5 ms·

Onion names are sort of public keys. You generate a secret key, then that's transformed/hashed into the public key that is your onion address. Since onion addr

Onion names are sort of public keys. You generate a secret key, then that's transformed/hashed into the public key that is your onion address. Since onion addresses are essentially random strings of a certain length, the only way to get a "vanity" onion address is to brute force it.

0x0 11y ago
Also, if I'm not mistaken, this means that if YOU can brute force a vanity domain, anyone else willing to throw down the same amount of computing power can perform the same brute force and discover your private key, taking over your onion site? Edit: probably wrong, see below
- eterm 11y ago
  Normally you brute force vanity addresses by having a range of acceptable outcomes, whereas to brute force a specific vanity address* you are only targetting a single outcome. So they might have just set it to filter for facebook[dictionaryword]+ and this was the best match. * Actually any address, it's not limited to brute forcing vanity addresses.
  - 0x0 11y ago
    I guess I incorrectly assumed the process would be repeatable, but now I see that getting a specific duplicate equals bruteforcing the entire key space - even if the prefix is a chosen vanity name. I confused it with the effort of getting a similar address where just the vanity prefix needs to match.
- nocarrier 11y ago
  It requires substantially more compute power to match "facebookcorewwwi" vs just finding a hash with a prefix of "facebook" that looks readable. Good luck hashing the remaining eight characters!
  - Russell91 11y ago
    Well, it would just take twice as long as hashing the first 8... /s
    - MacsHeadroom 11y ago
      I realize that was sarcasm. But for the non-hash-aware among us, it would take on average 2,147,483,647 as long to brute force the last 8 with the same computing power and 4,294,967,295 as long to hash every combination of the last 8. This all assumes no vulnerabilities in the algorithm, of course.
      - ryan-c 11y ago
        It's base32, not base16, so you're off by several orders of magnitude - numbers should be 549,755,813,888 and 1,099,511,627,776.
        MacsHeadroom 11y ago
        I believe you are correct. I appreciate the correction.
- jchendy 11y ago
  Sure. The same is true for anything that uses public key encryption (Bitcoin for one). But the amount of computing power needed doesn't exist. According to this person's math [1]: "It would take ~6.7e40 times longer than the age of the universe to exhaust half of the keyspace of a AES-256 key" I don't know if Tor uses AES-256, but I'm sure any reasonable encryption algorithm would be similar. [1] https://www.reddit.com/r/theydidthemath/comments/1x50xl/time_and_energy_required_to_bruteforce_a_aes256/ https://www.reddit.com/r/theydidthemath/comments/1x50xl/time...
  - ikeboy 11y ago
    The energy calculation assumes the computation is irreversible. If you use reversible computing, there is no lower bound: you can compute as much as you want for as little energy as you want. The time calculation assumes our current computers and disregards Moore's law.
    - Guvante 11y ago
      You have to create the algorithm to reverse an arbitrary AES-256 key, which is considered to be impossible, so that doesn't really make a difference. Your comment about current computers fails to grasp the scale that we are talking about here: > It would take 10^38 Tianhe-2 Supercomputers running for the entirety of the existence of everything to exhaust half of the keyspace of a AES-256 key. Let's assume that Moore's law is true for forever. In 300 years we will have a super computer capable of cracking a single AES-256 key in 37 millennium. However claiming that Moore's law will stay the same for 300 years when many think it won't last 30 is foolhardy.
      - ikeboy 11y ago
        >You have to create the algorithm to reverse an arbitrary AES-256 key, which is considered to be impossible, so that doesn't really make a difference. What? Why is brute force impossible to code? I don't understand what you're claiming. I agree that adding in Moore's law doesn't change the numbers by much. Moore's law plus weakening of cryptographic assumptions might do it, though. Plenty of previously-believed-to-be-strong crypto algorithms have been cracked, it's reasonable to think that we just don't have the tools to create unbreakable codes yet. (E.g. RSA is known to be breakable with quantum computers with Shor's algorithm.)
itsbenweeks 11y ago
The third part on the Tor project's blog at https://blog.torproject.org/blog/facebook-hidden-services-and-https-certs https://blog.torproject.org/blog/facebook-hidden-services-an... describes this well. Check out mapgrep's comment on another thread below for a more in depth answer, too.

0x0 11y ago

Also, if I'm not mistaken, this means that if YOU can brute force a vanity domain, anyone else willing to throw down the same amount of computing power can perform the same brute force and discover your private key, taking over your onion site? Edit: probably wrong, see below

eterm 11y ago
Normally you brute force vanity addresses by having a range of acceptable outcomes, whereas to brute force a specific vanity address* you are only targetting a single outcome. So they might have just set it to filter for facebook[dictionaryword]+ and this was the best match. * Actually any address, it's not limited to brute forcing vanity addresses.
- 0x0 11y ago
  I guess I incorrectly assumed the process would be repeatable, but now I see that getting a specific duplicate equals bruteforcing the entire key space - even if the prefix is a chosen vanity name. I confused it with the effort of getting a similar address where just the vanity prefix needs to match.
nocarrier 11y ago
It requires substantially more compute power to match "facebookcorewwwi" vs just finding a hash with a prefix of "facebook" that looks readable. Good luck hashing the remaining eight characters!
- Russell91 11y ago
  Well, it would just take twice as long as hashing the first 8... /s
  - MacsHeadroom 11y ago
    I realize that was sarcasm. But for the non-hash-aware among us, it would take on average 2,147,483,647 as long to brute force the last 8 with the same computing power and 4,294,967,295 as long to hash every combination of the last 8. This all assumes no vulnerabilities in the algorithm, of course.
    - ryan-c 11y ago
      It's base32, not base16, so you're off by several orders of magnitude - numbers should be 549,755,813,888 and 1,099,511,627,776.
      - MacsHeadroom 11y ago
        I believe you are correct. I appreciate the correction.
jchendy 11y ago
Sure. The same is true for anything that uses public key encryption (Bitcoin for one). But the amount of computing power needed doesn't exist. According to this person's math [1]: "It would take ~6.7e40 times longer than the age of the universe to exhaust half of the keyspace of a AES-256 key" I don't know if Tor uses AES-256, but I'm sure any reasonable encryption algorithm would be similar. [1] https://www.reddit.com/r/theydidthemath/comments/1x50xl/time_and_energy_required_to_bruteforce_a_aes256/ https://www.reddit.com/r/theydidthemath/comments/1x50xl/time...
- ikeboy 11y ago
  The energy calculation assumes the computation is irreversible. If you use reversible computing, there is no lower bound: you can compute as much as you want for as little energy as you want. The time calculation assumes our current computers and disregards Moore's law.
  - Guvante 11y ago
    You have to create the algorithm to reverse an arbitrary AES-256 key, which is considered to be impossible, so that doesn't really make a difference. Your comment about current computers fails to grasp the scale that we are talking about here: > It would take 10^38 Tianhe-2 Supercomputers running for the entirety of the existence of everything to exhaust half of the keyspace of a AES-256 key. Let's assume that Moore's law is true for forever. In 300 years we will have a super computer capable of cracking a single AES-256 key in 37 millennium. However claiming that Moore's law will stay the same for 300 years when many think it won't last 30 is foolhardy.
    - ikeboy 11y ago
      >You have to create the algorithm to reverse an arbitrary AES-256 key, which is considered to be impossible, so that doesn't really make a difference. What? Why is brute force impossible to code? I don't understand what you're claiming. I agree that adding in Moore's law doesn't change the numbers by much. Moore's law plus weakening of cryptographic assumptions might do it, though. Plenty of previously-believed-to-be-strong crypto algorithms have been cracked, it's reasonable to think that we just don't have the tools to create unbreakable codes yet. (E.g. RSA is known to be breakable with quantum computers with Shor's algorithm.)

itsbenweeks 11y ago

The third part on the Tor project's blog at https://blog.torproject.org/blog/facebook-hidden-services-and-https-certs https://blog.torproject.org/blog/facebook-hidden-services-an... describes this well. Check out mapgrep's comment on another thread below for a more in depth answer, too.