Assume an attacker with a record of Tor traffic between a client and guard has precomputed the 1024-bit Oakley group for Diffie-Hellman used in the TAP protocol. This would allow them to rapidly decrypt any recorded DH key exchange done over that group after an expensive but feasible (millions of dollars of equipment and a year of time) one-time computation. If I recall, the legacy TAP protocol used 1024-bit DH. Combined with the suspicion that the "breakthrough cryptanalytic capabilities" mentioned in the Snowden leaks refer to precomputation attacks against 1024-bit Diffie-Hellman parameters as pointed out in the WeakDH paper, would an adversary with these capabilities be able to decrypt old Tor traffic?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.