Re: [tor-bugs] #4390 [Tor Bridge]: The rotation of the TLS context can act as a fingerprint for bridges

["Tor Bug Tracker & Wiki" <torproject-admin@xxxxxxxxxxxxxx>]

#4390: The rotation of the TLS context can act as a fingerprint for bridges
------------------------+---------------------------------------------------
 Reporter:  asn         |          Owner:     
     Type:  defect      |         Status:  new
 Priority:  normal      |      Milestone:     
Component:  Tor Bridge  |        Version:     
 Keywords:              |         Parent:     
   Points:              |   Actualpoints:     
------------------------+---------------------------------------------------

Comment(by asn):

 This is also necessary for:
 https://lists.torproject.org/pipermail/tor-dev/2011-November/003061.html

 Do you people have any opinions on the new validity duration of the
 certificates?

 The scheme described in the above link, would enjoy long-term
 certificates, because every time a certificate expires the bridge operator
 has to manually re-propagate its fingerprint.

 Do you have any ideas on a good validity duration? Or do you have any
 ideas on a bad validity duration?

 Rotating certificates and keys is good practice, but in the case of SSL
 the Ephemeral DH ciphers guarantee PFS. In any case, if a relay gets
 rooted, They already get the identity key which doesn't have an expiration
 date.

-- 
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/4390#comment:4>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online
_______________________________________________
tor-bugs mailing list
tor-bugs@xxxxxxxxxxxxxxxxxxxx
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs