--- draft.txt 2013-11-09 19:35:23.984361512 +0100 +++ tor-edits-draft.txt 2013-11-09 19:34:14.834361308 +0100 @@ -66,10 +66,11 @@ These pTLDs are used in the GNU Name System (GNS), I2P and the Tor network to realize fully-decentralized and censorship-resistant secure alternatives for DNS or, in the case of ".exit", to control - overlay routing. To facilitate integration with legacy - applications, the overlay's namespaces can be accessed from - applications that only speak DNS using these special TLDs, for - example via specialized SOCKS proxies [RFC 1928]. + overlay routing and to securely specify path selection choices. To + facilitate integration with legacy applications, the overlay's namespaces + can be accessed from applications resolve these special TLDs, for example + via specialized SOCKS proxies [RFC 1928], through specialized DNS servers or + transparent name resolution and ephemeral address mapping. We will describe the proposed special treatment for each of these pTLDs below following the questions from [RFC 6761]. @@ -90,10 +91,13 @@ the proposed Special-Use Domain Names already in use on the Internet and described in this document. + The Tor realted names such as 'circuit', 'stream', 'node', 'exit', 'relay' + and related Tor terms are described in [Dingledine 2004] and the Tor + protocol specification [Tor Protocol Specification]. + 3. Description of Special-Use Domains in P2P Networks ------%<---------------------------------------------------------------- - TODO Add .exit and .noconnect for Tor TODO Reorganize by app? ------%<---------------------------------------------------------------- @@ -120,49 +124,52 @@ 3.3. Circuit-Based Anonymizing pTLDs - The Tor anonymization network makes use of three special domains to - date [TorSpec]. + The Tor anonymization network makes use of several special pTLD + domains, three of which have seen widespread usage to date [Tor address-spec.txt]. 3.3.1. The Hidden Service ".onion" pTLD - The widely deployed ".onion" pTLD designates an anonymous hidden - service reachable via the Tor network [Dingledine 2004]. Such - addresses are typically resolved via a local SOCKS proxy running on - TCP port 9050. The purpose of using such a system is to make both - the information provider and the person accessing the information - more difficult to trace, whether by one another, by an intermediate - network host, or by an outsider. + The widely deployed ".onion" pTLD designates an anonymous Tor Hidden + Service reachable via the Tor network [Dingledine 2004]. These .onion urls + are self-authenticating addresses for use with any TCP service. Such + addresses are typically resolved, reached and authenticated through transparent + proxying or through a local SOCKS proxy running on TCP port 9050, TCP port 9150 + or another user selected TCP port. The purpose of the Tor Hidden Services + system is to provide geographic anonymity for the .onion host and for all + clients visiting the hidden service. Addresses in the ".onion" pTLD are opaque, non-mnemonic, alpha- - semi-numeric hashes corresponding to the public key of the - matching Tor hidden service. This "Onion key" is generated - automatically when the hidden service is configured, following the - Tor specifications [TorSpec]. It can be made up of any letter of - the alphabet and decimal digits beginning with 2 and ending with 7, - thus representing a number in base32 [RFC 4648]. + semi-numeric hashes corresponding to an 80-bit truncated SHA1 hash over a + the Tor hidden service's public key. This "Onion key" is generated + automatically when the hidden service is configured and it is used by Tor + clients following the Tor Rendezvous specifications [Tor Rendezvous + Specification]. It can be made up of any letter of the alphabet and decimal + digits beginning with 2 and ending with 7, thus representing a number in base32 + [RFC 4648]. 3.3.2. The Exit Node ".exit" pTLD - The ".exit" suffix marks a way to access a DNS host via a Tor relay - nickname, in the form "host.nickname.exit". For example, - "www.gnu.org.torservers.exit" will route the client to "www.gnu.org" - via the Tor node named "torservers". In - "[hostname].[name-or-digest].exit", "hostname" is a valid DNS hostname; - "[name-or-digest]" is either the nickname of a Tor node or the - hex-encoded digest of that node's public key. When Tor sees an - address in this format, it uses the specified hostname as the exit - node. If no "[hostname]" component is given, Tor defaults to the - published IPv4 address of the exit node. + The ".exit" suffix is used as an in-band source routing control channel, + usually it is used for selection of a specific Tor relay during path + creation as the last node in the Tor circuit. It may be used to access a DNS + host via a Tor relay nickname, in the form "host.nickname.exit". For example, + "www.gnu.org.torservers.exit" will route the client to "www.gnu.org" via the + Tor node named "torservers". In "[hostname].[name-or-digest].exit", "hostname" + is a valid DNS hostname; "[name-or-digest]" is either the nickname of a Tor + node or the hex-encoded digest of that node's public key. When Tor sees an + address in this format, it uses the specified hostname as the exit node. If no + "[hostname]" component is given, Tor defaults to the published IPv4 address of + the Tor exit node. 3.3.3. The Interrupting ".noconnect" pTLD - The ".noconnect" suffix is used in Tor for testing purpose: when + The ".noconnect" suffix is used in Tor for testing purposes: when Tor sees an address in this format, it immediately closes the connection without attaching it to any circuits. It is useful for controllers that want to test whether a given application is indeed - using the same instance of Tor that they're controlling. This is - a deprecated method and thus do not include ".noconnect" in the - list of special-use domain names that should be reserved. + using the same instance of Tor that they're controlling. This is a + deprecated pTLD and thus we do not include ".noconnect" in the list of + special-use domain names that should be reserved. 3.4. Packet-Switched-Based Anonymous ".i2p" pTLD @@ -250,8 +257,8 @@ API. However, for legacy applications and legacy name resolution APIs, no changes are required. - The ".onion" pTLDs are typically accessed via SOCKS proxies and - do not define additional record types. + The ".onion" pTLDs are typically accessed via HTTP or SOCKS proxies + and do not define additional record types. The ".i2p" pTLDs are typically accessed via HTTP or SOCKS proxies and do not define additional record types. @@ -382,5 +389,18 @@ a Censorship Resistant and Fully Decentralized Name System", September 2012. - [TorSpec] Mathewson, N., Dingledine, R., "Special Hostnames in + [Tor's address-spec] Mathewson, N., Dingledine, R., "Special Hostnames in Tor", September 2011. + https://gitweb.torproject.org/torspec.git/blob/HEAD:/address-spec.txt + + [Tor's extensions to the SOCKS protocol] + https://gitweb.torproject.org/torspec.git/blob/HEAD:/socks-extensions.txt + + [Tor Path Specification] Mathewson, N., Dingledine, R., "Tor Path Specification" + https://gitweb.torproject.org/torspec.git/blob/HEAD:/path-spec.txt + + [Tor Rendezvous Specification] + https://gitweb.torproject.org/torspec.git/blob/HEAD:/rend-spec.txt + + [Tor Protocol Specification] + https://gitweb.torproject.org/torspec.git/blob/HEAD:/tor-spec.txt