Tor Stack Exchange is a question and answer site for researchers, developers, and users of Tor. It only takes a minute to sign up.
Sign up to join this community
Reading here I understand that only clients that are listed are authorized to access the hidden service, but how does it work?
I mean, is my hidden service really hidden? If a client is not authorized to access, can it see the activity of my h.s.? Can this configuration protect me from ddos attack (I assume that the attack is not done by authorized clients)?
What is the difference from basic and stealth?
So, what this can and cannot do?
A hidden service is truly hidden, this add another layer to discriminate clients.
In traditional HS, a hidden server publish in the tor network how to begin a communication with it (not its true location, tor uses a complex middle nodes link setup for bidirectional route anonymization, the server and client knows nothing about end point's location, same for the rest of the tor network). A client ask to the network how to reach a HS with this info.
In the authorize client option one mechanism provides two more features, a hidden server publish encrypted instructions of how to begin the communication, a client with the right key can decipher this info. And with the same key, the HS expects the first handshake to be made. If you are an authorized client, you only can locate the HS path and then try to establish connection if you have this key. Indeed you can prevent a DDOS because if the client does not have the key, it can not find the path to the server.
There is two flavor of this, the basic mode, where many keys for the same onion address are published, and the stealth mode where for the same HS the server publish differents onion addresses with each different key.
The security difference of this modes are that basic mode can escalate to many keys but the tor network knows how many keys are (not how many users connect with this keys, or when), can scale easily for big HS servers. Stealth mode is limited to more or less 16 keys, but the tor network knows nothing if this keys are for the same HS. Good for small setups, not so wheel for massive HS services. There are ways to overcome the limitations of the stealth mode.
I use the stealth mode quite a lot for my SSH servers. I have a different onion and key set for every client.
how does it work?
Clients must authenticate to create a successful rendezvous circuit.
can it see the activity of my h.s.?
That depends what you mean by activity, they could track the publication of it's descriptor for example (with basic, less-so with stealth) but they'd be unable to make a successful rendezvous circuit.
Can this configuration protect me from ddos attack?
It can help prevent some vectors but generally no. An adversary with sufficient available bandwith could still attack guards to perform "sniper" attacks (with basic, again less so with stealth).
What is the difference from basic and stealth?
Basic requires clients possess a shared secret (this secret is shared out-of-band) before they can create a rendezvous circuit.
Stealth also generates a new onion address for every client, each client has it's own shared secret and onion address pair. This scales least well because it must maintain a full set of descriptors for every client.
And easy description of how HS works. You HS server choose some random nodes, this nodes only relay info from the client to the HS if a client ask about the HS to them. Then the HS publish this info to the tor directory.
Before a client want to connect to a HS, first choose a ramdom node, this node (rendezvous node) will relay data from the HS to the client. Then ask to the tor directory servers how to contact the HS. The client will choose one of the published relays, and will send a message with rendezvous node location to the HS through the relay node.
Then, when the HS receive the petition, it establish a connection to the client through the rendezvous node. The relay node never told to the client where the HS is, the rendezvous node never told the HS where the client is. And with every step, the nodes uses keys to authenticate connections, middle points and endpoints.
In the authorize client mode, the relays nodes are encrypted with a secret key before the HS publish those to the directory. The client uses the key to read this relay locations.
