7

I am building an application that will be connected over tor, using onion services. I just realized that the file generated by Tor that contains the private key of the hidden site is only RSA 1024bits.

Isn't RSA 1024 considered weak?

Is the conversation when connecting to a hidden service encrypted only using RSA 1024? Should I wrap the conversation with another layer of encryption using a better RSA?

  • 1
    RSA1024 is used purely for identity in the case of onion services. The actual key exchange and session cipher are using more modern algorithms, breaking RSA1024 wouldn't allow decryption of onion service traffic, but it would allow them to impersonate the onion service. – cacahuatl Aug 30 '16 at 22:28
5

What encryption algorithms does Tor use?

See the following sections of the Tor Protocol Specification:

  • 0.2 Security parameters
  • 0.3 Ciphers

Isn't RSA 1024 considered weak?

1024 hasn't been broken (yet... ), and you'd find moving to anything bigger makes things generally slower.

There's a useful discussion in this old thread.

With regards to rolling your own more secure onion service, have a look at this thread.

  • I thought the NSA was breaking RSA 1,024 keys with chips that cost a fortune? – Nathan Parker Jan 13 '16 at 19:42
  • 1
    Also, why would the onion address be larger? AFAIK, its just the 80 first bits of the SHA-1 of the public key. It doesn't matter the size of the public key, if we use the same algorithm. – Nathan Parker Jan 13 '16 at 19:44
  • 1
    You're right about the address - the digest is what you describe. I'll edit my answer. With regards to the NSA... I'm not sure anyone here has the answer to that :) – Richard Horrocks Jan 13 '16 at 20:14
  • @RichardHorrocks We certainly have the technology to build an ASIC to break 1024-bit RSA keys using GNFS for a few million dollars, which the NSA absolutely has. – forest Feb 17 at 12:31

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.