[tor-dev] [tor-assistants] Python metrics-lib

[Karsten Loesing]

On 5/8/12 4:47 AM, Robert Ransom wrote:
> On 5/8/12, Beck Chen <csybeck at gmail.com> wrote:
> 
>> According to the outline, the long-term identity key should be different
>> from the
>> signing key, which changes every 3-12 months. Then why should the signing
>> key
>> become the identity key in the descriptor format, and fingerprint become
>> the hash
>> of the identity key?
> 
> The ‘relay identity key’ is not the same as the ‘authority identity
> key’. The ‘relay identity key’ might also be different from the
> ‘directory signing key’; I'm not sure about that.

Relay identity key and directory signing key are indeed different.

Think of the authority identity key and directory signing key as a
different layer on top of stuff that all relays do.  When a relay
becomes a directory authority, the operator creates an offline authority
identity key and uses it to create an online directory signing key.
When the directory signing key expires, which usually happens once per
year, the operator creates a new one using the authority identity key
and uploads it.  The relay identity key and authority identity key
usually stay the same for a long time.

For example, here are the long-term keys for gabelmoo (from
src/or/config.c):

"gabelmoo orport=443 no-v2 "
  "v3ident=ED03BB616EB2F60BEC80151114BB25CEF515B226 "
  "212.112.245.170:80 F204 4413 DAC2 E02E 3D6B CF47 35A1 9BCA 1DE9 7281",

The ED03... part is the hash of the authority identity key, the F204...
part is the relay identity.  The directory signing key is not
hard-coded.  You can find all directory signing keys here:

https://metrics.torproject.org/data/certs.tar.bz2

Best,
Karsten