8

I am building an application that will be connected over tor, using onion services. I just realized that the file generated by Tor that contains the private key of the hidden site is only RSA 1024bits.

Isn't RSA 1024 considered weak?

Is the conversation when connecting to a hidden service encrypted only using RSA 1024? Should I wrap the conversation with another layer of encryption using a better RSA?

Improve this question
1
  • 1
    RSA1024 is used purely for identity in the case of onion services. The actual key exchange and session cipher are using more modern algorithms, breaking RSA1024 wouldn't allow decryption of onion service traffic, but it would allow them to impersonate the onion service.
    – cacahuatl
    Commented Aug 30, 2016 at 22:28

1 Answer 1

Reset to default
5

What encryption algorithms does Tor use?

See the following sections of the Tor Protocol Specification:

  • 0.2 Security parameters
  • 0.3 Ciphers

Isn't RSA 1024 considered weak?

1024 hasn't been broken (yet... ), and you'd find moving to anything bigger makes things generally slower.

There's a useful discussion in this old thread.

With regards to rolling your own more secure onion service, have a look at this thread.

Improve this answer
4
  • I thought the NSA was breaking RSA 1,024 keys with chips that cost a fortune?
    – Nathan Parker
    Commented Jan 13, 2016 at 19:42
  • 1
    Also, why would the onion address be larger? AFAIK, its just the 80 first bits of the SHA-1 of the public key. It doesn't matter the size of the public key, if we use the same algorithm.
    – Nathan Parker
    Commented Jan 13, 2016 at 19:44
  • 1
    You're right about the address - the digest is what you describe. I'll edit my answer. With regards to the NSA... I'm not sure anyone here has the answer to that :)
    – Richard Horrocks
    Commented Jan 13, 2016 at 20:14
  • @RichardHorrocks We certainly have the technology to build an ASIC to break 1024-bit RSA keys using GNFS for a few million dollars, which the NSA absolutely has.
    – forest
    Commented Feb 17, 2019 at 12:31

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .