2

I'm trying to understand exactly how Tor builds a circuit with encryption. I've read the Tor design literature and have a pretty good grasp on it, however I'm left with the following misunderstanding.

When Alice, the client, goes to build her circuit, she will choose a node, say Bob, from the list of nodes distributed by Tor. She will find Bob's corresponding "onion key", which is I believe a public 1,024 bit RSA key (please correct me if I'm wrong). Alice generates the first half of a Diffe-Hellman key exchange, encrypts it with Bob's onion key then sends it to Bob, who decrypts it, generates his half of the DHKE and sends this to Alice along with a hash of the new symmetric key which they will use to encrypt future messages, which is known as a "session key".

Question 1: Does Bob send this message back to Alice in plaintext? I know that by nature of a DHKE even if an eavesdropper obtains Bob's half of the exchange he still cannot determine the secret key so I'm not sure if there is a need for encryption from Bob back to Alice at this point but if so, what type of encryption is it?

Also, if my understanding of the Tor encryption model is way off or there are any errors in my explanations, please let me know, if you can. Thank you.

Improve this question
5
  • The site is thought to answer one question. So please split your posting above into three questions. This makes it easier to give a good answer.
    – Jens Kubieziel
    Commented Jun 20, 2017 at 22:05
  • Apologies. I've edited the post down to one question.
    – Jon Behnken
    Commented Jun 20, 2017 at 22:10
  • tor.stackexchange.com/questions/12100/… might be a duplicate of this but also seems to be about the nature of public key cryptography?
    – cacahuatl
    Commented Jun 20, 2017 at 23:31
  • My question is this: Alice uses Bobs public key to encrypt her half of the secret key exchange. If Alice does not have a public key herself (which is how I understand the scenario to be), how does Bob communicate his half back to Alice?
    – Jon Behnken
    Commented Jun 21, 2017 at 0:12
  • @canonizing ironize: this is now actually more of a crypto question, but the nTor/TAP handshake is either DHE or ECDHE, respectively, yes? So one nTor/TAP handshake nets one symmetric key, ergo this process is performed twice to generate the forward and reverse keys?
    – Jon Behnken
    Commented Jun 23, 2017 at 15:42

2 Answers 2

Reset to default
1

Here is the design document for tor's next generation onion service. The paper that you linked to is outdated. The next generation onion service is expected to launch with 0.3.2 around December 15, 2017. https://gitweb.torproject.org/torspec.git/tree/proposals/224-rend-spec-ng.txt Also here is Tor Protocol Specification. https://gitweb.torproject.org/torspec.git/tree/tor-spec.txt onion-routerdotnet site is 12 years outdated, use tor's updated site's above

Improve this answer
1

Tor uses RSA keys as identity keys (except for .onion services, for the time being).

For exchanging secret key material Tor uses an ephemeral key exchange method, either TAP (old, DHE) or nTor (new, ECDHE). In {EC,}DH{,E} both parties exchange only public keys over the wire. Without knowledge of either of the secret keys, the shared secret cannot be recreated.

The RSA keys are for identity verification (I.E. Alice knows Bob is really Bob) and Alice knows that the RSA key she has for Bob is correct because the Directory Authorities attested to it. Alice knows the keys she has for the Directory Authorities is correct because they are hardcoded into Tor.

A passive attacker can see both public keys and still cannot discover the shared secret. An active attacker could try to replace part of the handshake but they would not be able to forge a signature for it using Bob's identity key. Bob doesn't have to verify Alice, only that he performed a key exchange with someone. Alice on the other hand needs to make sure she is definitely talking to the Bob she expects to, so she has a strong requirement to verify his identity.

Improve this answer
4
  • Ah, okay now I understand. Thank you this was actually very helpful. I apologize I'm a bit of a crypto novice. Just to clarify, Tor users as well as Tor nodes both have "short term onion keys", which is to say a public/private elliptic keypair?
    – Jon Behnken
    Commented Jun 21, 2017 at 3:32
  • So, if someone could get people to install builds of tor with different Dir. Auth. keys or replace the "real" tor without their knowledge, he could subvert the whole process?
    – WGroleau
    Commented Jun 21, 2017 at 5:45
  • Yes. Which is why it's important to check the signatures on the Tor Browser (and Tor in general) downloads.
    – cacahuatl
    Commented Jun 21, 2017 at 22:59
  • @cacahuatl It looks like, for the TAP protocol, one of the RSA keys is also used for encryption of the DH material for some reason. This is the "medium-term RSA key".
    – forest
    Commented Feb 17, 2019 at 12:41

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .