- tor-dev - lists.torproject.org

fteproxy depends on obfsproxy...
by Kevin P Dyer 09 Sep '15

09 Sep '15

...and it shouldn't. Fortunately, the dependency is isolated to a single file. See [1]. My understanding is that pyptlib [2] is no longer maintained. wiley/asn/etc. - What's the proper way to remove this dependency, but make it easy for fteproxy to be a PT? -Kevin [1] https://github.com/kpdyer/fteproxy/blob/master/fteproxy/cli.py#L248 [2] https://pypi.python.org/pypi/pyptlib

4 7

[RFC] On new guard algorithms and data structures
by George Kadianakis 09 Sep '15

09 Sep '15

Hello there, recently we've been busy specifying various important improvements to entry guard security. For instance see proposals 250, 241 and ticket #16861. Unfortunately, the current guard codebase is dusty and full of problems (see #12466, #12450). We believe that refactoring and cleaning up the entry guard code is essential before we proceed to more advanced security improvements. We've been working on new algorithms and data structures for guard nodes as part of ticket #12595. In this mail I include some pseudocode for this new algorithm with the hope that it will act as a draft for implementing these changes. You can find the pseucode here: https://gitweb.torproject.org/user/asn/tor.git/tree/src/or/guardlist.c?h=bu… A short description of the algorithm is included on top, and then various methods and functions are prototyped underneath to make the logic more concrete. Apart from the comments and XXXs on the code, here are some more thoughts on this work: - This new design focuses on protecting against path bias attacks, by slightly damaging our reachability. Specifically, the old design is better at recovering in filtered networks, because it will keep on adding new nodes till one succeeds. In this new design, we will not try more than 80 relays per time. So if none of them passes the filtered network, bad luck no Tor. While this failure mode should not happen much, it's bad news for users behind FascistFirewalls which are actually quite frequent. A quick fix here would be to always add an 80/443 guard on our list, however as it stands only 30% of the guards are 80/443 guards, so this has bad anonymity consequences. - To improve our algorithm and make it more robust we need to understand further what kind of path bias attacks are relevant here. The adversary here is a network adversary (like a gateway) that can block our connections to certain guards. What nasty attacks can this adversary do? If we can't find bad attacks here, then maybe we should stop worrying about those path bias attacks so much. For example a threat here with the old guard logic, is that if we used this evil gateway just for 10 minutes (in an airport), the adversary could launch a path bias attack and force us to connect to her guard node. Then even after we left that airport, we would still stick to the evil guard node which is bad. Also, an adversary that manages to own our guard using path bias attacks, then has further possibilites for biasing the rest of the circuit. What can this adversary do? - Notice that the pseudocode contains no logic about bridges. I'm not sure how bridges should be handled here. - I tried to keep the dirguard logic very simple, hoping that we can eventually forget about dirguards entirely when #12538 is done. The main dirguard feature is that we assume that populate_live_entry_guards() and add_an_entry_guard() will return dirguards when the circuit is a directory circuit. Maybe we should consider introducing the "primary dirguard" concept as well. And maybe also add some logic where Tor will move on to the next dirguard if it failed to receive a document from the current dirguard. - I used the ATTEMPTED_THRESHOLD concept of prop241, but did not use the NET_THRESHOLD and CONNECTED_THRESHOLD ideas. I removed NET_THRESHOLD because I increased the value of ATTEMPTED_THRESHOLD to the point that it can also be used as a network down indicator. Also, I was not sure what CONNECTED_THRESHOLD was useful for, and there were certain engineering issues with it (Like, if that threshold is hit, we need a logic that will *only retry the successfully connected guards*, and not all guards). - There is no log message warning the user of path bias attacks or bad network or anything. That's because there is no way to figure out what's the problem, and issuing an alarming log message here would confuse and panic the user. If we want to inform the user anyhow, maybe if the user is *actively* trying to visit a destination, and we've been cycling through our guard list for ages, maybe we should then issue a log message telling the user that something is wrong with the network. - In general, I tried to keep the number of heuristics and kludges to the minimum to keep the logic simple. Unfortunately, it seems that without a "network down" indicator (#16120) there is no way to avoid edge cases and false positives here. We should try to fix all problems here that can occur frequently or have security consequences, but there will always be scenarios where Tor will end up thinking there is no network while it's actually on a filternet. For this reason, we should give plenty of testing to this feature before we ship it to real users! - Finally, all the constants & parameters in the pseudocode are subject to change. I tried to motivate some of them, but others are just arbitrary. Feedback is very welcome and please let me know of any issues with security or reachability that you find! Or of how the pseudocode should be altered to make it more useful for implementors. Cheers!

9 19

Erebus Code Review
by Damian Johnson 09 Sep '15

09 Sep '15

Hi Cristobal, just took a peek at Erebus and looks good! There's some low hanging fruit for improvement (unused functions and such) but generally looks good. Cheers! -Damian ====================================================================== erebus/server/handlers/log.py ====================================================================== 9 import erebus.util.log Perfectly fine for now, but obviously most of this is copy/paste from Nyx. Both Nyx and Erebus are smack in the middle of development so this is great! Do whatever you find most expedient. But obviously in the long run we'll want to revisit this. ---------------------------------------------------------------------- 16 def conf_handler(key, value): 17 if key == 'features.log.maxLinesPerEntry': 18 return max(1, value) 19 elif key == 'features.log.prepopulateReadLimit': 20 return max(0, value) 21 elif key == 'features.log.maxRefreshRate': 22 return max(10, value) 23 elif key == 'cache.log_panel.size': 24 return max(1000, value) I know this is copy-and-paste from Nyx but personally I wouldn't bother. Many of the config keys are unused, and at present users don't have a way of customizing them. Nyx's support for a nyxrc is a very rarely used feature, so I would leave this out for now. ---------------------------------------------------------------------- 40 TOR_EVENT_TYPES = { 41 'd': 'DEBUG', 42 'i': 'INFO', 43 'n': 'NOTICE', 44 'w': 'WARN', 45 'e': 'ERR', I did this for Nyx because because... well, curses. For Erebus we can do better. ;) Rather than 'key => event' mapping maybe Erebus should show all the event types, with checkboxes for selection? ---------------------------------------------------------------------- 155 def _register_event(self, event): 156 output = { 'message': '', 'type': ''} 157 if event.type not in self._logged_events: 158 return 159 #self._event_log.add(event) 160 #self._log_file.write(event.display_message) 161 162 # notifies the display that it has new content 163 if self._filter.match(event.display_message): 164 self._has_new_event = True 165 output['message'] = event.display_message 166 output['type'] = event.type.lower() 167 ws = ws_controller() 168 if ws is not None: 169 ws.send_data(WebSocketType.LOG, output) You can drop the line with self._has_new_event. It's an unused attribute, and doesn't appear outside of this line. The 'output' is only ever used on this last line, so might as well just call... ws.send_data(WebSocketType.LOG, {'message': event.display_message, 'type': event.type.lower()}) ---------------------------------------------------------------------- 171 def log_handler(): 172 """ 173 Singleton for getting our log hander. 174 175 :returns: :class:`~erebus.server.handlers.log.LogHandler` 176 """ 177 178 return LOG_HANDLER 179 180 def init_log_handler(logged_events): 181 """ 182 """ 183 global LOG_HANDLER 184 LOG_HANDLER = LogHandler(logged_events) 185 return LOG_HANDLER Seems from a quick look that these might be unused. The controller.py and starter.py call init_log_handler, but not spotting anything that ever uses LOG_HANDLER. ---------------------------------------------------------------------- 195 response = None 196 if controller is not None: 197 response = controller.get_info('events/names', None) 198 if response is None: 199 return [] # GETINFO query failed This is equivalent to... response = controller.get_info('events/names', []) if controller else [] ====================================================================== erebus/util/controller.py ====================================================================== 29 def erebus_controller(): 30 """ 31 Provides the erebus controller instance. 32 """ 33 34 return EREBUS_CONTROLLER 35 36 def init_controller(control_port, control_socket, logged_events): 37 """ 38 Spawns the controller 39 """ 40 41 global EREBUS_CONTROLLER 42 EREBUS_CONTROLLER = Controller(control_port, control_socket, logged_events) Again, you call init_controller() but looks as though EREBUS_CONTROLLER is never used. ---------------------------------------------------------------------- 61 self._logged_events = logged_events 62 63 self._bw_handler = None 64 self._status_handler = None 65 self._log_handler = None All unused. ---------------------------------------------------------------------- 86 def _stop_loop_check(self): 87 """ 88 Stop the looping task when is not necessary 89 """ 90 91 self._loop_call.stop() Only called once, in _conn_starter(). Might as well just call this there (it's just a minor alias). ---------------------------------------------------------------------- 156 def heartbeat_check(is_unresponsive): 157 """ 158 Logs if its been ten seconds since the last BW event. 159 160 Arguments: 161 is_unresponsive - flag for if we've indicated to be responsive or not 162 """ 163 164 controller = tor_controller() 165 last_heartbeat = controller.get_latest_heartbeat() 166 167 if controller.is_alive(): 168 if not is_unresponsive and (time.time() - last_heartbeat) >= 10: 169 is_unresponsive = True 170 log.notice('Relay unresponsive (last heartbeat: %s)' % time.ctime(last_heartbeat)) 171 elif is_unresponsive and (time.time() - last_heartbeat) < 10: 172 # really shouldn't happen (meant Tor froze for a bit) 173 is_unresponsive = False 174 log.notice('Relay resumed') 175 176 return is_unresponsive Unused. ====================================================================== erebus/util/websockets.py ====================================================================== 41 def add_websocket(self, ws_type, ws): 42 """ 43 Add an object to the list of active websockets of certain type. 44 45 Arguments: 46 ws_type - type of websocket to be fetched 47 ws - websocket object to be added 48 """ 49 50 if self._websockets[ws_type] is not None: 51 if ws not in self._websockets[ws_type]: 52 self._websockets[ws_type].append(ws) 53 else: 54 log.notice('Undefined type (%s) when adding websocket' % ws_type) Your 'if self._websockets[ws_type] is not None' check will never evaluate to False. You default all WebSocketType values to an empty list, and if it doesn't belong to that enum then it'll raise a KeyError. You want... if ws_type in self._websockets: Also, if self._websockets had sets rather than lists then you could drop the second check. Btw, lets use Sphinx pydocs. The documentation style you're using here is adopted from Nyx before I started using Sphinx, and I'm replacing that documentation style as I rewrite it.

2 1

Troubleshooting Tor 0.2.7.1+ ephemeral hidden services
by Micah Lee 09 Sep '15

09 Sep '15

I'm trying to add support for ephemeral hidden services to OnionShare. They'll solve a wide variety of problems related to OnionShare using a system Tor instead of Tor browser, and running in environments like Tails or Whonix. I'd rather never write the hidden service info to disk anyway. I noticed that Tor Browser 5.5a2 comes with Tor 0.2.7.2-alpha, so it's easy to test. But so far I'm not having any success, at least with using stem. Before I open a bug report, either against stem or against tor, am I doing this right? I've made a simple test project: https://github.com/micahflee/ephemeral-hs-test It successfully appears to create the hidden service, but it never succeeds in connecting to itself. I also can't connect to it using Tor Browser. -- Micah Lee

2 2

Proposal: Out of Band Circuit HMACs
by Mike Perry 08 Sep '15

08 Sep '15

This proposal exists in my torspec remote here: https://gitweb.torproject.org/user/mikeperry/torspec.git/tree/proposals/xxx… Including it in-line for ease of reply: =============================== Filename: xxx-oob-hmac.txt Title: Out of Band Circuit HMACs Authors: Mike Perry Created: 01 September 2015 Status: Draft 0. Motivation It is currently possible for Guard nodes (and MITM adversaries that steal their identity keys) to perform a "tagging" attack to influence circuit construction and resulting relay usage[1]. Because Tor uses AES as a stream cipher, malicious or intercepted Guard nodes can simply XOR a unique identifier into the circuit cipherstream during circuit setup and usage. If this identifier is not removed by a colluding exit (either by performing another XOR, or making use of known plaintext regions of a cell to directly extract a complete side-channel value), then the circuit will fail. In this way, malicious or intercepted Guard nodes can ensure that all client traffic is directed only to colluding exit nodes, who can observe the destinations and deanonymize users. Most code paths in the Tor relay source code will emit loud warnings for the most obvious instances circuit failure caused by this attack. However, it is very difficult to ensure that all such error conditions are properly covered such that warnings will be emitted. This proposal aims to provide a mechanism to ensure that tagging and related malleability attacks are cryptographically detectable when they happen. 1. Overview Since Tor Relays are already storing a running hash of all data transmitted on their circuits (via the or_circuit_t::n_digest and or_circuit_t::p_digest properties), it is possible to compute an out-of-band HMAC on circuit data, and verify that it is as expected. This proposal first defines an OOB_HMAC primitive that can be included standalone in a new relay cell command type, and additionally in other cell types. Use of the standalone relay cell command serves to ensure that circuits that are successfully built and used were not manipulated at a previous point. By altering the RELAY_COMMAND_TRUNCATED and CELL_DESTROY cells to also include the OOB_HMAC information, it is similarly possible to detect alteration of circuit contents that cause failures before the point of usage. 2. The OOB_HMAC primitive The OOB_HMAC primitive uses the existing rolling hashes present in or_circuit_t to provide a Tor OP (aka client) with the hash history of the traffic that a given relay has seen it so far. Note that to avoid storing an additional 64 bytes of SHA256 digest for every circuit at every relay, we use SHA1 for the hash logs, since the circuits are already storing SHA1 hashes. It's not immediately clear how to upgrade the existing SHA1 digests to SHA256 with the current circuit protocol, either, since matching hash algorithms are essential to the 'recognized' relay cell forwarding behavior. The version field exists primarily for this reason, should the rolling circuit hashes ever upgrade to SHA256. The OOB_HMAC primitive is specified in Trunnel as follows: struct oob_hmac_body { /* Version of this section. Must be 1 */ u8 version; /* SHA1 hash of all client-originating data on this circuit (obtained from or_circuit_t::n_digest). */ u8 client_hash_log[20]; /* Number of cells processed in this hash, mod 2^32. Used to spot-check hash position */ u32 client_cell_count; /* SHA1 hash of all server-originating data on this circuit (obtained from or_circuit_t::p_digest). */ u8 server_hash_log[20]; /* Number of cells processed in this hash, mod 2^32. Used to spot-check hash position. XXX: Technically the server-side is not needed. */ u32 server_cell_count; /* HMAC-SHA-256 of the entire cell contents up to this point, using or_circuit_t::p_crypto as the hmac key. XXX: Should we use a KDF here instead of p_crypto directly? */ u8 cell_hmac_256[32]; }; 3. Usage of OOB_HMAC The OOB_HMAC body will be included in three places: 1. In a new relay cell command RELAY_COMMAND_HMAC_SEND, which is sent in response to a client-originating RELAY_COMMAND_HMAC_GET on stream 0. 2. In CELL_DESTROY, immediately after the error code 3. In RELAY_COMMAND_TRUNCATED, immediately after the CELL_DESTROY contents 3.1. RELAY_COMMAND_HMAC_GET/SEND relay commands Clients should use leaky-pipe topology to send RELAY_COMMAND_HMAC_GET to the second-to-last node (typically the middle node) in the circuit at three points during circuit construction and usage: 1. Immediately after the last RELAY_EARLY cell is sent 2. Upon any stream detachment, timeout, or failure. 3. Upon any OP-initiated circuit teardown (including timed-out partially built circuits). We use RELAY_EARLY as the point at which to send these cells to avoid leaking the path length to the middle hop. 3.2. Alteration of CELL_DESTROY and RELAY_COMMAND_TRUNCATED In order to provide an HMAC even when a circuit is torn down before use due to failure, the behavior for generating and handling CELL_DESTROY and RELAY_COMMAND_TRUNCATED should be modified as follows: Whenever an OR sends a CELL_DESTROY for a circuit towards the OP, if that circuit was already properly established, the OR should include the contents of oob_hmac_body immediately after the reason field. The HMAC must cover the error code from CELL_DESTROY. Upon receipt of a CELL_DESTROY, and in any other case where an OR would generate a RELAY_COMMAND_TRUNCATED due to error, a conformant relay would include the CELL_DESTROY oob_hmac_body, as well as its own locally created oob_hmac_body. The locally created oob_hmac_body must cover the entire payload contents of RELAY_COMMAND_TRUNCATED, including the error code and the CELL_DESTROY oob_hmac_body. Here is a new Trunnel specification for RELAY_COMMAND_TRUNCATED: struct relay_command_truncated { /* Error code */ u8 error_code; /* Number of oob_hmacs. Must be 0, 1, or 2 */ u8 num_hmac; /* If there are 2 hmacs, the first one is from the CELL_DESTROY, and the second one is from the truncating relay. If num_hmac is 0, then this came from a relay without support for oob_hmac. */ struct oob_hmac_body[num_hmac]; }; The usage of a strong HMAC to cover the entire CELL_DESTROY contents also allows an OP to properly authenticate the reason a remote node needed to close a circuit, without relying on the previous hop to be honest about it. 4. Ensuring proper ordering with respect to hashes 4.1. RELAY_COMMAND_HMAC_GET/SEND The in-order delivery guarantee of circuits will mean that the incoming hashes will match upon receipt of the RELAY_COMMAND_HMAC_SEND cell, but any outgoing traffic the OP sent since RELAY_COMMAND_HMAC_GET will not have been seen by the responding OR. Therefore, immediately upon sending a RELAY_COMMAND_HMAC_GET, the OP must record and store its current outgoing hash state for that circuit, until the RELAY_COMMAND_HMAC_SEND arrives, and use that stored hash value for comparison against the oob_hmac_body's client_hash_log field. The server_hash_log should be checked against the corresponding crypt_path_t entry in origin_circuit_t for the relay that the command was sent to. 4.2. RELAY_COMMAND_TRUNCATED Since RELAY_COMMAND_TRUNCATED may be sent in response to any error condition generated by a cell in either direction, the OP must check that its local cell counts match those present in the oob_hmac_body for that hop. If the counts do not match, the OP may generate a RELAY_COMMAND_HMAC_GET to the hop that sent RELAY_COMMAND_TRUNCATED, prior to tearing down the circuit. 4.3. CELL_DESTROY If the cell counts of the destroy cell's oob_hmac_body do not match what the client sent for that hop, unfortunately that hash must be discarded. Otherwise, it may be checked against values held from before processing the RELAY_COMMAND_TRUNCATED envelope. 5. Security concerns and mitigations 5.1. Silent circuit failure attacks The primary way to game this oob-hmac is to omit or block cells containing HMACs from reaching the OP, or otherwise tear down circuits before responses arrive with proof of tampering. If a large fraction of circuits somehow fail without any RELAY_COMMAND_TRUNCATED oob_hmac_body payloads present, and without any responses to RELAY_COMMAND_HMAC_GET requests, the user should be alerted of this fact as well. This rate of silent circuit failure should be kept as an additional, separate per-Guard Path Bias statistic, and the user should be warned if this failure rate exceeds some (low) threshold for circuits containing relays that should have supported this proposal. 5.2. Malicious/colluding middle nodes If the adversary is prevented from causing silent circuit failure without the client being able to notice and react, their next available vector is to ensure that circuits are only built to middle nodes that are malicious and colluding with them (or that do not support this proposal), so that they may lie about the proper hash values that they see (or omit them). Right now, the current path bias code also does not count circuit failures to the middle hop as circuit attempts. This was done to reduce the effect of ambient circuit failure on the path bias accounting (since an average ambient circuit failure of X per-hop causes the total circuit failure middle+exit circuits to be 2X). Unfortunately, not counting middle hop failure allows the adversary to only allow circuits to colluding middle hops to complete, so that they may lie about their hash logs. All failed circuits to non-colluding middle nodes could be torn down before RELAY_COMMAND_TRUNCATED is sent. For this reason, the per-Guard Path Bias counts should be augmented to additionally track middle-node-only failure as a separate statistic as well, and the user should be warned if middle-node failure drops below a similar threshold as the current end-to-end failure. 5.3. Side channel issues, mitigations, and limitations Unfortunately, leaking information about circuit usage to the middle node prevents us from sending RELAY_COMMAND_HMAC_GET cells at more optimal points in circuit usage (such as immediately upon open, immediately after stream usage, etc). As such, we are limited to waiting until RELAY_EARLY cells stop being sent. It is debatable if we should send hashes periodically (perhaps with windowing information updates?) instead. 6. Alternatives A handful of alternatives to this proposal have already been discussed, but have been dismissed for various reasons. Per-hop cell HMACs were ruled out because they will leak the total path length, as well as the current hop's position in the circuit. Wide-block ciphers have been discussed, which would provide the property that attempts to alter a cell at a previous hop would render it completely corrupted upon its final destination, thus preventing untagging and recovery, even by a colluding malicious peer. Unfortunately, performance analysis of modern provably secure versions of wide-block ciphers has shown them to be at least 10X slower than AES-NI[2]. 1. https://lists.torproject.org/pipermail/tor-dev/2012-March/003347.html 2. http://archives.seul.org/tor/dev/Mar-2015/msg00137.html -- Mike Perry

1 0

[Measurement Team] Next IRC meeting happens on Wednesday, Sep 9, 14:00 UTC in #tor-project
by Karsten Loesing 08 Sep '15

08 Sep '15

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hello list, This is an announcement/reminder that there will be an IRC meeting of the Measurement Team on Wednesday, September 9, 2015, 14:00 UTC in #tor-project https://www.timeanddate.com/worldclock/fixedtime.html?iso=20150909T14 Talk to you tomorrow! All the best, Karsten -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 Comment: GPGTools - http://gpgtools.org iQEcBAEBAgAGBQJV7zD0AAoJEJD5dJfVqbCrNlAIAIHDOy3J3Rw7Tg8zbIECZMdU bLwUE31jnsIE54fPBv2+lofWq0FlciMNR/UGmuCDCvgKy1tzLAReWvZzZc4kB3hg sUMOYqB757/4IBFuh/6YWqrC7jOEuVEhky7/J/1obHj1pSzWY/Tt+whhC4Sfl4h5 WRHAUQUYPVIDaa8FjYiHCnHcTCLDiuu+FoODCD6LjtBX1dQYABkbUVm8Vo1vH/u+ UimxN+EhrJc/u5WA3Eb4YDURhikzUkdMM680gyZXrCip7klvX4fGlojBZHur6VkS p3LSSWfZ7o+mPBqyord7CPs+1o66sQLZdG6tzeOm3nQugqE2DgF9fNlnBkBt1D4= =sCDs -----END PGP SIGNATURE-----

1 0

Is there a way to do the man in the middle on hidden service?
by Liste 08 Sep '15

08 Sep '15

Sometime i can find the wrong SSL certificate on my hidden service.

1 0

Re: [tor-dev] Let's identify which measurement-related tools n eedwork when relays switch from RSA identities to ed25519 identities
by tordev123＠Safe-mail.net 08 Sep '15

08 Sep '15

From: Damian Johnson <atagar(a)torproject.org> To: "tor-dev(a)lists.torproject.org" <tor-dev(a)lists.torproject.org> Subject: Re: [tor-dev] Let's identify which measurement-related tools needwork when relays switch from RSA identities to ed25519 identities Date: Tue, 8 Sep 2015 09:16:15 -0700 > On a side note it would be nice to have a spec patch before changing > things this time. +1 The dir spec is still broken and doesn't cover the new descriptor format with stuff like: extra-info-digest 0589E8C4C8A522814EE8D7DC1A3703920B57208C Qychl+FIG6YEbXgGJaG13mMHW9z9Tci5D9DWCXOwmNg dir-spec: "extra-info-digest" digest NL [At most once] "Digest" is a hex-encoded digest (using upper-case characters) of the router's extra-info document, as signed in the router's extra-info (that is, not including the signature). (If this field is absent, the router is not uploading a corresponding extra-info document.) [Versions before 0.2.0.1-alpha don't recognize this]

1 0

Let's identify which measurement-related tools need work when relays switch from RSA identities to ed25519 identities
by Karsten Loesing 08 Sep '15

08 Sep '15

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hi everyone, Sebastian suggested to me in one of our last measurement team 1-1-1 task exchange rounds [0] to think about the following question: Which measurement-related tools need work when relays switch from RSA identities to ed25519 identities? You'll find below what I came up with. Please send any feedback and corrections to this list. I'll incorporate everything and send an updated document to this list next week. Thanks! All the best, Karsten The switch from RSA to ed25519 will happen in multiple steps (need to confirm these!): 0. Before ed25519 identities were used, each relay had a unique RSA identity. 1. Relays can create an optional ed25519 identity, change it, or stop using it at will. 2. Relays can create an ed25519 identity, but are not allowed to change it or stop using it. 3. Relays can stop using their earlier RSA identity. 4. Relays only use their ed25519 identity. (Add a notion of timeframe here. It seems unlikely that 3 or even 4 will happen before 2017 or even 2018, given how long it takes to deploy a new major Tor version in the network. Sebastian thinks that the timeline may not contain step 1.) ## Directory authority tools: Torflow, Guardfraction There are several tools that provide data to directory authorities for voting on relays. These tools include bandwidth authorities and the yet-to-be-finished Guardfraction tool. They will have to handle new ed25519 identities and provide their data in a format that directory authorities will be able to use for voting. ## Network health scanners: Exitmap, Sybilhunter It's unclear how much work remains to update network scanners like Exitmap and Syilbhunter. ## Descriptor parsing libraries: metrics-lib, Stem, Zoossh Descriptor parsing libraries need to support parsing new fields and later need to support that fields containing RSA fingerprints have become optional. Stem has already implemented ed25519 identities, and there's Java code that metrics-lib could re-use in CollecTor's bridge descriptor sanitizer. Zoossh is probably not updated yet. ## Descriptor archiver: CollecTor The part of CollecTor that archives relay descriptors relies heavily on RSA identities and SHA-1 digests. This includes its implementation of the Tor directory protocol and its structure for storing fetched descriptors in tarballs. Another part of CollecTor that needs to be updated is the bridge descriptor sanitizer. That is already done to the extent of sanitizing ed25519-related descriptor lines. The part that is not updated yet is the tarball structure that still uses SHA-1 digests. ## Network health checkers: DocTor, DepicTor Network health checkers like DocTor and DepicTor use relay fingerprints, but they focus more on network consensus meta data provided by the directory authorities. Updating to ed25519 identities shouldn't be hard. ## Statistics portal: Metrics Most of the data-aggregating modules behind the Metrics website use RSA identities to ensure uniqueness of reported statistics. Switching to another fingerprint format or length should be doable, but will cause some effort. ## Relay address database: ExoneraTor The relay address database ExoneraTor only uses the RSA identity to ensure uniqueness of database entries and for display purposes. Supporting new identities should not be that difficult. ## Onionoo server and clients: Onionoo, Atlas, Globe, Compass, OnionTip, Roster The Onionoo server heavily depends on RSA fingerprints of relays and hashed RSA fingerprints of bridges, both internally and in its API. Supporting ed25519 identities in addition to RSA fingerprints would not be hard, but stopping to support RSA fingerprints will require rewriting major parts of Onionoo. Onionoo clients use the RSA fingerprint provided by the Onionoo server to uniquely identify relays and bridges. They will have to adapt to changes in Onionoo that would first support ed25519 identities and later stop supporting RSA fingerprints. This shouldn't be difficult. ## OONI It's unclear how much effort is needed to update OONI to support new ed25519 identities. ## Exit address scanners: TorDNSEL, TorBEL, Check TorDNSEL and its planned successor TorBEL include RSA identities in their output format. It might be sufficient to simply add ed25519 identities there and leave out RSA identities once they are not used anymore. Check will have to be updated to understand these new formats. [0] 1-1-1 task exchange: you get 1 minute to describe a task that would take somebody else roughly 1 hour and that they will do for you within 1 week (review a document, write some analysis code, fix a small bug, etc.; better come prepared to get the most out of this; give 1, take 1) -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 Comment: GPGTools - http://gpgtools.org iQEcBAEBAgAGBQJV7uf1AAoJEJD5dJfVqbCrBJUH/A78UIeNy5UIvctO6EjMp6KU XXeB7jxDoA9RmdhNV7v5MzhSCjblQLfG5tyLmeFV/opX+xG0fMvqFdUB9jupXccV HQXLjeSuNF4Tenayn3W49EUF/O75BHcfwe0fHzmV8KEIhPf66KQn6gNBFFnWr4S0 OfvoSWbIb9Wu7hCya4C7J69FVAhwXPH8JpgpSpKLFYSZWQo1aKbgVqBDKNe/lmrV UO04Ws/O04osG9WWX/HcZgSCfSaN68nBMllnu0yCTJY+fEqFruxYhAaZZV6tXIfG E66vZc2K3S6Rk/1nwHEkNeZKCfjyRG1LthzH28HdCEMzl1mdQhUPkJawNaQXoDM= =rXAd -----END PGP SIGNATURE-----

1 0

Re: [tor-dev] Proposal: Single onion services
by tordev123＠Safe-mail.net 05 Sep '15

05 Sep '15

-------- Original Message -------- From: John Brooks <john.brooks(a)dereferenced.net> To: tor-dev(a)lists.torproject.org Subject: Re: [tor-dev] Proposal: Single onion services Date: Fri, 4 Sep 2015 15:31:15 -0600 > tordev123(a)Safe-mail.net wrote: > > > Doesn't your proposal imply that you are turning all relays into > > exit-nodes lite? The last relay in the path will know what service you are > > connecting to (at least if that service is hosted with a unique relay), > > right? > > A single onion service operates its own server(s). These servers accept OR > connections like a relay does, but they aren’t required to be in the > consensus or to relay traffic. They are the servers listed in the > descriptor. Right, that's how I understood things. > A client connects by extending a circuit to the single onion server. This is > not the same as an exit connection: tor relays will extend circuits to > relays they don't know about, as long as the destination speaks the tor > protocol. It’s possible for any tor relay to be used as the last one before > the single onion server. > > If the single onion server isn’t also a tor relay, it’s possible for the > previous relay to guess the service you’re connecting to. That is a large part of my concern. > This isn’t a risk > to client anonymity, because tor clients will always choose the first three > hops in a circuit before extending to one they didn’t choose. I'm not concerned about clients. > The final circuit looks like: > > Client -> Guard -> Middle -> Middle -> Single Onion > > The client’s traffic is encrypted through to the single onion server as > well. IMO, the second Middle relay can be considered serving as an exit with regards to Single Onion services - that's what I meant with 'exit node lite'. There was the case of an Austrian exit node operator getting prosecuted. It will sometimes be possible to attribute traffic relating to specific transactions to the second Middle node in the path (e.g. when the single onion server keeps detailed logs). So the circumstances of that case could apply to a non-exit relay operator as well. Your proposal is shifting non-exit relays towards performing a role that can be considered exit-like, even if that role is much more limited than normal exits (and there is an additional Tor protocol layer involved).

2 1