2

In reading this bug I can see that, in the past, Tor has been fingerprinted based on the cipher suites negotiated in the initial TLS handshake. Originally it looks like a copy of the cipher suites in a version of Firefox negotiating with Apache were used -- the goal being that it mimics a standard browser. The result of the bug was that the cipher suite was updated to look like other browsers.

My questions are:

  • How effective is this solution? The pluggable transports page shows why this isn't perfect, but is there any information on whether it's currently being used to block connections?
  • While a variety of suites are offered only a few can actually be used by Tor. Would a plausible active attack exist where an adversary could force force negotiation using an unsupported cipher in order to verify the host is a Tor node?
Improve this question

1 Answer 1

Reset to default
3

Today, Tor is moving away from looking like TLS, with pluggable transports being the solution for censored users. Tor is moving to using stronger cryptographic primitives so looking like a browser is no longer the goal. Detecting Tor relays not behind pluggable transports is relatively straightforward. One of the ways is doing what you describe.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .