2

When I connect to a bridge is my encryption key the same as the encryption key for all other users to the same bridge or does the encryption key differ from one user to another for that same bridge?

If so how does the bridge pair the user and the key?

Improve this question

2 Answers 2

Reset to default
2

Whenever your client makes a connection to a bridge or any other Tor relay it negotiates an individual key. So this key if different from a key which another client uses and also from a key which your client negotiates in the next twenty minutes.

Improve this answer
0

I took a look at obfs4, other bridge protocols may differ.

Let's look at a bridge address for obfs4:

 obfs4 11.12.13.14:1516 64F77F8178AAFDD19035F398B28ABCD16C45A7DD cert=BF0SD8D0SBKmW8z4AMF+Ik3SiizaEdgRCrbKNYpLjr1qESQ8vQVLo3H6ioIa8KlhnV/wWg iat-mode=0

You'll notice the cert=… part, it contains certificate used to authenticate the bridge. It fulfills the same functionality as SSL certificates, it proofs the identity of your peer, the bridge, and ensures data integrity. The certificate is shared amongst all clients. It does not contain sensitive data, so this is secure.

The encryption key itself is derived during the handshake, and is unique. The certificate ensures that no man-in-the-middle attack can be mounted during the handshake.

You can also take a look at the obfs4 protocol specification.

Improve this answer
2
  • From your link (Not sure about No MITM attack) en.wikipedia.org/wiki/Public_key_certificate#Weaknesses It states “Where certificate providers are under the jurisdiction of governments, those governments may have the freedom to order the provider to generate any certificate, such as for the purposes of law enforcement.”
    – Private C
    Mar 29, 2017 at 9:54
  • It fulfills the same functionality but it doesn't involve certificate authorities (or certificate providers as the are called in the Wikipedia article.) In SSL they are needed to verify the certificate but in case of obfs4 you already have that certificate, it is in the information about the bridge you need to connect to it.
    – Peter Gerber
    Mar 29, 2017 at 16:50

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .