Generating new addresses

Question

Tor v2 addresses were generated by a base32 string of the first 80 bits of the SHA1 hash of the private key (sic - public key)

How can I generate Tor v3 addresses? (basic command line tools preferred, openssl, ssh-keygen, base32 and so on)

Please add sample key.pub, (full, not first 2 bytes of) checksum, and resulting .onion address.

---

Update:

I have found a sample (encoded in hex).

hs_ed25519_public_key

3d3d 2065 6432 3535 3139 7631 2d70 7562
6c69 633a 2074 7970 6530 203d 3d00 0000
0044 6619 5537 af38 e2c6 7ac2 d8f6 c13f
958f 7e63 41d0 60e2 727f ca7b a285 722b

hs_ed25519_secret_key

3d3d 2065 6432 3535 3139 7631 2d73 6563
7265 743a 2074 7970 6530 203d 3d00 0000
40ff f076 1f62 2657 85e9 0ec8 a2f9 7c52
1a6f 97ab bc20 2bd8 13e6 7442 7d67 506c
27aa 4c9b 935a 15c9 891d f2b0 e2a2 8acd
68fc 8bc8 a483 2829 7f93 9de4 f714 cb59

Resulting address
(do not use this address - the private key is now public)

abcgmgkvg6xtrywgplbnr5wbh6ky67tdihigbytsp7fhxiufoiv6w3yd.onion

Answer 1

https://gitweb.torproject.org/torspec.git/tree/rend-spec-v3.txt#n2013 (links to the correct line as of today. If you're from the future, you might need to ctrl-f for "ONIONADDRESS")

---

The onion address of a hidden service includes its identity public key, a version field and a basic checksum. All this information is then base32 encoded as shown below:

 onion_address = base32(PUBKEY | CHECKSUM | VERSION) + ".onion"
 CHECKSUM = H(".onion checksum" | PUBKEY | VERSION)[:2]

 where:
   - PUBKEY is the 32 bytes ed25519 master pubkey of the hidden service.
   - VERSION is an one byte version field (default value '\x03')
   - ".onion checksum" is a constant string
   - CHECKSUM is truncated to two bytes before inserting it in onion_address

Here are a few example addresses:

   pg6mmjiyjmcrsslvykfwnntlaru7p5svn6y2ymmju6nubxndf4pscryd.onion
   sp3k262uwy4r2k3ycr5awluarykdpag6a7y33jxop4cs2lu5uz5sseqd.onion
   xa4r2iadxm55fbnqgwwi5mymqdcofiu3w6rpbtqn7b2dyn7mgwj64jyd.onion

For more information about this encoding, please see our discussion thread at [ONIONADDRESS-REFS].

Answer 2

So it seems the public key is only 32 bytes long, but in your example it is 64 bytes long. I coded the following script, given the full public key of 64 bytes and got the sample address you put. So take it as a reference!

from base64 import b32encode
from hashlib import sha3_256

def main():
    # Expected result: abcgmgkvg6xtrywgplbnr5wbh6ky67tdihigbytsp7fhxiufoiv6w3yd.onion
    hex_string = "3d3d 2065 6432 3535 3139 7631 2d70 7562 6c69 633a 2074 7970 6530 203d 3d00 0000" + " 0044 6619 5537 af38 e2c6 7ac2 d8f6 c13f 958f 7e63 41d0 60e2 727f ca7b a285 722b"
    pub = bytearray.fromhex(hex_string)[32:]
    version = b"\x03"
    checksum = sha3_256(bytes(".onion checksum", "utf-8") + pub + version).digest()[:2]
    address = b32encode(pub + checksum + version).decode().lower()
    print(address + ".onion")

if __name__ == "__main__":
    main()

Answer 3

Here a shell script to generate an onion domain with openssl-tools:

# generate an Ed25519 private key if it's not exists yet
[ ! -f test25519.pem ] && openssl genpkey -algorithm ed25519 -outform PEM -out test25519.pem

# OpenSSL does not support outputting only the raw key from the command line.
# You can get it in SubjectPublicKeyInfo format.
# For Ed25519 key it always consist of 12 bytes of ASN.1 header followed by 32 bytes of raw key.
# Therefore to get a raw public key we'll skip the the first 12 bytes

pub=$(openssl pkey -outform DER -pubout -in test25519.pem | tail -c +13)
# SHA3-256(".onion checksum" | PUBKEY | VERSION)[:2]
checksum=$(printf ".onion checksum%s\x03" "$pub" | openssl dgst -sha3-256 -binary | head -c 2)
# onion_address = base32(PUBKEY | CHECKSUM | VERSION) + ".onion"
onion_domain=$(printf "%s%s\x03" "$pub" "$checksum" | base32 | tr A-Z a-z)
echo "$onion_domain.onion"

mkdir ./hs
echo "$onion_domain.onion" > ./hs/hostname

key_raw=$(openssl pkey -outform DER -in test25519.pem | tail -c +13)
printf "== ed25519v1-secret: type0 ==\x00\x00\x00%s" "$key_raw" > ./hs/hs_ed25519_secret_key

The generated hs folder can be used as an onion service. The public key will be created by a Tor itself on start. The hostname is also not necessary.

Please note that here we don't have a key expansion but still this key is working.