- tor-dev - lists.torproject.org

basket: More eggs in the Guard basket.
by Yawning Angel 17 Dec '14

17 Dec '14

Hi all, For several reasons I've been working on a bit of code that I named "basket". It's almost at the point where the brave members of the general public should be aware that it exists as a potential option in the privacy toolbox, though using it in any capacity beyond testing on a loopback device IS CURRENTLY ACTIVELY DISCOURAGED unless users are comfortable debugging it (This means, DO NOT USE IT. I will likely break backward compatibility in the future, and you will be sad.). "basket" is my stab at designing something that significantly increases Tor's resistance to upcoming/future attacks, by providing a link layer cryptographic handshake that uses post-quantum cryptographic primitives and defenses against website fingerprinting (and possibly e2e correlation) attacks. For the ease of development it is in the form of a pluggable transport with the expected tradeoffs (you must absolutely trust your Bridge, since both features only run to the Bridge). It is worth noting that it is anything but subtle, and it is blatantly obvious that a given connection is speaking "basket" as no attempt was made to obfuscate the handshake. The link layer handshake works roughly like thus: Setup: * Bob generates a long term SPHINCS256 keypair s,S used to sign responses. The handshake: 1. Alice generates a Curve25519 keypair x,X and a NTRUEncrypt EES1171EP1 keypair n,N. 2. Alice sends X | N to Bob. 3. Bob generates a Curve25519 keypair y,Y, and calculates Curve25519(y,X) as the shared secret. 4. Bob sends NTRUEncrypt(N,Y) | S | SPHINCS256(s, ntru_ciphertext | S) to Alice. 5. Alice verifies the SPHINCS256 signature (Alice's copy of S is saved/trusted in a Trust-On-First-Use manner), and decrypts the NTRU ciphertext to obtain Y. 6. Alice calculates Curve25519(x,Y) as the shared secret. NB: Some details omitted for brevity. Passive attackers see Alice's Curve25519 public key, Alice's NTRUEncrypt public key, Bob's SPHINCS256 public key, a NTRUEncrypt ciphertext, and SPHINCS256 signature. Obtaining the link's ephemeral session key requires decrypting the NTRUEncrypt ciphertext (to obtain Bob's Curve25519 public key), and reversing the scalar base multiply on one of X and Y. Active man-in-the-middle attackers need to be able to forge SPHINCS256 signatures to substitute their own NTRUEncrypt-ed payload to mount an attack (Alice's request is also validated/protected but it's one of the details omitted, read the code). As NTRUEncrypt is patent encumbered, there also is a handshake mode that removes the experimental post-quantum cryptography and uses Ed25519/Curve25519. The fingerprinting defenses are in the form of the CS-BuFLO algorithm in CTST (Client total, Server total) mode, without the application level hinting based optimizations to reduce bandwidth consumption (See: http://www3.cs.stonybrook.edu/~rob/papers/csbuflo.pdf) As a minor implementation refinement, "basket" uses the kernel information as described in the KIST paper to be more responsive to changing network conditions. Most of the CS-BuFLO parameters were adjusted in an attempt to compensate for the lack of said application level hinting, but "basket"'s CS-BuFLO implementation is still a lot more expensive than the one presented in the paper. The code: http://github.com/yawning/basket Notes: * The PQ crypto primitives used are ports to Go by yours truly based on the reference implementations. It is both possible and likely that I messed something up, so users should decide between trusting my implementations and using a handshake based on classical algorithms. * The "basket" handshake consumes a non-trivial amount of CPU on the server side due to the SPHINCS256 implementation being relatively unoptimized. * CS-BuFLO is EXTREMELY BANDWIDTH INTENSIVE, and if adversaries can observe the Bridge's upstream, it likely can be broken, especially if the Bridge is only servicing a handful of users. Running the defense end-to-end (or even to the middle relay) is *extremely* non-trivial, though that would be required if something more comprehensive is desired. * The KIST code is platform specific, and I only wrote the Linux version. If this ends up being useful to people, support for other platforms is possible. * "basket" was never written to be a general use transport, though it sits somewhere between obfsproxy-wfpadtools (a pure research framework) and obfs4proxy (something that is intended to be used in production) in terms of completeness. Thanks to Marc Juarez (KU Leuven) and Mike Perry for inspiration to write the CS-BuFLO component of "basket". Questions, comments, feedback appreciated as always, -- Yawning Angel ps: Seriously, unless you are a developer or researcher, you REALLY SHOULD NOT use "basket".

2 2

TOR C# application
by Hollow Quincy 17 Dec '14

17 Dec '14

Hi all, I would like to write a C# application (IRC client) that is using TOR. I read a lot, but I still don't know how can I run TOR proxy in transparent way (from my c# code). I see that Tor Stem (https://stem.torproject.org/) can be used by Python code or there are packages for Linux, but not C# (.NET). How can I run Tor proxy from C# ? Is there a library (dll) that I can run ? (without need to have open Tor Bundle browser). Thanks for help

4 3

TOR C# application
by Hollow Quincy 16 Dec '14

16 Dec '14

[...] > install TOR client(Not Browser Bundle) and run it. Then socks port will > open and you can connect from your program through TCP. Could you please answer me more clearly ? I read description of all TOR projects: https://www.torproject.org/projects/projects "Stem" project looks nice for me, but it is in python. I would like something in C#, dll library or command line tool. But there is no "TOR client" project.. What do you mean by "TOR client" ?

2 1

Pluggable transports meeting tomorrow (16:00UTC Wednesday 17th of December 2014)
by Yawning Angel 16 Dec '14

16 Dec '14

Hello! Just wanted to remind you that the regular biweekly pluggable transports meeting is going to occur tomorrow at 16:00 UTC. Place is the #tor-dev IRC channel in the OFTC network. Thanks for your attention! -- Yawning Angel

1 0

TOR C# application
by Hollow Quincy 16 Dec '14

16 Dec '14

>> Hi all, >> >> I would like to write a C# application (IRC client) that is using TOR. >> I read a lot, but I still don't know how can I run TOR proxy in >> transparent way (from my c# code). >> >> I see that Tor Stem (https://stem.torproject.org/) can be used by >> Python code or there are packages for Linux, but not C# (.NET). >> >> How can I run Tor proxy from C# ? Is there a library (dll) that I can >> run ? (without need to have open Tor Bundle browser). > >Let your application start a 'private' Tor node and connect your program >using SOCKS to it. Could you please give me a hint how to do that ? Should I use some library ? or can I find it in Tor Browser Bundle ? (Remember that I would like to do it in background) Thanks for help

2 1

Tor bridge reachability timeline being updated?
by David Fifield 16 Dec '14

16 Dec '14

Arturo, I really like http://reports.ooni.nu/analytics/bridge_reachability/timeline/. Is it still being updated? Are updates going to a different place? What does it take to add obfs4 support? As obfs4 is about to be introduced, it would be great to have reachability measurements from a variety of vantage points from the very beginning. David Fifield

2 1

A Tor document parser implemented in Go
by Philipp Winter 16 Dec '14

16 Dec '14

I have started working on a project to detect sybils and other anomalies in the Tor network. Once the algorithms are implemented, I want to run them over historical data. While Stem is great, it's implemented in an interpreted language which makes it a little bit too slow for my needs. As a result, I started working on a simple parser implemented in Go: <https://gitweb.torproject.org/user/phw/zoossh.git/> Here's a mirror on GitHub: <https://github.com/NullHypothesis/zoossh> At the moment, the parser partially supports historical network consensuses and router descriptors as archived by CollecTor. I hope to be able to add more file formats soon. Also, the API is not yet stable, so it's not wise to use it just yet. However, I wanted folks to know that I'm working on that and I'm always happy to get feedback and patches. Cheers, Philipp

1 0

Reminder for weekly OONI dev meeting Monday 2014-12-15 18:00 UTC (19:00 CET)
by Arturo Filastò 15 Dec '14

15 Dec '14

Hi, This is a reminder that today there will be the weekly OONI meeting. It will happen as usual on the #ooni channel on irc.oftc.net at 18:00 UTC (19:00 CET, 13:00 EST, 10:00 PST). Everybody is welcome to join us and bring their questions and feedback. See you later, ~ Arturo

1 0

Proposal draft: Better hidden service stats from Tor relays
by George Kadianakis 14 Dec '14

14 Dec '14

Hello there, I inline a copy of a proposal we've been working on lately. Discussion can be found in the "Feedback on obfuscating hidden-service statistics" thread. The proposal suggests that Tor relays add some stats about hidden service usage. We believe that these stats are not dangerous and can be useful to Tor developers and to people who want to understand hidden services and the onionspace better. Any feedback is appreciated :) ====== Filename: 238-hs-relay-stats.txt Title: Better hidden service stats from Tor relays Author: George Kadianakis, David Goulet, Karsten Loesing, Aaron Johnson Created: 2014-11-17 Status: Draft 0. Motivation Hidden Services is one of the least understood parts of the Tor network. We don't really know how many hidden services there are and how much they are used. This proposal suggests that Tor relays include some hidden service related stats to their extra info descriptors. No stats are collected from Tor hidden services or clients. While uncertainty might be a good thing in a hidden network, learning more information about the usage of hidden services can be helpful. For example, learning how many cells are sent for hidden service purposes tells us whether hidden service traffic is 2% of the Tor network traffic or 90% of the Tor network traffic. This info can also help us during load balancing, for example if we change the path building of hidden services to mitigate guard discovery attacks [0]. Also, learning the number of hidden services, can give us an understanding of how widespread hidden services are. It will also help us understand approximately how much load is put in the network by hidden service logistics, like introduction point circuits etc. 1. Design Tor relays will add some fields related to hidden service statistics in their extra-info descriptors. Tor relays collect these statistics by keeping track of their hidden service directory or rendezvous point activities, slightly obfuscating the numbers and posting them to the directory authorities. Extra-info descriptors are posted to directory authorities every 24 hours. 2. Implementation 2.1. Hidden service statistics interval We want relays to report hidden-service statistics over a long-enough time period to not put users at risk. Similar to other statistics, we suggest a 24-hour statistics interval. All related statistics are collected at the end of that interval and included in the next extra-info descriptors published by the relay. Tor relays will add the following line to their extra-info descriptor: "hidserv-stats-end" YYYY-MM-DD HH:MM:SS (NSEC s) NL [At most once.] YYYY-MM-DD HH:MM:SS defines the end of the included measurement interval of length NSEC seconds (86400 seconds by default). A "hidserv-stats-end" line, as well as any other "hidserv-*" line, is first added after the relay has been running for at least 24 hours. 2.2. Hidden service traffic statistics We want to learn how much of the total Tor network traffic is caused by hidden service usage. There are three phases in the rendezvous protocol where traffic is generated: (1) when hidden services make themselves available in the network, (2) when clients open connections to hidden services, and (3) when clients exchange application data with hidden services. We expect (3) to consume most bytes here, so we're focusing on this only. More precisely, we measure hidden service traffic by counting RELAY cells seen on a rendezvous point after receiving a RENDEZVOUS1 cell. These RELAY cells include commands to open or close application streams, and they include application data. Tor relays will add the following line to their extra-info descriptor: "hidserv-rend-relayed-cells" SP num NL [At most once.] Approximate number of RELAY cells seen in either direction on a circuit after receiving and successfully processing a RENDEZVOUS1 cell. The actual number observed by the directory is multiplied with a random number in [0.9, 1.1] and then gets floored before being reported. The keyword indicates that this line is part of hidden-service statistics ("hidserv") and contains aggregate data from the relay acting as rendezvous point ("rend"). 2.3. HSDir hidden service counting We also want to learn how many hidden services exist in the network. The best place to learn this is at hidden service directories where hidden services publish their descriptors. Tor relays will add the following line to their extra-info descriptor: "hidserv-dir-published-ids" SP num NL [At most once.] Approximate number of unique hidden-service identities seen in descriptors published to and accepted by this hidden-service directory. The actual number observed by the directory is multiplied with a random number in [0.9, 1.1] and then gets floored before being reported. This statistic requires keeping a separate data structure with unique identities seen during the current statistics interval. We could, in theory, have relays iterate over their descriptor caches when producing the daily hidden-service statistics blurb. But it's unclear how caching would affect results from such an approach, because descriptors published at the start of the current statistics interval could already have been removed, and descriptors published in the last statistics interval could still be present. Keeping a separate data structure, possibly even a probabilistic one, seems like the more accurate approach. 3. Security The main security considerations that need discussion are what an adversary could do with reported statistics that they couldn't do without them. In the following, we're going through things the adversary could learn, how plausible that is, and how much we care. (All these things refer to hidden-service traffic, not to hidden-service counting. We should think about the latter, too.) 3.1. Identify rendezvous point of high-volume and long-lived connection The adversary could identify the rendezvous point of a very large and very long-lived HS connection by observing a relay with unexpectedly large relay cell count. 3.2. Identify number of users of a hidden service The adversary may be able to identify the number of users of an HS if he knows the amount of traffic on a connection to that HS (which he potentially can determine himself) and knows when that service goes up or down. He can look at the change in the total reported RP traffic to determine about how many fewer HS users there are when that HS is down. 4. Discussion 4.1. Why count only RP cells? Why not also count IP cells? As discussed on IRC, counting only RP cells should be fine for now. Everything else is protocol overhead, which includes HSDir traffic, introduction point traffic, or rendezvous point traffic before the first RELAY cell, etc. Furthermore, introduction points correspond to specific HSes, so publishing IP cell stats could reveal the popularity of specific HSes. 4.2. How to use these stats? 4.2.1. How to use RP Cell statistics We plan to extrapolate reported values to network totals by dividing values by the probability of clients picking relays as rendezvous point. This approach should become more precise on faster relays and the more relays report these statistics. We also plan to compare reported values with "cell-*" statistics to learn what fraction of traffic can be attributed to hidden services. Ideally, we'd be able to compare values to "write-history" and "read-history" lines to compute similar fractions of traffic used for hidden services. The goal would be to avoid enabling "cell-*" statistics by default. In order for this to work we'll have to multiply reported cell numbers with the default cell size of 512 bytes (we cannot infer the actual number of bytes, because cells are end-to-end encrypted between client and service). 4.2.2. How to use HSDir HS statistics We plan to extrapolate this value to network totals by calculating what fraction of hidden-service identities this relay was supposed to see. This extrapolation will be very rough, because each hidden-service directory is only responsible for a tiny share of hidden-service descriptors, and there is no way to increase that share significantly. Here are some numbers: there are about 3000 directories, and each descriptor is stored on three directories. So, each directory is responsible for roughly 1/1000 of descriptor identifiers. There are two replicas for each descriptor (that is, each descriptor is stored under two descriptor identifiers), and descriptor identifiers change once per day (which means that, during a 24-hour period, there are two opportunities for each directory to see a descriptor). Hence, each descriptor is stored to four places in identifier space throughout a 24-hour period. The probability of any given directory to see a given hidden-service identity is 1-(1-1/1000)^4 = 0.00399 = 1/250. This approximation constitutes an upper threshold, because it assumes that services are running all day. An extrapolation based on this formula will lead to undercounting the total number of hidden services. A possible inaccuracy in the estimation algorithm comes from the fact that a relay may not be acting as hidden-service directory during the full statistics interval. We'll have to look at consensuses to determine when the relay first received the "HSDir" flag, and only consider the part of the statistics interval following the valid-after time of that consensus. 4.3. Multiplicative or additive noise? A possible alternative to multiplying the number of cells with a random factor is to introduce additive noise. Let's suppose that we would like to obscure any individual connection that contains C cells or fewer (obscuring extremely and unusually large connections seems hopeless but unnecessary). That is, we don't want the (distribution of) the cell count from any relay to change by much whether or not C cells are removed. The standard differential privacy approach would be to *add* noise from the Laplace distribution Lap(\epsilon/C), where \epsilon controls how much the statistics *distribution* can multiplicatively differ. This is not to say that we need to add noise exactly from that distribution (maybe we weaken the guarantee slightly to get better accuracy), but the same idea applies. This would apply the same to both large and small relays. We *want* to learn roughly how much hidden-service traffic each relay has - we just want to obscure the exact number within some tolerance. We'll probably want to include the algorithm and parameters used for adding noise in the "hidserv-rend-relayed-cells" line, as in, "lap=x" with x being \epsilon/C. [0]: guard discovery: https://lists.torproject.org/pipermail/tor-dev/2014-September/007474.html

3 12

Call for Papers: Switzerland - International Conference on Semantic Web Business and Innovation (SWBI2015)
by ANNOUNCEMENT 12 Dec '14

12 Dec '14

The International Conference on Semantic Web Business and Innovation (SWBI2015) The University of Applied Sciences and Arts Western Switzerland (HES-SO Valais-Wallis) October 7-9, 2015 http://sdiwc.net/conferences/swbi2015/ All registered papers will be included in SDIWC Digital Library ================================================================ The proposed conference on the above theme will be held at he University of Applied Sciences and Arts Western Switzerland (HES-SO Valais-Wallis) on October 7-9, 2015 which aims to enable researchers build connections between different digital applications. The conference welcomes papers on the following (but not limited to) research topics: *Semantic Web and Linked Data - Database, IR, NLP and AI technologies for the Semantic Web - Geospatial Semantic Web - Information Extraction from unstructured data - Information visualization of Semantic Web data and Linked Data - Internet of things - Languages, tools, and methodologies for representing and managing Semantic Web data - Linked open data - Management of Semantic Web data and Linked Data - Ontology engineering and ontology patterns for the Semantic Web - Ontology modularity, mapping, merging, and alignment - Ontology-based data access - Privacy and Security - Query and inference over data streams - Search, query, integration, and analysis on the Semantic Web - Semantic business process management - Semantic Sensor networks - Semantic technologies for mobile platforms - Semantic Web and Linked Data for Cloud Environments - Semantic Web, Ontologies - Social networks and processes on the Semantic Web - Supporting multi-linguality in the Semantic Web - User Interfaces and interacting with Semantic Web data and Linked Data *Business and Innovation in Semantic Web - Business Model Innovation - Business Models and E-Commerce - Business Technology Intelligence - Challenges for change in semantic services - Collaborative improvement and innovation - E-Business Applications and Software - E-commerce Technology Adoption - E-commerce, E-Business Strategies - E-tailing and Multi-Channel selling - Evolution of Business model for Semantic Web Applications - High-tech marketing - Implementation strategies for responsible innovation - Innovation for E-Business - Innovative methods and tools for products and services - Practices and Cases in E-Commerce - Production of Knowledge Economy - Technology and Business Transformation - Technology strategies - The Latest Trends in Linked Data - Web Advertising and Web Publishing - Web and Mobile Applications Researchers are encouraged to submit their work electronically. All papers will be fully refereed by a minimum of two specialized referees. Before final acceptance, all referees comments must be considered. Important Dates ============== Submission Date: Open from now until Sept. 1, 2015 Notification of Acceptance: 6 weeks from the submission date Camera Ready Submission: September 14, 2015 Registration Deadline: September 14, 2015 Conference Dates: October 7-9, 2015

1 0