- tor-dev - lists.torproject.org

Re: [tor-dev] Proposal 198: Restore semantics of TLS ClientHello
by Jacob Appelbaum 21 Mar '12

21 Mar '12

On 03/20/2012 09:08 PM, Nick Mathewson wrote: > On Tue, Mar 20, 2012 at 11:57 PM, Jacob Appelbaum <jacob(a)appelbaum.net> wrote: > [...] >> Ah ha. That sounds like a nightmare. Is there a bug report we can pile >> on to request that they don't create a headache for everyone in the future? > > There is, but I don't currently see much point: their developers are > irritated, and know that other developers are irritated, and believe > that they can't take any … [View More]actual action without word from their legal > department. > We can provide packages for users or a spec file for their users as an alternative, I guess? I think generally we're already doing this by providing the Tor Browser but all users with system tors are going to be left out... >>>> It seems that our integration with >>>> platforms is really heading in a bad direction. I'd like to figure out >>>> how to not diverge entirely and if possible to fix or document the issues. >>> >>> I don't know what you mean by "diverge" here -- do you mean that >>> different platforms may advertise different ciphers based on their >>> version of OpenSSL or whether their legal department fears ECC? If >>> so, then all non-Tor OpenSSL applications running on those hosts >>> already leak this information. >> >> I mean - Tor's cipher suite advertisement will be really wacky, >> basically on a platform by platform basis, version by version basis. >> What we expect to say about tor's fingerprint is less and less easy to >> say concisely, or perhaps it's easy but has a few variants? It seems >> like we'll have to track it more closely, perhaps by sniffing network >> traces on a per OS basis? > > It should be fairly easy to notice what ciphers we are really > advertising, and warn when it isn't the list we want to advertise. > Sure, it's just a simple matter of programming. ;-) > What we can expect to say about the fingerprint will be: "If you have > a default build of OpenSSL 1.0.0 or later, then you will look like > Firefox 8+ (modulo other issues not related to ciphersuites). If you > have an ECC-disabled build of OpenSSL 1.0.0 or later, then you will > look like FF8+ with all the ECC turned off. (I am pretty sure that > Fedora does indeed turn off the ECC in the Firefox they ship.) > Otherwise, if you have a really weird OpenSSL build, or an older > version of OpenSSL, your fingerprint will be weird." > I think that's a lot of stuff to say - we'll probably want to keep track of our various fingerprints somewhere - a bug or the wiki, perhaps? > [...] >> My thought was as follows - we have a >> pt_client{many-cipher-suites-support} that can be made to impersonate >> many browsers, it can try to connect to either relays which it can thus >> become Firefox without issue or to a bridge with this >> pt_server{many-cipher-suites-support} support and so it can pretend to >> be nearly anything. I probably should have made that suggestion more >> explicit. >> >> But yes, I agree, unless we can make the servers support the required >> ciphers, I think we're doomed. I didn't miss that, I was just trying to >> suggest a hack whereby we can impersonate IE as a pluggable transport. >> >> I've wondered for a while about cipher suites, specifically, why can't >> we just lie on the wire and then internally map ciphers as we like? For >> example - our client sends ECDHE but our server understands this is us >> trying as a client to impersonate IE and maps that to some other forward >> secret cipher suite like TLS_DHE_RSA_WITH_AES_128_SHA? I'm sure it's a >> TLS nightmare but, I guess it feels like we're heading there anyway...? > > Actually, we are heading AWAY from the TLS nightmare. That's the point > of this proposal: to minimize our use of ClientHello ciphersuite > fakery, so that the TLS ciphersuite negotiation handshake can > eventually just work again. > Well, OK, I think I understand that. Sorta. I agree that it is a step in the right direction but I do think it's a nightmare unless we have some way to basically make tor perform uniformly without us tracking things. Basically, we can impersonate a few browsers on the client side but the relays limit our ability to impersonate properly. It seems like a lot of stuff to keep track up, I already want a lookup table to know which version of tor, which version of openssl, which platform, etc to know what my handshake looks like and so on. It's not that complicated, it's just complicated enough though... > The idea above wouldn't work in any straightforward way: It is easy to > tell a DHE handshake from an ECDHE handshake -- for example, by > looking at the group parameters, which are sent in the clear! -- so if > the server says that it picks one but then the server and the client > do another, that would be really easy to detect. Ok, I admit, I had no idea that the group parameters were sent in the clear - I agree, just hacking up the cipher suites isn't actually useful in that case. Argh! All the best, Jake [View Less]

1 0

Re: [tor-dev] Proposal 198: Restore semantics of TLS ClientHello
by Nick Mathewson 21 Mar '12

21 Mar '12

Jacob sent me this message in reply to my last; sending to tor-dev with permission. On Tue, Mar 20, 2012 at 11:57 PM, Jacob Appelbaum <jacob(a)appelbaum.net> wrote: > On 03/20/2012 08:14 PM, Nick Mathewson wrote: >> On Tue, Mar 20, 2012 at 9:30 PM, Jacob Appelbaum <jacob(a)appelbaum.net> wrote: >>> On 03/20/2012 08:33 AM, Nick Mathewson wrote: >>>> Filename: 198-restore-clienthello-semantics.txt >>>> Title: Restore semantics of TLS … [View More]ClientHello >>>> Author: Nick Mathewson >>>> Created: 19-Mar-2012 >>>> Status: Open >>>> >>> >>> [ ... ] >>> >>> >>>> Currently, OpenSSL 1.0.0 (in its default configuration) supports every >>>> cipher that we would need in order to give the same list as Firefox >>>> versions 8 through 11 give in their default configuration, with the >>>> exception of the FIPS ciphersuite above. Therefore, we will be able >>>> to fake the new ciphersuite list correctly in all of our bundles that >>>> include OpenSSL, and on every version of Unix that keeps up-to-date. >>>> >>>> However, versions of Tor compiled to use older versions of OpenSSL, or >>>> versions of OpenSSL with some ciphersuites disabled, will no >>>> longer give the same ciphersuite lists as other versions of Tor. On >>>> these platforms, Tor clients will no longer impersonate Firefox. >>>> Users who need to do so will have to download one of our bundles, or >>>> use a (non-system) OpenSSL. >>>> >>> >>> What platforms have this issue? >> >> The ones that don't have OpenSSL 1.0.0, and the ones that turn off >> some of the relevant ciphersuites in OpenSSL 1.0.0. > > > Sure, I understand the pre-OpenSSL 1.0.0 issue - I mostly wondered what > platforms don't support the relevant ciphersuites in their builds of > OpenSSL 1.0.0. We should either 0) file bug reports 1) offer packages > that fix the issue or 2) something else such as ignoring it and simply > tracking the issues. > >> >> With time, the number of platforms that don't ship 1.0.0 or later will >> fall. Furthermore, we can support them just fine with a TBB that >> includes OpenSSL. >> > > Sure. That makes sense. The main downside is that TBB is a UX nightmare. > It works OK for browsing and basically everything else becomes ten times > the nightmare. > >> To the best of my knowledge, Fedora is the only major OS that ships >> OpenSSL and turns off any of the ciphersuites we care about, though >> there could be more. Last I heard, their legal department were >> reviewing that decision. >> > > Ah ha. That sounds like a nightmare. Is there a bug report we can pile > on to request that they don't create a headache for everyone in the future? > >>> It seems that our integration with >>> platforms is really heading in a bad direction. I'd like to figure out >>> how to not diverge entirely and if possible to fix or document the issues. >> >> I don't know what you mean by "diverge" here -- do you mean that >> different platforms may advertise different ciphers based on their >> version of OpenSSL or whether their legal department fears ECC? If >> so, then all non-Tor OpenSSL applications running on those hosts >> already leak this information. > > I mean - Tor's cipher suite advertisement will be really wacky, > basically on a platform by platform basis, version by version basis. > What we expect to say about tor's fingerprint is less and less easy to > say concisely, or perhaps it's easy but has a few variants? It seems > like we'll have to track it more closely, perhaps by sniffing network > traces on a per OS basis? >> >> But in any case, I think that the damage is self-healing (as people >> upgrade to OpenSSL 1.0.0) and the alternative of being stuck on our >> current ciphersuites forever is worse. >> > > Ok. That I find pretty convincing. > >>>> Open questions: >>>> >>>> Should the client drop connections if the server chooses a bad >>>> cipher, or a suite without forward secrecy? >>>> >>> >>> I think so. Do we have any relays that do not currently support forward >>> secrecy? >> >> No. >> > > Ok. > >> The question is, what should a client do if the relay selects, say, >> TLS_RSA_AES_128_CBC_SHA1 (ciphersuite name may not be exact). If it >> drops the connection immediately, that might be unusual behavior. >> Some other behavior might be smarter: perhaps it should pause for a >> while, then drop. Or perhaps it should send a little junk data then >> drop. I'm not sure there, though. > > Ah. What does s_client do if that selected cipher is not supported? When > in doubt, I often just punt and do what s_client does... > >> >> [...] >>>> Can we do anything to eventually allow the IE7+[**] cipher list as >>>> well? IE does not support TLS_DHE_RSA_WITH_AES_{256,128}_SHA or >>>> SSL_DHE_RSA_WITH_3DES_EDE_CBC_SHA, and so wouldn't work with current >>>> Tor servers, which _only_ support those. It looks like the only >>>> forward-secure ciphersuites that IE7+ *does* support are ECDHE ones, >>>> and DHE+DSS ones. So if we want this flexibility, we could mandate >>>> server-side ECDHE, or somehow get DHE+DSS support (which would play >>>> havoc with our current certificate generation code IIUC), or say that >>>> it is sometimes acceptable to have a non-forward-secure link >>>> protocol[***]. None of these answers seems like a great one. Is one >>>> best? Are there other options? >>>> >>> >>> This sounds like a job for pluggable transports! >>> >>> I think as long as the servers support as many ciphers as possible, we >>> can make simple pluggable transports that setup the cipher suites we >>> want to use - no? >> >> Pluggable transports feel out-of-scope for this proposal. But even if >> they are, I don't see how they answer my question: Because (as a >> given!) current servers do not support any of the forward-secure >> ciphers on the IE7 list, if we want to impersonate IE7 or later, we >> will be doing something that current servers cannot support. Whether >> this impersonation is done somehow as a plugin, or in Tor, it would >> still be something we needed to coordinate with the servers in >> question. >> > > My thought was as follows - we have a > pt_client{many-cipher-suites-support} that can be made to impersonate > many browsers, it can try to connect to either relays which it can thus > become Firefox without issue or to a bridge with this > pt_server{many-cipher-suites-support} support and so it can pretend to > be nearly anything. I probably should have made that suggestion more > explicit. > > But yes, I agree, unless we can make the servers support the required > ciphers, I think we're doomed. I didn't miss that, I was just trying to > suggest a hack whereby we can impersonate IE as a pluggable transport. > > I've wondered for a while about cipher suites, specifically, why can't > we just lie on the wire and then internally map ciphers as we like? For > example - our client sends ECDHE but our server understands this is us > trying as a client to impersonate IE and maps that to some other forward > secret cipher suite like TLS_DHE_RSA_WITH_AES_128_SHA? I'm sure it's a > TLS nightmare but, I guess it feels like we're heading there anyway...? > > (I'm sorry if this seems rambly, I've been pretty sick...) > > All the best, > Jake [View Less]

1 1

Re: [tor-dev] Proposal 198: Restore semantics of TLS ClientHello
by Nick Mathewson 21 Mar '12

21 Mar '12

Forgot to send this to tor-dev: ouch. Sending now. On Tue, Mar 20, 2012 at 9:30 PM, Jacob Appelbaum <jacob(a)appelbaum.net> wrote: > On 03/20/2012 08:33 AM, Nick Mathewson wrote: >> Filename: 198-restore-clienthello-semantics.txt >> Title: Restore semantics of TLS ClientHello >> Author: Nick Mathewson >> Created: 19-Mar-2012 >> Status: Open >> > > [ ... ] > > >> Currently, OpenSSL 1.0.0 (in its default configuration) supports … [View More]every >> cipher that we would need in order to give the same list as Firefox >> versions 8 through 11 give in their default configuration, with the >> exception of the FIPS ciphersuite above. Therefore, we will be able >> to fake the new ciphersuite list correctly in all of our bundles that >> include OpenSSL, and on every version of Unix that keeps up-to-date. >> >> However, versions of Tor compiled to use older versions of OpenSSL, or >> versions of OpenSSL with some ciphersuites disabled, will no >> longer give the same ciphersuite lists as other versions of Tor. On >> these platforms, Tor clients will no longer impersonate Firefox. >> Users who need to do so will have to download one of our bundles, or >> use a (non-system) OpenSSL. >> > > What platforms have this issue? The ones that don't have OpenSSL 1.0.0, and the ones that turn off some of the relevant ciphersuites in OpenSSL 1.0.0. With time, the number of platforms that don't ship 1.0.0 or later will fall. Furthermore, we can support them just fine with a TBB that includes OpenSSL. To the best of my knowledge, Fedora is the only major OS that ships OpenSSL and turns off any of the ciphersuites we care about, though there could be more. Last I heard, their legal department were reviewing that decision. > It seems that our integration with > platforms is really heading in a bad direction. I'd like to figure out > how to not diverge entirely and if possible to fix or document the issues. I don't know what you mean by "diverge" here -- do you mean that different platforms may advertise different ciphers based on their version of OpenSSL or whether their legal department fears ECC? If so, then all non-Tor OpenSSL applications running on those hosts already leak this information. But in any case, I think that the damage is self-healing (as people upgrade to OpenSSL 1.0.0) and the alternative of being stuck on our current ciphersuites forever is worse. >> Open questions: >> >> Should the client drop connections if the server chooses a bad >> cipher, or a suite without forward secrecy? >> > > I think so. Do we have any relays that do not currently support forward > secrecy? No. The question is, what should a client do if the relay selects, say, TLS_RSA_AES_128_CBC_SHA1 (ciphersuite name may not be exact). If it drops the connection immediately, that might be unusual behavior. Some other behavior might be smarter: perhaps it should pause for a while, then drop. Or perhaps it should send a little junk data then drop. I'm not sure there, though. [...] >> Can we do anything to eventually allow the IE7+[**] cipher list as >> well? IE does not support TLS_DHE_RSA_WITH_AES_{256,128}_SHA or >> SSL_DHE_RSA_WITH_3DES_EDE_CBC_SHA, and so wouldn't work with current >> Tor servers, which _only_ support those. It looks like the only >> forward-secure ciphersuites that IE7+ *does* support are ECDHE ones, >> and DHE+DSS ones. So if we want this flexibility, we could mandate >> server-side ECDHE, or somehow get DHE+DSS support (which would play >> havoc with our current certificate generation code IIUC), or say that >> it is sometimes acceptable to have a non-forward-secure link >> protocol[***]. None of these answers seems like a great one. Is one >> best? Are there other options? >> > > This sounds like a job for pluggable transports! > > I think as long as the servers support as many ciphers as possible, we > can make simple pluggable transports that setup the cipher suites we > want to use - no? Pluggable transports feel out-of-scope for this proposal. But even if they are, I don't see how they answer my question: Because (as a given!) current servers do not support any of the forward-secure ciphers on the IE7 list, if we want to impersonate IE7 or later, we will be doing something that current servers cannot support. Whether this impersonation is done somehow as a plugin, or in Tor, it would still be something we needed to coordinate with the servers in question. cheers, -- Nick [View Less]

1 0

Mnemonic 80-bit phrases (proposal)
by Sai 21 Mar '12

21 Mar '12

Hello all. We've written up our proposal for mnemonic .onion URLs. See https://docs.google.com/document/d/sT5CulCVl0X5JeOv4W_wC_A/edit?disco=AAAAA… for details; please read the full intro for explanations and caveats, as some are important. tl;dr: It's a system that would have all three properties of being secure, distributed, and human-meaningful… but would *not* also have choice of name (though it has the required *canonicality* of names), and has a somewhat absurdist definition of '… [View More]

6 13

A modest proposal for a petname system in ideas/xxx-onion-nyms.txt
by Jacob Appelbaum 19 Mar '12

19 Mar '12

Hi, Arturo and I have discussed a possible petname system for tor2web that would make it simple to remember hidden service names; it's not perfect, it's not secure and it requires comment from the community. The basic idea is to make it easy to deploy and see if anyone cares to use it. Here's the proposal in url form: https://gitweb.torproject.org/torspec.git/blob/HEAD:/proposals/ideas/xxx-on… Here's the proposal as text: Filename: xxx-onion-nyms.txt Title: .onion nym system Author: Arturo … [View More]FilastÃ², Jacob Appelbaum Created: 17 December 2011 Status: Draft 1. Intro and Motivation The main issue that prohibits the wide scale adoption of .onion addressing is the fact that they are not human memorable. While Zooko's triangle says that you can only have at most two of "memorable", "secure" and "global" it is possible to build a simple nym mechanism that relies on the current .onion addressing system. We define a basic registration system generally and also it's particual application to the tor2web network. This is a very simple kind of petname system for applications such as tor2web. 2. Definitions These are the definitions of the actors involved in the process. Beppe - The owner of the Tor Hidden Service User - A random user of Tor/tor2web v2cbb2l4lsnpio4q.onion - The .onion address that Beppe is interested in registering antani - The nym Beppe is interested in associating to v2cbb2l4lsnpio4q.onion t2w - A tor2web node 3. Registration This is the process through which Beppe is able to make a registration for his chosen nym. 3.1 General implementation Beppe wishes to register "antani" to point to v2cbb2l4lsnpio4q.onion so he creates a a TCP service listening on his .onion will respond with the string "reg antani" when interrogated. The requester will make a lookup in his database to see if "antani" is already registered. If it is not registered the "antani" <-> v2cbb2l4lsnpio4q.onion mapping is created. A timestamp is added to the database. 3.2 Tor2web implementation Beppe creates a file called "onion.txt" containing the string "reg antani" and uploads it to the root of his web server. When User visits v2cbb2l4lsnpio4q.tor2web.org the t2w checks if his database contains a mapping with v2cbb2l4lsnpio4q.onion, if it does not, it requests the http://v2cbb2l4lsnpio4q.onion/onion.txt file. If the file exists t2w reads it and extracts the "antani" string. A lookup is made in his database. If "antani" is not registered he creates a mapping between "antani" and v2cbb2l4lsnpio4q.onion. A timestamp is added to the database. 4. Expiration A nym will expire if either the HS goes offline for longer than a given time threshold or if he explicitly requests removal of the association to that particualr nym. This allows dynamic reallocation of nyms and avoids nym squatting. 4.1 Time delay We define the default tiem threshold to be 30 days since the last check. At the time of expiry or anytime before, another request is made to either the TCP service or for the "onion.txt" file. If the Hidden Service is offline or if the requested mapping has changed the mapping is removed or modified. If the onion.txt is unchanged, the nym remains valid and the database timestamp entry is updated. 4.2 Release The HS can specify the "release" string to delete the entry from the nym database. 5. Synchronization To keep the database of registered nyms up to date in for many t2w nodes, a synchronization mechanism is required but currently out of scope for this document. All the best, Jacob [View Less]

5 5

TorHS related files re-organization ?
by Fabio Pietrosanti (naif) 18 Mar '12

18 Mar '12

While thinking about TorHS key protection, it would be also nice to think about "re-organizing" the way the TorHS describe store it's data. One of the example issue i see is that currently the hostname of a TorHS is written to a text file. This provide two major drawbacks: - Application integration Any application willing to integrate with Tor and ship Tor together with the application (GlobaLeaks, TorChat, etc) must do a file i/o operation to know the hostname. If the hostname could be … [View More]

2 4

Tor HS keys password protection against impersonation attacks?
by Fabio Pietrosanti (naif) 18 Mar '12

18 Mar '12

Hi, thinking about Tor Hidden services, they are managed by using Hidden Services client keys. The Tor HS keys are "private keys" that may require to be protected because they represent also the "identity" of the Tor HS and if stolen, it would be possible to carry on impersonation attack on connecting to Tor HS. Accepting connections on behalf of the real TorHS, with the goal to steal passwords, provide fake data to clients, exploit them, etc. The Tor HS keys are even more sensible than the … [View More]

3 4

[PATCH] tor-exit-notice.html: shorten Cornell URLs
by Christian Kujau 17 Mar '12

17 Mar '12

Hi, these ever so long law.cornell.edu URLs are now automatically redirecting to a shorter version - let's use that in our tor-exit-notice.html as well. Christian. diff --git a/contrib/tor-exit-notice.html b/contrib/tor-exit-notice.html index de3be17..8cf5c29 100644 --- a/contrib/tor-exit-notice.html +++ b/contrib/tor-exit-notice.html @@ -87,7 +87,7 @@ seize this router will accomplish nothing.</p> <p> Furthermore, this machine also serves as a carrier of email, which means … [View More]

2 1

Proposal: Message-based Inter-controller IPC Channel
by Mike Perry 17 Mar '12

17 Mar '12

Filename: xxx-postmessage-ipc.txt Title: Message-based Inter-controller IPC Channel Author: Mike Perry Created: 16-03-2012 Status: Proposed Target: 0.2.4.x Overview This proposal seeks to create a means for inter-controller communication using the Tor Control Port. Motivation With the advent of pluggable transports, bridge discovery mechanisms, and tighter browser-Vidalia integration, we're going to have an increasing number of collaborating Tor controller programs communicating … [View More]with each other. Rather than define new pairwise IPC mechanisms for each case, we will instead create a generalized message-passing mechanism through the Tor Control Port. Control Protocol Specification Changes CONTROLLERNAME command Sent from the client to the server. The syntax is: "CONTROLLERNAME" SP ControllerID ControllerID = 1*(ALNUM / "_") Server returns "250 OK" and records the ControllerID to use for this control port connection for messaging information if successful, or "553 Controller name already in use" if the name is in use by another controller, or if an attempt is made to register the special names "all" or "unset". [CONTROLLERNAME need not be issued to send POSTMESSAGE commands, and CONTROLLERNAME may be unsupported by initial POSTMESSAGE implementations in Tor.] POSTMESSAGE command Sent from the client to the server. The syntax is: "POSTMESSAGE" SP "@" DestControllerID SP LineItem CRLF DestControllerID = "all" / 1*(ALNUM / "_") If DestControllerID is "all", the message will be posted to all controllers that have "SETEVENTS POSTMESSAGE" set. Otherwise, the message should be posted to the controller with the appropriate ControllerID. Server returns "250 OK" if successful, or "552 Invalid destination controller name" if the name is not registered. [Initial implementations may require DestControllerID always be "all"] POSTMESSAGE event "650" SP "POSTMESSAGE" SP MessageID SP SourceControllerID SP "@" DestControllerID SP LineItem CRLF MessageID = 1*DIGIT SourceControllerID = "unset" / 1*(ALNUM / "_") DestControllerID = "all" / 1*(ALNUM / "_") MessageID is an incrementing integer identifier that uniquely identifies this message to all controllers. The SourceControllerID is the value from the sending controller's CONTROLLERNAME command, or "unset" if the CONTROLLERNAME command was not used or unimplemented. GETINFO commands "recent-messages" -- Retrieves messages sent to ControllerIDs that match the current controller in POSTMESSAGE event format. This list should be generated on the fly, to handle disconnecting controllers. "new-messages" -- Retrieves the last 10 "unread" messages sent to this controller, in POSTMESSAGE event format. If SETEVENTS POSTMESSAGE was set, this command should always return nothing. "list-controllers" -- Retrieves a list of all connected controllers with either their registered ControllerID or "unset". Implementation plan The POSTMESSAGE protocol is designed to be incrementally deployable. Initial implementations are only expected to implement broadcast capabilities and SETEVENTS based delivery. CONTROLLERNAME need not be supported, nor do non-"@all" POSTMESSAGE destinations. To support command-based controllers (which do not use SETEVENTS) such as Torbutton, at minimum the "GETINFO recent-messages" command is needed. However, Torbutton does not have immediate need for this protocol. -- Mike Perry [View Less]

2 2

Tor and DNS - draft finalized into proposal
by Ondrej Mikle 15 Mar '12

15 Mar '12

Hi all, the DNS/DNSSEC resolving draft for seems to be finished. I added a few thoughts on mitigating circuit correlation (mentioned in proposal 171). Somebody could look at those if they are not totally stupid (last two paragraphs of section 7). A note is added about the "DNSSEC stapling" [1] (extremely difficult, won't be implemented). The draft is here (full text pasted at the end of this mail): https://github.com/hiviah/torspec/blob/master/proposals/ideas/xxx-dns-dnsse… The draft … [View More]could probably be given a "proposal number" and merged into torspec proposals directory unless there is an objection. I'll leave few weeks (2-3) in case someone finds a vulnerability or has an objection. After that I could slowly begin implementing it in a separate branch. [1] https://lists.torproject.org/pipermail/tor-dev/2012-February/003285.html Ondrej ---- pasted proposal (hopfully will wrap well) ---- Filename: xxx-dns-dnssec.txt Title: Support for full DNS and DNSSEC resolution in Tor Authors: Ondrej Mikle Created: 4 February 2012 Modified: 10 March 2012 Status: Draft 0. Overview Adding support for any DNS query type to Tor, as well as DNSSEC support. 0.1. Motivation Many applications running over Tor need more than just resolving FQDN to IPv4 and vice versa. Sometimes to prevent DNS leaks the applications have to be hacked around to be supplied necessary data by hand (e.g. SRV records in XMPP). TLS connections will benefit from planned TLSA record that provides certificate pinning to avoid another Diginotar-like fiasco. DNSSEC is part of the DNS protocol and the most appropriate place for DNSSEC API would be probably in OS libraries (e.g. libc). However that will probably take time until it becomes widespread. On the Tor's side (as opposed to application's side), DNSSEC will provide protection against DNS cache-poisoning attacks (provided that exit is not malicious itself, but still reduces attack surface). 1. Design 1.1 New cells There will be two new cells, RELAY_DNS_BEGIN and RELAY_DNS_RESPONSE (we'll use DNS_BEGIN and DNS_RESPONSE for short below). DNS_BEGIN payload: DNS packet data (variable length) The DNS packet must be generated internally by libunbound to avoid fingerprinting users by differences in client resolvers' behavior. DNS_RESPONSE payload: total length (2 octets) data (variable) Data contains the reply DNS packet or its part if packet would not fit into the cell. Total length describes length of complete response packet. AXFR and IXRF are not supported in this cell by design (see specialized tool below). 2. Interfaces to applications DNSPort evdns - existing implementation will be updated to use DNS_BEGIN. SOCKS proxy - new command will be added, containing RR type, class and query. Response will simply contain the DNS packet. 3. New options in configuration file libunbound takes couple of parameters, e.g. trust anchors and cache-size. In order not to put them all into torrc, there will be only one option, configuration file name. Tor will be distributed with some sensible defaults. New option will be named UnboundConfig and value will be filename. An option DNSQueryPolicy will determine what query types and classes are permitted: - common - class INTERNET, RR types listed on https://en.wikipedia.org/wiki/List_of_DNS_record_types#Resource_records - full - any query type and class is allowed Class CHAOS in "common" would not be of much use, since its prevalent use is for asking authoritative servers. For client side, full validation would be optional described by option DNSValidation (0|1). By default validation is turned on, otherwise it would be easy to fingerprint people who turned it on and asked for not-so-common records like SRV. 4. Changes to directory flags Exit nodes will signal their resolving capability by two flags: - CommonDNS - reflects "common" DNSQueryPolicy - FullDNS - reflects "full" DNSQueryPolicy Exit node asked for a RR type not in CommonDNS policy will return REFUSED in as status in the reply DNS packet contained in DNS_RESPONSE cell. If new types are added to CommonDNS set (e.g. new RFC adds a record type) and exit node's Tor version does not recognize it as allowed, it will send REFUSED as well. 5. Implementation notes There will be one instance of ub_ctx (libunbound resolver structure) in Tor, libunbound is thread-safe. Client will periodically purge incomplete DNS replies. Any unexpected DNS_RESPONSE will be dropped. Request for special names (.onion, .exit, .noconnect) will return REFUSED. RELAY_BEGIN would function "normally", there is no need for returning DNS data. In case of malicious exit, client can't check he's really connected to whatever IP is in A/AAAA. We won't send any NSEC/NSEC3 back in case FQDN does not exist, it would needlessly complicate things. Client can check by extra query on DNSPort. AD flag must be zeroed out on client unless validation is performed. 6. Separate tool for AXFR The AXFR tool will have similar interface like tor-resolve, but will return raw DNS data. Parameters are: query domain, server IP of authoritative DNS. The tool will transfer the data through "ordinary" tunnel using RELAY_BEGIN and related cells. This design decision serves two goals: - DNS_BEGIN and DNS_RESPONSE will be simpler to implement (lower chance of bugs) - in practice it's often useful do AXFR queries on secondary authoritative DNS servers IXFR will not be supported (infrequent corner case, can be done by manual tunnel creation over Tor if truly necessary). 7. Security implications Client as well as exit MUST block attempts to resolve local RFC 1918, 4193, 4291 adresses (PTR). An exit node resolving names will use libunbound for all types of resolving, including lookup of A/AAAA records when connecting stream to desired server. Ordinary streams will gain a small benefit of defense against DNS cache poisoning on exit node's network. Transaction ID is provided randomly by libunbound, no need to modify. This affects only DNSPort and SOCKS interfaces. As proposal 171 mentions, we need mitigate circuit correlation. One solution would be keeping multiple streams to multiple exit nodes and picking one at random for DNS resolution. Other would be keeping DNS-resolving circuit open only for a short time (e.g. 1-2 minutes). Yet another option for mitigating circuit correlation would be having separate circuit for each application, but that would require some cooperation of application and Tor, e.g. via some LD_PRELOAD mechanism. 8. TTL normalization idea A bit complex on implementation, because it requires parsing DNS packets at exit node. TTL in reply DNS packet MUST be normalized at exit node so that client won't learn what other clients queried. The normalization is done in following way: - for a RR, the original TTL value received from authoritative DNS server should be used when sending DNS_RESPONSE, trimming the values to interval [5, 600] - does not pose "ghost-cache-attack", since once RR is flushed from libunbound's cache, it must be fetched anew 9. Implementation notes I noticed that libunbound does not always parallelize requests that could be parallelized when using a forwarder (this does not apply to unrelated queries). Thus, A query for addons.mozilla.org looks like (note the interleaving of query/reponse): Time Info 0.000000 Standard query A addons.mozilla.org 0.178366 Standard query response A 63.245.217.112 RRSIG 0.178572 Standard query DNSKEY <Root> 0.178617 Standard query response DNSKEY DNSKEY RRSIG 0.178981 Standard query DS org 0.179041 Standard query response DS DS RRSIG 0.179192 Standard query DNSKEY org 0.179233 Standard query response DNSKEY DNSKEY DNSKEY DNSKEY RRSIG RRSIG 0.179505 Standard query DS mozilla.org 0.179562 Standard query response DS RRSIG 0.179717 Standard query DNSKEY mozilla.org 0.179762 Standard query response DNSKEY DNSKEY DNSKEY RRSIG RRSIG Further investigation is needed how to work around this. Maybe future version will have it fixed, since I see DNS queries exiting from unbound forwarder to authoritative DNS server are parallelized. 10. "DNSSEC stapling" The following idea tries to mitigate attack where observer of exit node can learn the fact that client's OR is "heating up DNS cache". Instead of asking for several records (DS, DNSKEY, etc.), exit node would send all of them at once in a "stapled response". Unfortunately this is extremely difficult to implement correctly [1] [2]. Thus we need to live with fact that exit node or an eavesdropper of such exit node will know that an OR used some TLD for the first time. Causing unrelated errors or vulnerabilities in Tor by implementing this algorithm is not worth the risk. References [1] https://www.ietf.org/mail-archive/web/dane/current/msg02823.html [2] http://unbound.net/pipermail/unbound-users/2012-February/002239.html [View Less]

2 3