- tor-dev - lists.torproject.org

Regarding involvement in organisation project for GSOC 2015
by dp docs 19 Dec '14

19 Dec '14

Dear Sir, I am a research student. I have good skills in languages c/c++,python. I want to participate in GSOC 2015 by taking a project from your organisation. please help me how should I start so that i will surely be able to participate in GSOC 2015 from your organisation. Please provide the mentor's email id so that I can contact them. It would be very much helpful for me if you are responding this mail. Moreover,i have tried to connect to #tor-dev IRC channel but it was showing that "you are banned". please help regaridng this too. please respond ASAP so that I can start working in a significant way. Thanks Durgesh Pandey.

4 4

Suggestions for Projects
by Abhiram Chintangal 18 Dec '14

18 Dec '14

Hello, I am a student and I am thinking of getting myself more involved in the tor project over the winter break. Previously, I worked briefly on the tor-weather rewrite project which eventually turned into an gsoc project in March 2014. Are there any projects that are in need of a volunteer? I am well versed in C, Python and Java (Android). Cheers! -- Abhiram Chintangal

4 3

basket: More eggs in the Guard basket.
by Yawning Angel 17 Dec '14

17 Dec '14

Hi all, For several reasons I've been working on a bit of code that I named "basket". It's almost at the point where the brave members of the general public should be aware that it exists as a potential option in the privacy toolbox, though using it in any capacity beyond testing on a loopback device IS CURRENTLY ACTIVELY DISCOURAGED unless users are comfortable debugging it (This means, DO NOT USE IT. I will likely break backward compatibility in the future, and you will be sad.). "basket" is my stab at designing something that significantly increases Tor's resistance to upcoming/future attacks, by providing a link layer cryptographic handshake that uses post-quantum cryptographic primitives and defenses against website fingerprinting (and possibly e2e correlation) attacks. For the ease of development it is in the form of a pluggable transport with the expected tradeoffs (you must absolutely trust your Bridge, since both features only run to the Bridge). It is worth noting that it is anything but subtle, and it is blatantly obvious that a given connection is speaking "basket" as no attempt was made to obfuscate the handshake. The link layer handshake works roughly like thus: Setup: * Bob generates a long term SPHINCS256 keypair s,S used to sign responses. The handshake: 1. Alice generates a Curve25519 keypair x,X and a NTRUEncrypt EES1171EP1 keypair n,N. 2. Alice sends X | N to Bob. 3. Bob generates a Curve25519 keypair y,Y, and calculates Curve25519(y,X) as the shared secret. 4. Bob sends NTRUEncrypt(N,Y) | S | SPHINCS256(s, ntru_ciphertext | S) to Alice. 5. Alice verifies the SPHINCS256 signature (Alice's copy of S is saved/trusted in a Trust-On-First-Use manner), and decrypts the NTRU ciphertext to obtain Y. 6. Alice calculates Curve25519(x,Y) as the shared secret. NB: Some details omitted for brevity. Passive attackers see Alice's Curve25519 public key, Alice's NTRUEncrypt public key, Bob's SPHINCS256 public key, a NTRUEncrypt ciphertext, and SPHINCS256 signature. Obtaining the link's ephemeral session key requires decrypting the NTRUEncrypt ciphertext (to obtain Bob's Curve25519 public key), and reversing the scalar base multiply on one of X and Y. Active man-in-the-middle attackers need to be able to forge SPHINCS256 signatures to substitute their own NTRUEncrypt-ed payload to mount an attack (Alice's request is also validated/protected but it's one of the details omitted, read the code). As NTRUEncrypt is patent encumbered, there also is a handshake mode that removes the experimental post-quantum cryptography and uses Ed25519/Curve25519. The fingerprinting defenses are in the form of the CS-BuFLO algorithm in CTST (Client total, Server total) mode, without the application level hinting based optimizations to reduce bandwidth consumption (See: http://www3.cs.stonybrook.edu/~rob/papers/csbuflo.pdf) As a minor implementation refinement, "basket" uses the kernel information as described in the KIST paper to be more responsive to changing network conditions. Most of the CS-BuFLO parameters were adjusted in an attempt to compensate for the lack of said application level hinting, but "basket"'s CS-BuFLO implementation is still a lot more expensive than the one presented in the paper. The code: http://github.com/yawning/basket Notes: * The PQ crypto primitives used are ports to Go by yours truly based on the reference implementations. It is both possible and likely that I messed something up, so users should decide between trusting my implementations and using a handshake based on classical algorithms. * The "basket" handshake consumes a non-trivial amount of CPU on the server side due to the SPHINCS256 implementation being relatively unoptimized. * CS-BuFLO is EXTREMELY BANDWIDTH INTENSIVE, and if adversaries can observe the Bridge's upstream, it likely can be broken, especially if the Bridge is only servicing a handful of users. Running the defense end-to-end (or even to the middle relay) is *extremely* non-trivial, though that would be required if something more comprehensive is desired. * The KIST code is platform specific, and I only wrote the Linux version. If this ends up being useful to people, support for other platforms is possible. * "basket" was never written to be a general use transport, though it sits somewhere between obfsproxy-wfpadtools (a pure research framework) and obfs4proxy (something that is intended to be used in production) in terms of completeness. Thanks to Marc Juarez (KU Leuven) and Mike Perry for inspiration to write the CS-BuFLO component of "basket". Questions, comments, feedback appreciated as always, -- Yawning Angel ps: Seriously, unless you are a developer or researcher, you REALLY SHOULD NOT use "basket".

2 2

TOR C# application
by Hollow Quincy 17 Dec '14

17 Dec '14

Hi all, I would like to write a C# application (IRC client) that is using TOR. I read a lot, but I still don't know how can I run TOR proxy in transparent way (from my c# code). I see that Tor Stem (https://stem.torproject.org/) can be used by Python code or there are packages for Linux, but not C# (.NET). How can I run Tor proxy from C# ? Is there a library (dll) that I can run ? (without need to have open Tor Bundle browser). Thanks for help

4 3

TOR C# application
by Hollow Quincy 16 Dec '14

16 Dec '14

[...] > install TOR client(Not Browser Bundle) and run it. Then socks port will > open and you can connect from your program through TCP. Could you please answer me more clearly ? I read description of all TOR projects: https://www.torproject.org/projects/projects "Stem" project looks nice for me, but it is in python. I would like something in C#, dll library or command line tool. But there is no "TOR client" project.. What do you mean by "TOR client" ?

2 1

Pluggable transports meeting tomorrow (16:00UTC Wednesday 17th of December 2014)
by Yawning Angel 16 Dec '14

16 Dec '14

Hello! Just wanted to remind you that the regular biweekly pluggable transports meeting is going to occur tomorrow at 16:00 UTC. Place is the #tor-dev IRC channel in the OFTC network. Thanks for your attention! -- Yawning Angel

1 0

TOR C# application
by Hollow Quincy 16 Dec '14

16 Dec '14

>> Hi all, >> >> I would like to write a C# application (IRC client) that is using TOR. >> I read a lot, but I still don't know how can I run TOR proxy in >> transparent way (from my c# code). >> >> I see that Tor Stem (https://stem.torproject.org/) can be used by >> Python code or there are packages for Linux, but not C# (.NET). >> >> How can I run Tor proxy from C# ? Is there a library (dll) that I can >> run ? (without need to have open Tor Bundle browser). > >Let your application start a 'private' Tor node and connect your program >using SOCKS to it. Could you please give me a hint how to do that ? Should I use some library ? or can I find it in Tor Browser Bundle ? (Remember that I would like to do it in background) Thanks for help

2 1

Tor bridge reachability timeline being updated?
by David Fifield 16 Dec '14

16 Dec '14

Arturo, I really like http://reports.ooni.nu/analytics/bridge_reachability/timeline/. Is it still being updated? Are updates going to a different place? What does it take to add obfs4 support? As obfs4 is about to be introduced, it would be great to have reachability measurements from a variety of vantage points from the very beginning. David Fifield

2 1

A Tor document parser implemented in Go
by Philipp Winter 16 Dec '14

16 Dec '14

I have started working on a project to detect sybils and other anomalies in the Tor network. Once the algorithms are implemented, I want to run them over historical data. While Stem is great, it's implemented in an interpreted language which makes it a little bit too slow for my needs. As a result, I started working on a simple parser implemented in Go: <https://gitweb.torproject.org/user/phw/zoossh.git/> Here's a mirror on GitHub: <https://github.com/NullHypothesis/zoossh> At the moment, the parser partially supports historical network consensuses and router descriptors as archived by CollecTor. I hope to be able to add more file formats soon. Also, the API is not yet stable, so it's not wise to use it just yet. However, I wanted folks to know that I'm working on that and I'm always happy to get feedback and patches. Cheers, Philipp

1 0

Reminder for weekly OONI dev meeting Monday 2014-12-15 18:00 UTC (19:00 CET)
by Arturo Filastò 15 Dec '14

15 Dec '14

Hi, This is a reminder that today there will be the weekly OONI meeting. It will happen as usual on the #ooni channel on irc.oftc.net at 18:00 UTC (19:00 CET, 13:00 EST, 10:00 PST). Everybody is welcome to join us and bring their questions and feedback. See you later, ~ Arturo

1 0