[tor-bugs] #3460 [Tor Hidden Services]: Replay-detection window for HS INTRODUCE2 cells causes HS reachability failures

[Tor Bug Tracker & Wiki]

#3460: Replay-detection window for HS INTRODUCE2 cells causes HS reachability
failures
---------------------------------+------------------------------------------
 Reporter:  rransom              |          Owner:  rransom           
     Type:  task                 |         Status:  needs_review      
 Priority:  normal               |      Milestone:  Tor: 0.2.2.x-final
Component:  Tor Hidden Services  |        Version:                    
 Keywords:                       |         Parent:                    
   Points:                       |   Actualpoints:                    
---------------------------------+------------------------------------------

Comment(by nickm):

 Okay, I've got some obvious stuff to sort out in my head before I can
 review this.

 Stupid questions: What if, after we replace an intro point, we
 accidentally pick the same intro point later on?  What if we stop, then
 restart and pick the same intro point?  Is it just service key rotation
 that keeps this safe?  (And am I right in thinking that everybody uses the
 introduce format that include service keys?)

 Also, it seems that this approach has a nasty possibility where I "just"
 make 16K bogus introduce attempts -- I don't need to even do a g^x; I only
 need to do the public RSA -- and make you choose a different intro point.
 Probably I could keep doing this until you're using an intro point I like.
 Not a terribly cheap attack, but could be worth analyzing.  Maybe the
 right answer is to change only the service key, but keep the same
 introduction points until you would otherwise rotate them?

 Here's another dumb question: Why take this approach rather than, say,
 just incrementing the window from 30 minutes to 12 hours?

-- 
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/3460#comment:4>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online