Can a certificate chain be used for a hidden service's private key? It would be nice to be able to periodically re-sign a public key and upload it to the host. This would mean that in the case of the private key on the host being compromised, it is only valid for a short amount of time, due to the manual reauthorization process.

I'm not sure of the correct terminology to use, so I'll try to explain it with some examples and my reasoning behind wanting this:

  • Host: I am ONION_ADDRESS, my public key is HOST_PUBLIC_KEY.
  • HSDir: I don't trust that public key.
  • Host: Here is the signature from root key ROOT_PUBLIC_KEY: SIGNED_HOST_PUBLIC_KEY.

Depending on whether the signature has expired:

  • HSDir: ROOT_PUBLIC_KEY is valid, and that signature is valid. Go ahead.


  • HSDir: ROOT_PUBLIC_KEY is valid, but that signature has expired. Goodbye.

The ROOT_PRIVATE_KEY is stored on a machine under physical control of the hidden service operator. The remote host is considered the weakest point. Should the remote host be compromised, all that can be obtained is HOST_PRIVATE_KEY (and of course HOST_PUBLIC_KEY), and the SIGNED_HOST_PUBLIC_KEY. Due to the signature being created with an expiry date, the adversary can only masquerade as the hidden service for as long as SIGNED_HOST_PUBLIC_KEY remains valid. Should the hidden service operator become aware of the host becoming compromised, he would not renew the signature. Once the SIGNED_HOST_PUBLIC_KEY expires, due to the absence of a renewed signature, HOST_PUBLIC_KEY will not be trusted, resulting in the adversary's loss of control of the hidden service.

The purpose of this is to limit the impact which a compromise would have. Further, once SIGNED_HOST_PUBLIC_KEY expires, the hidden service operator can regain exclusive control of the .onion address – it would not be necessary for a new .onion to be created.

Are there currently any methods (or any planned methods) which would allow for the host to be given partial/temporary authority to serve as the hidden service?


  • This would be a pretty substantial redesign since the hidden service address is actually part of the main public key and there's nothing close to offering this kind of verification via the HSDir's. I see the value in compartmentalizing two separate services (and likely a good idea) but it's too far away from the current implementation to make any conclusions. It may be worth trying to integrate into the next version of hidden services. – Lizbeth Jul 7 '15 at 20:22
  • Is this something you could just do for yourself using SSL certificates that expire, instead of your onion? – Jobiwan Jul 7 '15 at 20:41

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.