- tor-dev - lists.torproject.org

Bored C programmers? I've got some warnings for you....
by Nick Mathewson 09 Sep '16

09 Sep '16

Hi, all! I've just turned on some code [1] that makes all of the "bug" warnings that occur during the unit tests get logged to console. Previously, all warnings from the unit tests were off by default. Now there are a lot of warnings from the unit tests! For each one, we should either: 1) Decide that the warning message wouldn't actually reflect a bug in Tor, and change it. 2) Decide that there's a bug in the unit tests (or elsewhere) and fix it. 3) Decide that _in this case_, the unit tests are correctly testing code that *would* indicate a real bug in Tor. In this case, we should use the functions in log_test_helpers.c to temporarily suppress the log messages, and make sure that this message (and only this message!) is logged. This is going to be a fair bit of work, but with any luck, we can actually fix it all before the next 029 alpha comes out, and improve our confidence in our unit tests. [1] https://trac.torproject.org/projects/tor/ticket/20042 cheers, -- Nick

2 2

Post-quantum proposals #269 and #270
by lukep＠tutanota.com 09 Sep '16

09 Sep '16

Great to see the community making progress with post-quantum handshakes. But I'm wondering what's going to happen with Proposals #269 and #270. #269 seems to allow any post-quantum algorithm to be used in the hybrid with NTRUEncrypt and NewHope being specified as two options (presumably other options like SIDH or Mceliece could also be used). #270 is more specific, a hybrid of x25519 and NewHope. NewHope seems to be in the lead but do we want to rule others - so a flexible proposal like #269 might be better. #269 and #270 look as if they would not be compatible with each other so what's the process for deciding between them? Also see https://eprint.iacr.org/2016/717.pdf, a comparison of attacks on NTRU. It doesn't break NTRU but it does break (some versions of) YASHE which is a FHE scheme based on NTRUEncrypt. In the conclusion it recommends transforming NTRU-like algorithms into ring-LWE like algorithms, and dismissing the former since they are known to be weaker. I still think a flexible protocol rather than all eggs in the NewHope basket is a Good Thing. -- lukep

4 6

Pluggable transport idea: TLS session resumption
by David Fifield 08 Sep '16

08 Sep '16

Here's an idea for a new pluggable transport. It's just a TLS tunnel, but with a twist that allows the server's certificate to be omitted, depriving the censor of many classification features, such as whether the certificate is signed by a CA, the certificate's lifetime, and whether the commonName matches the server's IP address. I got the idea from ShadowsocksR: https://github.com/breakwa11/shadowsocks-rss/blob/master/ssr.md#2%E6%B7%B7%… The trick that makes it work is RFC 5077 session tickets. How it's supposed to work is, the client makes a TLS connection as usual, and the server sends back a session ticket before beginning the flow of application data. The session ticket is just a random blob from the client's point of view; from the server's point of view it's an authenticated ciphertext that encodes session parameters such as the ciphersuite and master secret. The next time the client connects to the same server, it sends the session ticket along with its ClientHello and the server can skip sending its certificate. Here's a simple way to adapt session tickets for circumvention. The client *always* sends a session ticket when making a connection, even the very first time. The ticket doesn't come from a previous communication with the server; the client generates the ticket itself. The ticket could for instance be a random string--the censor wouldn't be able to distinguish--but we can also use those bits for other purposes. When the server receives the ClientHello, it *pretends* that the ticket was a valid one, and finishes the handshake using hardcoded session parameters, just statically configuring what it would have encoded into a session ticket. The protocol as just described would be vulnerable to active probing; the censor could test for servers by sending them garbage session tickets and seeing how they respond. But that's easy to fix. We can, for example, let the client and server have a shared secret, and have the server treat the session ticket as the client part of an obfs4 handshake--which conveniently resembles a random blob. If the session ticket doesn't pass obfs4 authentication, then the TLS server can respond as it naturally would if a client sent an invalid session ticket; i.e., issue a new ticket and do a full handshake (then send dummy data, I guess). The server can also honor its own legitimately issued tickets, but still send dummy data in response. Only clients who know the shared secret will be able to access the proxy functionality of the server. In order to block such a transport, the censor will have to look at features other than the server certificate. It could, for example: * block all session tickets (dunno how costly that would be) * statefully track which tickets servers have issued, and block connections that use an unknown ticket. * track the fraction of connections that use session tickets on each TLS server. * active-probe the server in order to get a certificate, and then look at certificate features. We'd have to do some research to find out the distribution of session ticket sizes in the wild. (RFC 5077 recommends a specific format: https://tools.ietf.org/html/rfc5077#section-4.) I didn't think of this idea; it comes from ShadowsocksR and its tls1.2_ticket_auth plugin. https://github.com/breakwa11/shadowsocks-rss/blob/master/ssr.md#2%E6%B7%B7%… The documentation is in Chinese. Here is what Google Translate says in English: Analog TLS1.2 handshake at client has a session ticket situation is connected. Currently complete analog implementation, software testing through capture perfectly disguised as TLS1.2. Because there is no ticket so send certificates and other complicated steps, so the firewall can not make a judgment based on the certificate. At the same time it comes with the ability of certain anti-replay attacks. In case of a replay attack is searched end log in to the service, you can grep "replay attack" search, you can use this plug-in found in your area there is no line of interference for TLS. TLS relatively powerless firewall, anti-blocking ability than other plug-ins should be strong, but may also encounter a lot of interference, but the agreement itself will check out any interference, then disconnect encounter interference, to avoid long waits, so that customers end browser or reconnect themselves. This plug-in is compatible with the original agreement (the server is configured to require tls1.2_ticket_auth_compatible), one more than the original protocol handshake causes the connection will take longer, use C # client open automatically reconnect when performed better than the other plug-ins. Support for custom parameters, parameters SNI, it sends the host name field, this function is very similar to the TOR meet widget, for example, is set to cloudfront.net disguised as a cloud server requests, you can use a comma separate multiple host such as a.com, b.net, c.org (C # supports only), then it will randomly use. Note that error settings for this parameter may cause the connection to be disconnected even IP is blocked, such as how to set clear then please leave it blank. Recommended customized parameter settings to cloudflare.com or cloudfront.net. This is how a normal ticketless handshake looks (https://tools.ietf.org/html/rfc5246#section-7.3) ClientHello --------> ServerHello Certificate* ServerKeyExchange* CertificateRequest* <-------- ServerHelloDone Certificate* ClientKeyExchange CertificateVerify* [ChangeCipherSpec] Finished --------> [ChangeCipherSpec] <-------- Finished Application Data <-------> Application Data This is how the ticket-using transport would look: (https://tools.ietf.org/html/rfc5077#section-3.1) ClientHello (SessionTicket extension) --------> ServerHello NewSessionTicket [ChangeCipherSpec] <-------- Finished [ChangeCipherSpec] Finished --------> Application Data <-------> Application Data

2 1

Error in javascript:ISSUE#6761
by AKASH DAS 05 Sep '16

05 Sep '16

There is an error in the javascript syntax in https-anywhere which the test bypasses. I have issued it in the github link https://github.com/EFForg/https-everywhere/issues/6761. On Mon, Sep 5, 2016 at 10:49 PM, AKASH DAS <akash.d14(a)iiits.in> wrote: > If I have to make any patch in the code, do I have to submit it in this > mailing list or https-everywhere's mailing list? Just a doubt > > On Mon, Sep 5, 2016 at 10:35 PM, David Fifield <david(a)bamsoftware.com> > wrote: > >> On Mon, Sep 05, 2016 at 10:28:26PM +0530, AKASH DAS wrote: >> > Can I know the issues that are currently in https everywhere. >> >> I don't know if this is what you're looking for, but here are some open >> bug tracker tickets. >> >> https://trac.torproject.org/projects/tor/query?status=!close >> d&component=HTTPS+Everywhere%2FEFF-HTTPS+Everywhere >> https://trac.torproject.org/projects/tor/query?status=!close >> d&component=HTTPS+Everywhere%2FHTTPS+Everywhere%3A+Chrome >> > > > > -- > > *Akash Das* > > *Student Systems Admin* > > *Indian Institute Of Information Technology* > > *Sricity* > -- *Akash Das* *Student Systems Admin* *Indian Institute Of Information Technology* *Sricity*

1 0

HTTPS Everywhere
by AKASH DAS 05 Sep '16

05 Sep '16

Respected all, Can I know the issues that are currently in https everywhere. -- *Akash Das* *Student Systems Admin* *Indian Institute Of Information Technology* *Sricity*

3 4

Re: [tor-dev] [tor-talk] Onion Service introduction point selection
by George Kadianakis 03 Sep '16

03 Sep '16

Muhammad Hammad Mazhar <mmazhar(a)uiowa.edu> writes: > [ text/plain ] > I am looking into Tor onion services as part of my research, and am interested in how an Onion Service selects its introduction points, in particular where in source code does it do so. I am aware of rendservice.c in the source code, but any pointers are welcome. > > Please move this mail to the requisite list if required. > You were very close! Please see function rendservice.c:rend_consider_services_intro_points() and related code. [Moved to [tor-dev] from [tor-talk])

1 0

onionoo: poor reverse DNS results
by nusenu 02 Sep '16

02 Sep '16

Hi Karsten, some time ago I reported onionoo's poor reverse DNS results https://trac.torproject.org/projects/tor/ticket/18342 and it didn't change since then. As of 2016-07-02 08:00 (tpo instance) 3144 out of 8473 (~37%) still have no reverse DNS result (=IP address). Do you have an idea whether this will improve sometime before 2016-09-01? thanks, nusenu btw: Thanks for working around the maxmind AS problem with reverting to the May version.

2 2

txtorcon 0.16.1
by meejah 01 Sep '16

01 Sep '16

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 I'm very happy to announce txtorcon 0.16.1 which adds a couple minor features to help support using Foolscap and Tahoe-LAFS over Tor. * issue 172: give TorProcessProtocol a .quit method * issue 181: enable SOCKS5-over-unix-sockets for TorClientEndpoint (thanks to "dawuud"). Also adds TLS support over SOCKS5. You can download the release from PyPI or GitHub (or of course "pip install txtorcon"): https://pypi.python.org/pypi/txtorcon/0.16.1 https://github.com/meejah/txtorcon/releases/tag/v0.16.1 Releases are also available from the hidden service: http://timaq4ygg2iegci7.onion/txtorcon-0.16.1.tar.gz http://timaq4ygg2iegci7.onion/txtorcon-0.16.1.tar.gz.asc You can verify the sha256sum of both by running the following 4 lines in a shell wherever you have the files downloaded: cat <<EOF | sha256sum --check d551837025bb9f4fdded58cd11025c6e42924b6eb20dcb2a49f182b3fd85f377 dist/txtorcon-0.16.1.tar.gz e89a785f64f3544b19f7b1e6cebdbd6914475e0c60f508d9f0b6ce4a840769a7 dist/txtorcon-0.16.1-py2-none-any.whl EOF thanks, meejah p.s. There is no 0.16.0 because I tagged the wrong thing and noticed when pushing to PyPI. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQEcBAEBAgAGBQJXx3TOAAoJEMJgKAMSgGmn7AEIAN5BQNqisxefMyKnHA8BCSZW UJpXPagnftg33HF2v4ZG/2yQUh8sYMqEn/OI99g8yA++bZmG9H0lJixg0zs6V2XV bX63zJ7d9lr+uu3D+crQNnmofcoUbLRX+Z7n5SWhgGtlsVqemIJton/cuedtnrXm 1E5VdjhxYIZ/2Qv0gTz7ZBYw0Hmkr24qwVufdblQHDov2SdM0kknInWqxFqVMLQd /p0+PTEF6SMdemHFkOJ73sCbINg6qLB4cErKaFY14U2cnS3Y1pZLhlEKFTzbd8TU SWtg1b9pn5s4Euq5ruYhNNIqVtQz/lrq0/ZQ+NKiLZ/L2rtw9xFY0nF1KhFTgLc= =IMj2 -----END PGP SIGNATURE-----

1 0

Bifroest's sanitized bridge descriptors available from CollecTor in 48 hours from now
by Karsten Loesing 31 Aug '16

31 Aug '16

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hi devs, if you're not using CollecTor's sanitized bridge descriptors for anything, you can safely ignore this message. As you may know, there are currently two bridge directory authorities in the Tor network, Tonga and Bifroest, and Tonga will go away some time this weekend. You can fetch sanitized versions of Tonga's bridge descriptors here: https://collector.torproject.org/recent/bridge-descriptors/ We're also now ready to provide sanitized versions of Bifroest's bridge descriptors. The only differences to Tonga's descriptors are: - Statuses will have Bifroest's fingerprint in their file name rather than Tonga's. Example: https://people.torproject.org/~karsten/volatile/20160829-164232-1D8F3A91C37… - There will be two "concurrent" statuses published by Tonga and Bifroest this week, containing two distinct sets of bridges. I'm holding back Bifroest's descriptors from CollecTor for another 48 hours or so to give you time to prepare for this change. After all, you might have written your code under the assumption that there's just a single bridge authority, and the above change might confuse your code and break it. Everything will be on CollecTor in 48 hours from now. All the best, Karsten -----BEGIN PGP SIGNATURE----- Comment: GPGTools - http://gpgtools.org iQEcBAEBAgAGBQJXxHytAAoJEC3ESO/4X7XBMfAIAKXADVnMGK5rYmbZN5ymF2M8 IbFc/6VWV+CoUdss868Dp5/Y3huE6SgFXCe3A+R+jCg5Od8rIiWKEfNvVeLEXpU1 DtuYNAq3vlhVhHTOdWmCz2uRVeWNddb12RDa+H55QtGHC4JC8HP9PRSN+lLj5fBr YBuKvLAWfMOsfdAqVJwHmmhtORPag7wL2NWmmk/y4j9JCzQ//NmUv3CMdIQm+j98 pM5jwI6ogiec2f/Nbij3eSJHCAhHKuL5TKR6E+//TE/s4ZGBKDPxkw+w/PdQrViC A3RgDVm7sqrjKkm2jWHVEuTa36QdzBgpV6vH1tEmTrHTz7Epre3MVFwKR607LBM= =gXT3 -----END PGP SIGNATURE-----

1 1

metrics-lib/DescripTor 1.4.0 is released
by Karsten Loesing 31 Aug '16

31 Aug '16

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hello devs, we just released metrics-lib/DescripTor 1.4.0: https://dist.torproject.org/descriptor/1.4.0/ - From the change log: # Changes in version 1.4.0 - 2016-08-31 * Major changes - Add the Simple Logging Facade for Java (slf4j) for logging support rather than printing warnings to stderr. Applications must provide slf4j-api-1.7.7.jar or higher as dependency and can optionally provide a compatible logging framework of their choice (java.util.logging, logback, log4j). * Medium changes - Add an alpha version of a DescriptorCollector implementation that is not enabled by default and that uses CollecTor's index.json file to determine which descriptor files to fetch. Applications can enable this implementation by providing gson-2.2.4.jar or higher as dependency and setting property descriptor.collector to org.torproject.descriptor.index.DescriptorIndexCollector. * Minor changes - Include resource files in src/*/resources/ in the release tarball. - Move executable, source, and javadoc jar to generated/dist/. Happy descriptoring! All the best, Karsten -----BEGIN PGP SIGNATURE----- Comment: GPGTools - http://gpgtools.org iQEcBAEBAgAGBQJXxp6UAAoJEC3ESO/4X7XBUF8IAMuIPxoCkt9FR6LolUmuyk3I +eElyry5r8jUGDiBOxx0TWrYxr6ZrvxOD6lxzvG0a/nfAF+cdELJyNE+1+GiTku2 rgM/1NcxqGq6yBzxMFOZXPv1VG35LmpFtQUnxZR5Ij8x/p3SweMlbHUAVShSQZT2 tuRi32YCBZyH8XgD65XAak0SZ7co7aMZOORsixymFYW2oRYOxOkARX4sA4AfA4ED Nkqwa4fhX3b4uIshbzpifXm0ACkAxEUwewLS/g6vkKcn0a0tS6DC3mDrzIOAvF8v VTLghyZKbuWWuGZAlLEDhyHmo3/Afy6ETb1cFy/lvJUVnu/W8P4sbRnQrfvVJ/s= =Ugsq -----END PGP SIGNATURE-----

1 0