5

I asked this question about Tor and how secure are the first steps before the circuit is made (the guy who answered me, lead me to this site which i didn't know).

Please correct me if I'm wrong (or if the guy is wrong, since I will take his answer as starting point).

Currently the Directories (which are hard-coded servers in the Tor software) download a huge list of nodes. The Tor client is the one who creates the circuit. However: How can one be sure that the Directories are not compromised (after all, they are mainly maintained by the US Defense dept.) and don't bring compromised nodes? I'm aware that Tor does not build a circuit having 2+ nodes from the same "person" but ... what if the NSA has spread a lot of nodes and the Directories bring you such nodes? (perhaps your IP address is already being watched by the US dept. for suspicious* activities beforehand, and they only grant you, for that IP, a subset of nodes which are all from distinct identities but all of them compromised in the same way).

How feasible is what I say?

(* this could apply even to entire countries, e.g. USA trying to put an eye on Venezuela, Ecuador, Argentina, Middle-East countries with internet access, ... having a IP2Location database is easy to get and pay for).

3

thanks for the question. First off, the "directories" you speak of are called "directory authorities" inside Tor. Their job is indeed to compile a list of all running Tor relays and make it available to everyone. This list is called the networkstatus consensus, and it is signed by the directory authorities. All Tor clients need this list of relays, so they download it and then verify the signature to make sure they received a valid document.

This does not protect from an attack where the directory authorities make more than one such list, and hand out the "wrong" list to the target they want to attack, and the "good" list to everyone else. Currently, defenses against this attack are in the works in a way for clients to keep a log of the consensuses they saw so that this attack can be detected and the malicious directory authorities get replaced.

But there are some misconceptions which are becoming apparent in your question. The US Defense department does not maintain the directory authorities, they are all run by individuals who do not receive government money to run these machines. Only a minority of them is located inside the US, and it needs a majority to make a consensus that your client will believe in.

Note that the attack gets more and more tricky to pull off and more and more easy to detect the more lists the malicious directory authorities would be making.

  • So, you can protect yourself only if most of the DAs are not compromised. – Luis Masuelli Mar 9 '15 at 14:26
  • correct, if a majority of DAs is compromised there's currently no way to really protect yourself. The system I described would mean the compromised DAs would have to attack the whole network, but couldn't target individual users. – Sebastian Mar 9 '15 at 14:34
  • Can someone create its own DA? – Luis Masuelli Mar 9 '15 at 15:33
  • 1
    Yes, but it won't be recognized by anyone else. By creating your own DAs, you're creating a new, different Tor network. So if you mean "can I create my own DA for use with the official Tor network", the answer is no. – Sebastian Mar 9 '15 at 16:07

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.