May 2026 - tor-relays - lists.torproject.org

Post-Quantum Cryptography in Tor's TLS Layer: Help needed!
by Alexander Hansen Færøy 01 Jul '26

01 Jul '26

Hello Tor Relay Operators, With the arrival of OpenSSL 3.5.0 in 2025, we finally had an important missing piece of infrastructure to start enabling the Tor network to support Post-Quantum Cryptography in the outermost cryptographic layer of the Tor protocol. Since Tor version 0.4.8.17, we have supported the x25519/ML-KEM-768 hybrid handshake in our TLS layer, and we have gradually seen more relays supporting it in the production network. Tor Browser has been built against OpenSSL >= 3.5.0 since (at least) version 13.5.22, released in September 2025, and therefore supports Post-Quantum TLS handshakes today, but it requires that its guard node supports it. We need to give a big shout-out to the OpenSSL Team here to get this out and available to the masses! <3 Since Q3 2025, I've been running some semi-regular scans of the Tor production network to check for TLS cipher suite availability. This work started as part of the first Tor Community Gathering back in October, 2025[1]. The results are as follows: In January, around 28% of the Tor relays supported the Post-Quantum TLS handshake. The scan I did yesterday showed an increase of around 4 percentage points to 32.32%. Out of 9476 scanned relays, 9185 were reachable, 291 were unreachable. Of the 9185 reachable relays, I saw the following distribution of cipher suites: `TLS13_AES_256_GCM_SHA384`: 9023 relays. `TLS13_CHACHA20_POLY1305_SHA256`: 158 relays. `TLS13_AES_128_GCM_SHA256`: 4 relays. For the key exchange groups, I saw the following distribution: `secp256r1`: 6212 relays. `X25519MLKEM768`: 2969 relays. `X25519`: 4 relays. Of the Directory Authorities, 5 of them supported the `X25519MLKEM768` key exchange group during the TLS handshakes. 2969 / 9185 * 100 = 32.32% of relays support the `X25519MLKEM768` cipher suite. This number is a good start, but we should ideally bump it up! You can see the individual results for your relay(s) in the big table available at https://ahf.me/tor-tls-pqc/2026-02-26/ -- entries without a cipher suite or key exchange group were unreachable at the time I ran the scan. These missing entries can be due to a network problem anywhere on the path between my host and yours, so don't get worried if your relay is missing :-) The scanner I used is free software and is available as part of the Network Health Team's Margot tool[2], used for various analysis purposes. Please note that the goal here isn't to enumerate all available cipher suites for each relay, but instead I'm interested in the "strongest" possible cipher suite my custom client can negotiate with each relay. My ask for you as the relay operator community here is as follows: Next time you folks are doing maintenance on your relay(s), please have a look at whether you can upgrade either your packages or underlying software distribution to a version such that you either get a new enough version of OpenSSL (>= 3.5.0), or if you are a LibreSSL user, check whether the LibreSSL project supports the ML-KEM hybrid handshake, and upgrade to that version. It looks like the LibreSSL project is currently working towards supporting the ML-KEM handshake in the next upcoming release[3]. For Debian users, to get a new enough OpenSSL version that supports the PQC TLS handshake, you need to upgrade to (at least) Debian Trixie. For everybody else, it's best to check your respective software distribution's package management system to find the version you need to upgrade to. For Arti users, a licensing issue with the currently available crypto providers in Arti prevented enabling the ML-KEM handshake. Nick, however, has recently been making progress on this matter and has a patch up that is now pending upstream review[4]! :-) If you are excited about exploring different aspects of the Tor ecosystem, talking with other Tor enthusiasts, and you have nothing planned for your weekend in two weeks, I highly encourage you to look into the next Tor Community Gathering in Denmark. The event takes place from 2026-03-13 to 2026-03-15. For more information, check out our website at https://onionize.space/2026/ Thank you all for all the work you do to make Tor better! <3 Cheers, Alex [1]: https://onionize.space/2025/ [2]: https://gitlab.torproject.org/tpo/network-health/margot/ [3]: https://github.com/libressl/portable/blob/a989b7acb9a475fde656e48dbcb38289d… [4]: https://github.com/RustCrypto/rustls-rustcrypto/pull/143 -- Alexander Hansen Færøy

4 7

GeoIPFile option warning
by krishna e bera 27 Jun '26

27 Jun '26

I am seeing these warnings in Tor's notices.log: Mar 24 09:42:21.000 [notice] Configured to measure directory request statistics, but no GeoIP database found. Please specify a GeoIP database using the GeoIPFile option. Mar 24 09:42:21.000 [notice] Configured to measure entry node statistics, but no GeoIP database found. Please specify a GeoIP database using the GeoIPFile option. However the option is set in torrc and i verified the files are at those locations and readable by all: GeoIPFile /usr/local/share/tor/geoip GeoIPv6File /usr/local/share/tor/geoip6 Any hints how i could check whether the warnings are spurious or dump what the running config actually is? I know it is reading the torrc because introducing an error in the file stops it from loading.

2 3

Tor Metrics Country Error
by Diyar Ciftci 01 Jun '26

01 Jun '26

Good evening, One of my relays (azadisrvbasic) is being listed on tor metrics as being in the United States of America but it is in the United Kingdom of Gread Britain and Northern Ireland. Could this be corrected please. Kind regards, Diyar Ciftci https://diyarciftci.xyz

3 2

tor 0.4.8.x reaches end-of-life on 2026-06-01
by nusenu 25 May '26

25 May '26

Hi, this is a reminder that tor version 0.4.8.x reaches end-of-life on 2026-06-01, in one week from now. https://gitlab.torproject.org/tpo/core/team/-/wikis/NetworkTeam/CoreTorRele… kind regards, nusenu -- https://nusenu.github.io

1 0

AROI Validation vanished due to ciissversion:3 on 1AEO Metrics
by ProSecureRelays 15 May '26

15 May '26

Hey there, is there any information out regarding the AROI-Status and the trasisition from ciisversion:2 to ciisversion:3? I was proud having it all setup, but then I followed the advice on creating an ed25519 key and added the proof in my github page. The setup was done correctly as far as I can see, however, this led to loosing my AROI Status :'( . I'm happy if someone sees my fault or has a clue what to do now to get the AROI back. Of course it would be easy to just revert the change to the contact info, but the must be a "Go-Live" when the ciisv3 is the desired value? Best regards, Joker P.S. What I also noticed - I have only one relay, but since I configured the ed-key, there was a notice in the tor log that MyFamily Descriptor is still needed aswell. [warn] FamilyId was configured, but MyFamily was not. FamilyId is good, but the Tor network still requires MyFamily while clients are migrating to use family keys instead. As with one relay, I didn't see the benefit, but added the fingerprint as desired with the MyFamily Option. The warning is gone since then. Additionally I also lost my "First-Seen" Date when doing the change to v3. But I heard this is already under investigation. Picture 1: Happy Family Cert is installed and valid. Picture 2: 1AEO stats claims missing ciisversion:2. Picture 3: On the Page from Nusenu (OrNetStats), I still see myself as verified, but the update rate is quite low. This reflects the data before the change.

3 4

Reducing ContactInfo to the family ID level
by nusenu 14 May '26

14 May '26

Hi, since we have a significantly less cumbersome and much less error prone way for tor relay operators to self-declare their relay groups using the Happy Family design I was thinking about whether we actually need ContactInfo at the relay fingerprint level or if we only need it at family ID level? The idea: - only a single relay in a family publishes a ContactInfo that is valid for the entire family benefits: - easiers ContactInfo management for relay operatos not using configuration management, since they only need to update a single config - less redundant information in relay metadata that gets received and distributed by tor directory authority - significantly smaller onionoo details files downsides: - no "backup channel" in case software has Happy Family related issues - like we saw in collector/onionoo - less flexibility you want to have different contacts for different servers I do not expect that rust-based tor relays - that hopefully significantly reduce the number of tor daemons an operator has to run to make use of multi-core CPUs will take over the tor network soon. So this will remain a relevant question for the time being. This topic is limited to relays and not bridges until bridges fully support Happy Family. If there are no strong reasons for relay level ContactInfos I might implement the idea in a minor variation in ansible-relayor: only a single tor instance per server will get a ContactInfo torrc entry. The CIISS spec would also be updated to reflect that. kind regards, nusenu -- https://nusenu.github.io

3 2

What's wrong with geolocation here?
by Dennis Bronk 13 May '26

13 May '26

2 2

Quetzalcoatl relays - Loss of may exits with immediate effect
by Dr Remmiz 13 May '26

13 May '26

Hi, I thought I would write to let you know that I have just lost all my servers - all exit relays, that were part supported and sponsored by rdp.sh. They had very kindly supported and sponsored many of my exit relays over the past several years. Rdp.sh made the decision to drop all my tor exit traffic after repeated and numerous Spamhaus listings. These had recently been forwarded to their upstreams who are now starting to cut their lines. This is with immediate effect as of several hours ago - and instead of 760 exit relays, I shall now be serving only 160 exit relays. I apologize for this disruption in service, but unfortunately it is out of my control. I shall endevour to rebuild some of my server pool, but this may take some time, and finding someone to help sponsor some of the servers I run will likely be difficult, and finding such a good provider as rdp.sh was, will also I believe be difficult. If anyone has any suggestions which may help, I'd be happy to hear them. Thanks for utilizing my server pool over the years. Regards, Zimmer

2 1

Tor-ddos project is now dead
by Chris Enkidu-6 12 May '26

12 May '26

On my last post to the group I mentioned a serious illness. unfortunately I should have said a terminal illness. I probably have a couple of weeks.Since my original post I really had no legitimate offer from anyone to take it over. Just a few time waster conversations that went nowhere. So as of now both tor-ddos and tor-relay-lists are down. Sorry to do this but I have other things to worry about and since only a limited number of people on this list know about it. Others can judge me however they like. Thank you for reading this.

7 7

Re: Reducing ContactInfo to the family ID level
by DTMF dont.track.my.stuff 10 May '26

10 May '26

Hello together, thank you for raising the idea. As far as i understood - defining some kind of data attributes centrally which are unique on family level is causing more struggle in usability even if there could be a slight benefit in reducing the general payload. ////////////////////////////////////////// Single Point of Truth /////// I see a potential down side in the definition of the central point of truth. It could be one relay of the family. But when a single relay is holding that information and that relay disappears or is compromise, the information could be lost/altered. Are there any other location (non-torrc) where that information could be included. Maybe some functionality that could be added by the TOR-Project themselves instead of having workaround with third party specs like CIISS. ////////////////////////////////////////// Levels of relevancy /////// Furthermore i see different levels of relevancy. - FamilyID / HappyFamilyID Level - vServer Level (Multiple Relays) - Relay Fingerprint Level The ContactInfo (according to spec ciissversion:3) can contain also data attributes (hoster, ram, etc..) which are only relevant on Relay Fingerprint Level, or even vServer Level (multiple relays). That means when we will end up in a hydrid-state anyways. All relays would contain their specific (Relay Fingerprint Level ) data attributes in the ContactInfo field - only one relay would have have the additional information. I also like to understand which data attributes of ciissversion:3 you are specifically talking about. @NUSENU Is it only about these - that you want to markup centrally? (1) email: (2) url: (3) proof: Kind regards DTMS - dont track my stuff

1 0