4 ms·

If they're going to use random numbers to enhance security, they should make sure that at worst, if the numbers are predictable and controlled by an attacker, i

by ikeboy 10y ago

If they're going to use random numbers to enhance security, they should make sure that at worst, if the numbers are predictable and controlled by an attacker, it's no worse than the current security. Does anyone know if their protocol does that?

DSingularity 10y ago
Interesting. Can you give an example of how a security enhancing protocol can be end up degrading security?
- nxzero 10y ago
  >> "RSA BSAFE is a FIPS 140-2 validated cryptography library offered by RSA Security. From 2004 to 2013 the default random number generator in the library contained an alleged kleptographic backdoor from the American National Security Agency (NSA), as part of its secret Bullrun program." https://en.m.wikipedia.org/wiki/RSA_BSAFE https://en.m.wikipedia.org/wiki/RSA_BSAFE
- JupiterMoon 10y ago
  A VPN or ssh accessed with a weak password.
nxzero 10y ago
Given to my knowledge they still have no way to insure the exit nodes are not control by a single majority, no idea why this would be any different.
- feklar 10y ago
  Tor's design document also warns a nation state level adversary who can view the whole network defeats any guarantees of anonymity. There's no way to know GCHQ/NSA aren't running 90%+ of bridges and exit relays either in addition to having a total network overview at the backbone level. Tor was designed for strong anonymity guarantees in nations that aren't 5 Eyes Alliance ie: China, Russia, ect.
  - neerdowell 10y ago
    > There's no way to know GCHQ/NSA aren't running 90%+ of bridges and exit relays Yes there is. There are currently 857 exit nodes. The Tor Project only has to personally know who runs 86 of them to ensure that 90% of the exits are not run by the NSA. In fact, since ~90% of traffic exits through the top ~260 relays, they'd only need to know 27 of the people who run those.
    - pakled_engineer 10y ago
      There is ~7000 internal relays and 2,500 bridges. https://metrics.torproject.org/networksize.html https://metrics.torproject.org/networksize.html This guarantee doesn't scale very well considering the combined 5 Eyes intel budget is ~60 billion USD and throwing just 0.1% of their budget at negating Tor would completely overwhelm the network with hundreds of thousands of stooge relays, plus they have the added benefit of global backbone cable traps. Tor can't give any kind of guarantee against a global passive adversary (5 Eyes) which is why they specifically warn against believing otherwise.
      - ikeboy 10y ago
        Tor has defenses against a large number of new nodes coming online.
        ryanlol 10y ago
        Which really only work if the attacker is stupid or trolling.
  - maerF0x0 10y ago
    Is there some trustable way that one could financially support a server w/o unintentionally supporting a compromised server?
    - gnopgnip 10y ago
      Noisebridge runs a tor exit relay and is registered as a 501c3 charity.
cyphar 10y ago
The randomness will be used to defend against knowing in advance what nodes are responsible for the HSDir entries in the hashring (allowing DoS and statistics gathering). If an attacker knew the next numbers, then this protection would be broken (but none of the other important protections would be broken).
- garrettr_ 10y ago
  Right, and this answers the parent's question. Currently, the layout of the HSDir is deterministic and therefore predictable by anyone, which allows for a number of potential attacks. See "Non-Hidden Hidden Services Considered Harmful" for context [0]. In the context of using the distributed randomness protocol to randomize the DHT layout, if the protocol were somehow broken then the worst case outcome would be that the DHT layout would again be predictable, which is no worse than the status quo today. Disclaimer: IIRC there are some proposals to use the distributed randomness protocol for other things besides randomizing the DHT; I cannot speak to how those proposals might be affected if the distributed randomness protocol is flawed. [0]: https://conference.hitb.org/hitbsecconf2015ams/wp-content/uploads/2015/02/D2T2-Filippo-Valsorda-and-George-Tankersly-Non-Hidden-Hidden-Services-Considered-Harmful.pdf https://conference.hitb.org/hitbsecconf2015ams/wp-content/up...

by ikeboy 10y ago

DSingularity 10y ago

Interesting. Can you give an example of how a security enhancing protocol can be end up degrading security?

nxzero 10y ago
>> "RSA BSAFE is a FIPS 140-2 validated cryptography library offered by RSA Security. From 2004 to 2013 the default random number generator in the library contained an alleged kleptographic backdoor from the American National Security Agency (NSA), as part of its secret Bullrun program." https://en.m.wikipedia.org/wiki/RSA_BSAFE https://en.m.wikipedia.org/wiki/RSA_BSAFE
JupiterMoon 10y ago
A VPN or ssh accessed with a weak password.

nxzero 10y ago

Given to my knowledge they still have no way to insure the exit nodes are not control by a single majority, no idea why this would be any different.

feklar 10y ago
Tor's design document also warns a nation state level adversary who can view the whole network defeats any guarantees of anonymity. There's no way to know GCHQ/NSA aren't running 90%+ of bridges and exit relays either in addition to having a total network overview at the backbone level. Tor was designed for strong anonymity guarantees in nations that aren't 5 Eyes Alliance ie: China, Russia, ect.
- neerdowell 10y ago
  > There's no way to know GCHQ/NSA aren't running 90%+ of bridges and exit relays Yes there is. There are currently 857 exit nodes. The Tor Project only has to personally know who runs 86 of them to ensure that 90% of the exits are not run by the NSA. In fact, since ~90% of traffic exits through the top ~260 relays, they'd only need to know 27 of the people who run those.
  - pakled_engineer 10y ago
    There is ~7000 internal relays and 2,500 bridges. https://metrics.torproject.org/networksize.html https://metrics.torproject.org/networksize.html This guarantee doesn't scale very well considering the combined 5 Eyes intel budget is ~60 billion USD and throwing just 0.1% of their budget at negating Tor would completely overwhelm the network with hundreds of thousands of stooge relays, plus they have the added benefit of global backbone cable traps. Tor can't give any kind of guarantee against a global passive adversary (5 Eyes) which is why they specifically warn against believing otherwise.
    - ikeboy 10y ago
      Tor has defenses against a large number of new nodes coming online.
      - ryanlol 10y ago
        Which really only work if the attacker is stupid or trolling.
- maerF0x0 10y ago
  Is there some trustable way that one could financially support a server w/o unintentionally supporting a compromised server?
  - gnopgnip 10y ago
    Noisebridge runs a tor exit relay and is registered as a 501c3 charity.

cyphar 10y ago

The randomness will be used to defend against knowing in advance what nodes are responsible for the HSDir entries in the hashring (allowing DoS and statistics gathering). If an attacker knew the next numbers, then this protection would be broken (but none of the other important protections would be broken).

garrettr_ 10y ago
Right, and this answers the parent's question. Currently, the layout of the HSDir is deterministic and therefore predictable by anyone, which allows for a number of potential attacks. See "Non-Hidden Hidden Services Considered Harmful" for context [0]. In the context of using the distributed randomness protocol to randomize the DHT layout, if the protocol were somehow broken then the worst case outcome would be that the DHT layout would again be predictable, which is no worse than the status quo today. Disclaimer: IIRC there are some proposals to use the distributed randomness protocol for other things besides randomizing the DHT; I cannot speak to how those proposals might be affected if the distributed randomness protocol is flawed. [0]: https://conference.hitb.org/hitbsecconf2015ams/wp-content/uploads/2015/02/D2T2-Filippo-Valsorda-and-George-Tankersly-Non-Hidden-Hidden-Services-Considered-Harmful.pdf https://conference.hitb.org/hitbsecconf2015ams/wp-content/up...