDCSRFNtvqa1ZPwOj3ENBvB8++wB/M2DM3KN4B6dKXdHNgjfMDNfji L62o23ApQaKOu8vi0wr9VNLTCbji9LS0GerR5G7mUMAUo194WjBGhNwhBQknCeze RACjHnRjfqDWSyszgI7e0xKNK3rGOzQWIPwlScqnl1LEh6tWaxMZDmzN+FHr2QbG C5Sb1fDywKeVCQdBSAjAS++WvzvYNbiFExaJ9ucVWMPMdjrxjDzpHrVM8P/xWaY= =6kyi -----END PGP SIGNATURE-----

2 1