Is it possible right now, with the current version of Tor, to use a distributed web of trust in Hidden Sevices' public keys, meaning:

  • Public keys are uploaded to public keyservers
  • Users can search for them by human meaningful names
  • Users can download keys, sign them and share certificates, thus growing web of trust
  • .onion addresses may then (RLY?) be derived locally on user side from keys

In effect users would have

  1. Convenient bookmark lists, with human meaningful names to use in browsers and shareable peer-certified bookmarks.

  2. Easy-to-check trust level for a particular Hidden Service a user is interested in.

By “is possible right now” I mean “end-user class software for Tor key managing does exist” (AFAIK, Tor still doesn't use OpenPGP, so GnuPG, etc. won't do). Getting “1.” done seems to be pretty trivial, if only (RLY?) is true.

  • not sure if this is what you want know, but having the public key you can totally get the onion address by computing SHA-1 of it, taking the first half of the resulting digest and converting it to base-32 encoding – flagg19 Dec 12 '14 at 17:04
  • This may be an untutored question, but is there some way to put the public key into an OpenPGP cert? If so, we could add the name of the service and put the onion address in the comment field, sign, and upload to a keyserver? That would solve the problem, no? – Diagon Jul 2 '19 at 1:15

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.