On Jan 14, 2012 8:55 AM, "Ian Goldberg" iang@cs.uwaterloo.ca wrote:
On Fri, Jan 13, 2012 at 08:18:06PM -0600, Watson Ladd wrote:
Dear all, After thinking hard about the issues involved with new cryptography in Tor I came to the following idea for a somewhat reasonable upgrade path for OP's and OR's that preserves everyone's privacy and security at all points (to the extent that this is possible: new connections are by new clients). The only issue is what actually goes out on the wire needs to be though through.
First note that the connection between the identity used to ensure EXTEND cells go over canonical connections and the keys actually presented by two OR's that have formed a connection can be pretty much arbitrary: it isn't necessary for the client to know what it is. So we could have each OR have an identity key that stays 1024 bit RSA for old ORs while newer ORs trust some snazzy new elliptic curve key, while using the same 1024 bits to form the identity. Note that if we use elliptic curves to secure the endpoints,(and don't mind incompatibility with old clients) the RSA key doesn't even need to be an RSA key.
I'm not sure what you're saying in this last line. Are you saying that the crypto uses the snazzy EC key, and the 1024-bit identity key is now just an arbitrary 1024-bit string? That doesn't seem secure to me: another OR can just publish that same string, along with its own snazzy keys?
Good catch: the identities in this scheme must remained tied to the RSA key, which I think has to be the case to support all clients. Changing that will be a flag day.
- Ian
tor-dev mailing list tor-dev@lists.torproject.org https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-dev