- tor-dev - lists.torproject.org

[prop269] Further changes to the hybrid handshake proposal (and NTor)
by isis agora lovecruft 18 Oct '16

18 Oct '16

Hello, After discussion with John Schanck and Trevor Perrin over the last month, we've decided to make some alterations to the specification for hybrid handshakes in Tor proposal #269. It seems that John, Trevor, and I are mostly in agreement about most of the construction. First, I'll try to summarise a list of changes and the reasoning/concerns which provoked them. For what it's worth, these concerns mostly involve highly theoretical problems surrounding whether we model a hash function with a random oracle or try to make some stronger claims to its properties, and aren't due to any real world attacks (assuming that hash functions do what you'd expect them to do and aren't something crazy like a NULL op or a pineapple slicing machine). Changes: 1. [NTOR] Inputs to HKDF-extract(SALT, SECRET) which are not secret (e.g. server identity ID, and public keys A, X, Y) are now removed from SECRET and instead placed in the SALT. Reasoning: *Only* secret data should be placed into the HKDF extractor, and public data should not be mixed into whatever entropic material is used for key generation. This eliminates a theoretical attack in which the server chooses its public material in such a way as to bias the entropy extraction. This isn't reasonably assumed to be possible in a "hash functions aren't probablistically pineapple slicers" world. Previously, and also in NTor, we were adding the transcript of the handshake(s) and other public material (e.g. ID, A, X, Y, PROTOID) directly into the secret portion of an HMAC call, the output of which is eventually used to derive the key material. The SALT for HKDF (as specified in RFC5869) can be anything, even a static string, but if we're going to be adding transcript material into the handshake, it shouldn't be in the entropy extraction phrase. 2. [NTOR] The authentication of transcript data, i.e. (ID, A, X, Y, EPK, C) where EPK is the public and ephemeral portion which the client sends in the post-quantum KEM, and C is the reconciliation data, is now distinctly separate from the production of SALT for the extractor, and is first HMACed separately (where the key is derived from the same HKDF extraction which produces the seed) before being included within the expansion phase. Reasoning: The idea is to avoid attempting to do context-binding (of the transcript, in this case) and entropy extraction at the same time, in order to have a stronger argument that the shared key used for authenticating the context is secure, whereas (before, in NTor) things were a bit murky. The use of auth_input in ntor was designed to prevent a certain type of collision attack (see [Zav12, SZW16]). However the auth_input countermeasure is unnecessary if the authentication tag is of length 2*LAMBDA. A collision attack on a random function of output length 2*LAMBDA has cost 2^LAMBDA. This change additionally avoids the collision attack. 3. The hashing of first SALT has been removed. (Or, alternatively, it's still there, assuming you're following the specification for HKDF extraction in RFC5869 to the T and hashing any incoming SALT longer than 32 bytes. If you're using something like SHAKE-256 or similar… well, it's not exactly clear or specified yet how to use SHAKE as a dropin replacement for a KDF. Joan is apparently writing something.) Reasoning: It was originally included due to concerns that a malicious adverary could potentially choose some SALT such that when passed into the HKDF-extractor, it would "nullify" the SECRET input rather than extracting from it. However, the HKDF-extractor is HMAC(SALT, SECRET) and we assume the HMAC's underlying hash function is not a machine which factors discrete logarithms or a slices pineapples. Were you to replace your own hash function with a pineapple slicer, you'd simply be creating a vulnerability for yourself, and thus it doesn't really make sense in Tor's case to hash the SALT first because we're not living in the horrible world where hash functions can turn out to be pineapple slicers. (And even if it were possible for them to be pineapple slicers, it personally still doesn't make sense to me why you'd want to protect against potential pineapple slicers by putting your data through a pineapple slicer twice.) Best regards, -- ♥Ⓐ isis agora lovecruft _________________________________________________________ OpenPGP: 4096R/0A6A58A14B5946ABDE18E207A3ADB67A2CDB8B35 Current Keys: https://fyb.patternsinthevoid.net/isis.txt

5 5

Note on my GPG key update
by Nick Mathewson 18 Oct '16

18 Oct '16

Hi! Please see https://people.torproject.org/~nickm/key-transition-statement-2.txt for information on my updated GPG key. Thanks! (I wouldn't ordinarily send this here, but this new key signs the Tor source and tags these days, so it's a good idea to make sure people know about it. The most recent releases were signed with both my old key and my new key: this is the last time that I'm planning to be doing that, however, since it seemed to confuse a lot of software.)

1 1

Proposal 273: Exit relay pinning for web services
by Philipp Winter 18 Oct '16

18 Oct '16

The proposal is in draft state. We have several open questions that we are still wrestling with in Section 2.6. Any feedback is greatly appreciated. You can track the evolution of our proposal online: <https://github.com/NullHypothesis/exit-pinning> --- Filename: 273-exit-relay-pinning.txt Title: Exit relay pinning for web services Author: Philipp Winter, Tobias Pulls, Roya Ensafi, and Nick Feamster Created: 2016-09-22 Status: Draft Target: n/a 0. Overview To mitigate the harm caused by malicious exit relays, this proposal presents a novel scheme -- exit relay pinning -- to allow web sites to express that Tor connections should preferably originate from a set of predefined exit relays. This proposal is currently in draft state. Any feedback is appreciated. 1. Motivation Malicious exit relays are increasingly becoming a problem. We have been witnessing numerous opportunistic attacks, but also highly sophisticated, targeted attacks that are financially motivated. So far, we have been looking for malicious exit relays using active probing and a number of heuristics, but since it is inexpensive to keep setting up new exit relays, we are facing an uphill battle. Similar to the now-obsolete concept of exit enclaves, this proposal enables web services to express that Tor clients should prefer a predefined set of exit relays when connecting to the service. We encourage sensitive sites to set up their own exit relays and have Tor clients prefer these relays, thus greatly mitigating the risk of man-in-the-middle attacks. 2. Design 2.1 Overview A simple analogy helps in explaining the concept behind exit relay pinning: HTTP Public Key Pinning (HPKP) allows web servers to express that browsers should pin certificates for a given time interval. Similarly, exit relay pinning (ERP) allows web servers to express that Tor Browser should prefer a predefined set of exit relays. This makes it harder for malicious exit relays to be selected as last hop for a given website. Web servers advertise support for ERP in a new HTTP header that points to an ERP policy. This policy contains one or more exit relays, and is signed by the respective relay's master identity key. Once Tor Browser obtained a website's ERP policy, it will try to select the site's preferred exit relays for subsequent connections. The following subsections discuss this mechanism in greater detail. 2.2 Exit relay pinning header Web servers support ERP by advertising it in the "Tor-Exit-Pins" HTTP header. The header contains two directives, "url" and "max-age": Tor-Exit-Pins: url="https://example.com/pins.txt"; max-age=2678400 The "url" directive points to the full policy, which MUST be HTTPS. Tor Browser MUST NOT fetch the policy if it is not reachable over HTTPS. Also, Tor Browser MUST abort the ERP procedure if the HTTPS certificate is not signed by a trusted authority. The "max-age" directive determines the time in seconds for how long Tor Browser SHOULD cache the ERP policy. After seeing a Tor-Exit-Pins header in an HTTP response, Tor Browser MUST fetch and interpret the policy unless it already has it cached and the cached policy has not yet expired. 2.3 Exit relay pinning policy An exit relay pinning policy MUST be formatted in JSON. The root element is called "erp-policy" and it points to a list of pinned exit relays. Each list element MUST contain two elements, "fingerprint" and "signature". The "fingerprint" element points to the hex-encoded, uppercase, 40-digit fingerprint of an exit relay, e.g., 9B94CD0B7B8057EAF21BA7F023B7A1C8CA9CE645. The "signature" element points to an Ed25519 signature, uppercase and hex-encoded. The following JSON shows a conceptual example: { "erp-policy": [ "start-policy", { "fingerprint": Fpr1, "signature": Sig_K1("erp-signature" || "example.com" || Fpr1) }, { "fingerprint": Fpr2, "signature": Sig_K2("erp-signature" || "example.com" || Fpr2) }, ... { "fingerprint": Fprn, "signature": Sig_Kn("erp-signature" || "example.com" || Fprn) }, "end-policy" ] } Fpr refers to a relay's fingerprint as discussed above. In the signature, K refers to a relay's master private identity key. The || operator refers to string concatenation, i.e., "foo" || "bar" results in "foobar". "erp-signature" is a constant and denotes the purpose of the signature. "start-policy" and "end-policy" are both constants and meant to prevent an adversary from serving a client only a partial list of pins. The signatures over fingerprint and domain are necessary to prove that an exit relay agrees to being pinned. The website's domain -- in this case example.com -- is part of the signature, so third parties such as evil.com cannot coerce exit relays they don't own to serve as their pinned exit relays. After having fetched an ERP policy, Tor Browser MUST first verify that the two constants "start-policy" and "end-policy" are present, and then validate the signature over all list elements. If any element does not validate, Tor Browser MUST abort the ERP procedure. If an ERP policy contains more than one exit relay, Tor Browser MUST select one at random, weighted by its bandwidth. That way, we can balance load across all pinned exit relays. Tor Browser could enforce the mapping from domain to exit relay by adding the following directive to its configuration file: MapAddress example.com example.com.Fpr_n.exit 2.4 Defending against malicious websites The purpose of exit relay pinning is to protect a website's users from malicious exit relays. We must further protect the same users from the website, however, because it could abuse ERP to reduce a user's anonymity set. The website could group users into arbitrarily-sized buckets by serving them different ERP policies on their first visit. For example, the first Tor user could be pinned to exit relay A, the second user could be pinned to exit relay B, etc. This would allow the website to link together the sessions of anonymous users. We cannot prevent websites from serving client-specific policies, but we can detect it by having Tor Browser fetch a website's ERP policy over multiple independent exit relays. If the policies are not identical, Tor Browser MUST ignore the ERP policies. If Tor Browser would attempt to fetch the ERP policy over n circuits as quickly as possible, the website would receive n connections within a narrow time interval, suggesting that all these connections originated from the same client. To impede such time-based correlation attacks, Tor Browser MUST wait for a randomly determined time span before fetching the ERP policy. Tor Browser SHOULD randomly sample a delay from an exponential distribution. The disadvantage of this defence is that it can take a while until Tor Browser knows that it can trust an ERP policy. 2.5 Design trade-offs We now briefly discuss alternative design decisions, and why we defined ERP the way we did. Instead of having a web server *tell* Tor Browser about pinned exit relays, we could have Tor Browser *ask* the web server, e.g., by making it fetch a predefined URL, similar to robots.txt. We believe that this would involve too much overhead because only a tiny fraction of sites that Tor users visit will have an ERP policy. ERP implies that adversaries get to learn all the exit relays from which all users of a pinned site come from. These exit relays could then become a target for traffic analysis or compromise. Therefore, websites that pin exit relays SHOULD have a proper HTTPS setup and host their exit relays topologically close to the content servers, to mitigate the threat of network-level adversaries. It's possible to work around the bootstrapping problem (i.e., the very first website visit cannot use pinned exits) by having an infrastructure that allows us to pin exits out-of-band, e.g., by hard-coding them in Tor Browser, or by providing a lookup service prior to connecting to a site, but the additional complexity does not seem to justify the added security or reduced overhead. 2.6 Open questions o How should we deal with selective DoS or otherwise unavailable exit relays? That is, what if an adversary takes offline pinned exit relays? Should Tor Browser give up, or fall back to non-pinned exit relays that are potentially malicious? Should we give site operators an option to express a fallback if they care more about availability than security? o Are there any aspects that are unnecessarily tricky to implement in Tor Browser? If so, let's figure out how to make it easier to build. o Is a domain-level pinning granularity sufficient? o Should we use the Ed25519 master or signing key? o Can cached ERP policies survive a Tor Browser restart? After all, we are not supposed to write to disk, and ERP policies are basically like a browsing history. o Should we have some notion of "freshness" in an ERP policy? The problem is that an adversary could save my ERP policy for example.com, and if I ever give up example.com, the adversary could register it, and use my relays for pinning. This could easily be mitigated by rotating my relay identity keys, and might not be that big a problem. o Should we support non-HTTP services? For example, do we want to support, say, SSH? And if so, how would we go about it? o HPKP also defines a "report-uri" directive to which errors should be reported. Do we want something similar, so site operators can detect issues such as attempted DoS attacks? o It is wasteful to send a 60-70 byte header to all browsers while only a tiny fraction of them will want it. Web servers could send the header only to IP addresses that run an exit relay, but that adds quite a bit of extra complexity. o We currently defend against malicious websites by fetching the ERP policy over several exit relays, spread over time. In doing so, we are making assumptions on the number of visits the website sees. Is there a better solution that isn't significantly more complex?

13 14

Building Torsocks for Armv7 - Build error
by Luca Bertoni 18 Oct '16

18 Oct '16

Goodmorning, I hope this is the correct section where to ask about building Torsocks. If that is the wrong place I apoligize and ask for a reference that can help me. So, I am trying to build torsocks for my armv7 smartphone. What I'm talking about is a cross-compilation, done using autools. After I have generated the configure script executing autogen.sh I configure torsocks using "./configure --host=armv7" and that doesn't raise errors. When I try to build it (using gnu-make) I get an error: ../src/lib/.libs/libtorsocks.a(log.o):(.data+0x0): multiple definition of `tsocks_loglevel' test_connect.o:(.data+0x0): first defined here I know what the error means but I can not figure out if I'm doing something wrong (that is the first time I cross-compile something so I am a newbie) or if there is a bug in the software. If it is a bug in the software I would like to submit it I downloaded torsocks from github (latest tag/release) and I am trying to build it using Debian 8.6 and gcc (Debian 4.9.2-10) 4.9.2. Thanks, Luca. Luca Bertoni

1 0

Re: [tor-dev] Call for help on testing core tor releases
by perky＠sigaint.org 14 Oct '16

14 Oct '16

Heya I'd like to help too - able to test on debian stable and testing. isabela at riseup.net: > > What we are asking volunteers: > > * Validate release signature/checksum > > * Does it build with _no_ Warnings? > > * Does "make test" pass? > > * Does "make test-network-all" pass? (you'll need chutney for this - > chutney does not work on Windows) > > * Does it work as a client? As a relay? As a hidden service ? > > * Does it work if you drop the binary into (eg) torpbrowser? > > > We are hoping to find enough people that we can test the releases on as > many OS's as possible. > Some OS-specific notes: > > * on Linux and BSD, Tor requires some dependencies (read INSTALL). > > * on OS X, you'll need to choose a package manager (HomeBrew, > MacPorts, Fink), or install dependencies from source, > > * either way, you will need to tell configure where the dependencies > are located. > > * on Windows, people sometimes have trouble building Tor. Help us > update our build instructions for Windows! > > > Our goals: > > * We hope to have tor alpha releases tested within a week of it going out > > * We hope to have people testing it on as many OS's as possible > > * Reduce the number of bugs found when we launch a release candidate > and/or stable release > > * We want operating systems and configurations other than the ones we > use in development to get tested BEFORE we declare the release stable. > >

2 1

performance of CREATE/CREATED handshake
by Rob van der Hoeven 13 Oct '16

13 Oct '16

Hi folks, I'm currently thinking about a new scalable network architecture for Tor. In order to get some idea about the performance of this architecture I need some data about the CREATE/CREATED handshake. This handshake involves PK encryption which is of course time consuming, and this probably determines the maximum client-capacity of a node in my new network architecture. I'm interested in two values: 1) The average circuit-rate of a single client (circuits/sec) 2) The average CPU-time it takes to perform a CREATE/CREATED handshake. Any data on these questions is much appreciated. Rob. https://hoevenstein.nl

3 4

prop224: Maximum introduction points in a descriptor
by David Goulet 11 Oct '16

11 Oct '16

Hello Tor-Dev! As part of some discussions that happened at the Seattle Tor Meeting few weeks ago, we've talked about the number of introduction points in an hidden service descriptor for proposal 224 (next generation HS). I've attached a spec change with the values ranging: Minimum: 0 - Default: 3 - Maximum: 20 The changes from what we have right now is basically the maximum. We would like to go from 10 to 20. It's arbitrary for now but one of the main reasons is to allow tools like OnionBalance to be able to scale more as we heard from large HS operators that they would like to go above 60 (10 * 6 HSDirs). Let us know what you think! Cheers! David

2 1

Re: [tor-dev] Proposal 274: A Name System API for Tor Onion Services
by 61wxgp60＠vfemail.net 11 Oct '16

11 Oct '16

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 Hi, Why run a separate process instead of using unix socket or TCP socket? > Since a Namecoin domain can point to IP addresses and ICANN-based DNS > names in addition to onion service names, and a Namecoin domain owner > might wish to switch between these configurations without causing > downtime or forcing their users to change behavior, I recommend against > this. However, see the open question below: > Open question: If a Namecoin domain points to an onion service, end > users might expect encryption to be built in, and this assumption will > be violated if the Namecoin domain switches to using an IP address. > However, Namecoin domains can include TLS fingerprints, which would be > enforced for both the IP address and the onion service address. Is it > sufficient to tell users that TLS is required if they want encryption > for Namecoin-addressed services, or is some additional mechanism > needed here to avoid bad things? How about specifying whether the Namecoin domain should point to .onion or clearnet in the domain? We can require that TLDs for such service must end in either: o o: The name points to a .onion name. o i: The name points to an IP address. o a: The name points to a clearnet domain name. So example.zkeyo points to 66tluooeeyni5x6y.onion. example.zkeyi points to 192.0.2.1 or (and?) 2001:db8::1. example.zkeya points to example.com. -----BEGIN PGP SIGNATURE----- Version: GnuPG v2 iQIcBAEBCAAGBQJX+OqnAAoJEOoKZxebCIumIh0P/RaIZj9XYNngI6fVIcwQRGt9 OV9xPWNKkf53TcDi7HkkQLw5QerSe+Qmu6aMYBJ1J3s32QliX6Za+/AAfXwQ+051 JxOZKcg0RKGbTrjPMkF6mptkfSf+Xjkc8C5/BQp9TNcuy/CYmG88Soud7GidngW4 6lNvgJumxlP6YxpDvVg+VXpk8ry7k8kugoiKsFBKKFWYoEXUkDGRSXXLUiqC7hpv N6UleRnK7eeHBFu3K76l9j8tuW33xohomKdLf33BB4E1XBUQnPfw6DRdRns0IlqX BnWed7GGdd9ToQcWFKbRopYLRyTT7VX9IpgP1DJ689xchad8xnWcEz57aevyUlZ3 WaP5Vdrd3n/btYxAMbX65smAR98bkxSSr3NlFlpnympGnlgNW8bXtB6bjD2OQvmU uBLTXZsJWyCZAWGmVk5XJUU6leieZz6DLCQTRk36qWfHT5/0E6bDsvdUUQAWfw9M uHMoNKmVMXxTUhmQx3AVifQZ1w30jD/7ZsyF/Us3L0RpcUrCZKLvoDs5SIfD/VVe SCGFXYPC9VMxF+ElrmyrRC/IEGxEOgegdRwdSnnVi73PuOU2cxIR2iYyj845AE8f /JMN2rwULDVaxyREAhDafZRojkcJmQgv/prqN8U890Ihc2MUiGhgIqeDxCSAfwqN w6sZ30pOL9/BiBKzmTto =mMR3 -----END PGP SIGNATURE----- ------------------------------------------------- 75% of Americans don't like Clinton or Trump. Don't waste your vote, say 'No' to the US Oligarchy and give it to Gary Johnson. (paid for by VFEMail) ONLY AT VFEmail! - Use our Metadata Mitigator to keep your email out of the NSA's hands! $24.95 ONETIME Lifetime accounts with Privacy Features! 15GB disk! No bandwidth quotas! Commercial and Bulk Mail Options!

3 2

archive.is alternative for CFC addon
by bancfc＠openmailbox.org 09 Oct '16

09 Oct '16

Since there were plans to use this service to circumvent Cloudflare CAPTCHAs and now its behind Cloudflare itself (it requires users to execute JS to access content) what alternative is planned for the upcoming CFC addon? *** PS. My username was around long before this addon and is not related to it in any way.

2 1

Tor Browser downloads and updates graphs
by Georg Koppen 09 Oct '16

09 Oct '16

Hi all! So, Karsten, Nicolas and I were sitting together for a while and were looking at past data for figuring out how many users downloaded and updated their Tor Browser over time. We actually got more questions than we were able to answer but I guess that's fine for a start. Here are the graphs showing initial downloads, update pings and update requests over time: https://people.torproject.org/~karsten/volatile/torbrowser-annotated-2016-0… We annotated the grapgs a bit highlighting things we wanted people to point to. The initial downloads are the number of package downloads from the website for all supported platforms (Windows, OS X and Linux). Apart from spike (5) all events seem to be non-Tor Browser related. * On the downloads graph we seem to have a spike (5) in new downloads with the release of Tor Browser 6.0. Maybe because it was much more widely publicized in the media than previous/later releases? * On the same graph, a big spike (6) can be seen at the same day the new board got announced. * There are other spikes on the initial downloads graph (1, 3, 4) where we have no idea what happened while (2) is probably just an outlier. The update pings are made by Tor Browser instances roughly twice a day and they indicate the number of active Tor Browser users. More importantly, one can see the decrease or increase of Tor Browser usage over time. * As (2) in the downloads graph (7) seems to be an outlier as well. * We don't know what (8) or (9) is but it seems to us we are losing users over time and are only getting them back slowly if at all. A weekday/weekend pattern is visible there as well. The graph with the update requests is basically showing how fast users are updating to newly released Tor Browser versions. * (10) shows a large spike correlating to the 6.0 release. It is not clear to us where all those update requests were coming from given the update request pattern before/after 6.0. One plausible explanation could be that our infrastructure was heavily overloaded causing clients to retry fetching the update. We'd love to hear feedback, especially those that could shed light on the events we did not have an explanation for. Georg

11 21