0

For many years, Tor is having issues with malicious relays.

Verifying/contacting operators via their email addresses seems to be not an option.

Wouldn't it be feasible for the Tor project to set up a certificate authority and provide certificates to operators, so they can run relays with certificates, and thus relays without certificate (i.e. malicious relays) are not used for routing anymore?

Those certificates/operators could have different trust levels, which e.g. allows operators with a high trust level (e.g. personal acquaintance) to run many nodes, and operators with limited trust level (email contact) to run less nodes/bandwidth.

I think from a technical perspective that could be a solution for removing malicious relays, but I'm sure that I'm the first person to come up with such an idea.

So I assume there are other reasons for not following such an approach, and I'd like to learn about them. I could think of

  • effort for the Tor project (the process to set up/operate a CA, decide on trust levels, and to provide certificates). At the same time, it might save effort for finding ways to identify and remove malicious relays
  • additional computing resources needed for nodes to sign/verify challenges
  • ...??
Improve this question

1 Answer 1

Reset to default
1

Those certificates/operators could have different trust levels, which e.g. allows operators with a high trust level (e.g. personal acquaintance) to run many nodes, and operators with limited trust level (email contact) to run less nodes/bandwidth.

Who would be the ones to decide who is trustworthy and who isn't? If it's the directory authorities, then what happens if they're not in agreement? And this would be a lot of work for each directory authority to verify the legitimacy of the thousands of relay operators.

I think from a technical perspective that could be a solution for removing malicious relays, but I'm sure that I'm the first person to come up with such an idea.

So I assume there are other reasons for not following such an approach, and I'd like to learn about them. I could think of

I think I've seen some proposals for some similar ideas in the past, such as https://lists.torproject.org/pipermail/tor-relays/2021-October/019854.html, but I haven't followed along with any of that discussion. Hopefully someone who knows more will answer.

Improve this answer
2
  • Tor organizers already have to make such decisions with less information to decide which relays are considered malicious. And the effort seems to be rather a onetime effort (assuming that the relay operators don't "fluctuate" a lot). And Tor already put in effort for years to try to identify malicious relays, why not put the effort into another strategy. The link is interesting, another trust-based approach, but there they explicitly try to avoid certificates because of the effort.
    – radix
    Commented Feb 27, 2023 at 19:01
  • Another thing to keep in mind is that the Tor Project organization is separate from the directory authority operators. The Tor Project doesn't control the directory authorities, and doesn't directly choose what relays are part of the network or not. The directory authorities are run by trusted volunteers, so this would push this work onto these volunteers.
    – Steve
    Commented Feb 28, 2023 at 3:20

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .