========================================================================
Tor Weekly News September 11th, 2013
========================================================================
Welcome to the eleventh issue of Tor Weekly News, the weekly newsletter
that covers what is happening in the taut Tor community.
tor 0.2.4.17-rc is out
----------------------
There are now confirmationsÂ[1] that the sudden influx of Tor clients
which started mid-AugustÂ[2] is indeed coming from a botnet. âI guess
all that work weâve been doing on scalability was a good idea,â wrote
Roger Dingledine in a blog post about âhow to handle millions of
new Tor clientsâÂ[3].
On September 5th, Roger Dingledine announced the release of the third
release candidate for the tor 0.2.4 seriesÂ[4]. This is an emergency
release âto help us tolerate the massive influx of users: 0.2.4 clients
using the new (faster and safer) âNTorâ circuit-level handshakes now
effectively jump the queue compared to the 0.2.3 clients using âTAPâ
handshakesâÂ[5].
It also contains several minor bugfixes and some new status messages for
better monitoring of the current situation.
Roger asked relay operators to upgrade to 0.2.4.17-rcÂ[6]: âthe more
relays that upgrade to 0.2.4.17-rc, the more stable and fast Tor will be
for 0.2.4 users, despite the huge circuit overload that the network is
seeing.â
For relays running Debian or Ubuntu, upgrading to the development branch
can be done using the Tor projectâs package repositoryÂ[7]. New versions
of the beta branch of the Tor Browser Bundle are also availableÂ[8]
since September 6th. The next Tails release, scheduled for September
19thÂ[9] will also contain tor 0.2.4.17-rcÂ[10].
Hopefully, this will be the last release candidate. What looks missing
at this point to declare the 0.2.4.x series stable is simply enough time
to finish the release notes.
[1] http://blog.fox-it.com/2013/09/05/large-botnet-cause-of-recent-tor-network-overload/
[2] https://lists.torproject.org/pipermail/tor-talk/2013-September/029822.html
[3] https://blog.torproject.org/blog/how-to-handle-millions-new-tor-clients
[4] https://lists.torproject.org/pipermail/tor-talk/2013-September/029857.html
[5] https://bugs.torproject.org/9574
[6] https://lists.torproject.org/pipermail/tor-relays/2013-September/002701.html
[7] https://www.torproject.org/docs/debian.html.en#development
[8] https://blog.torproject.org/blog/new-tor-02417-rc-packages
[9] https://mailman.boum.org/pipermail/tails-dev/2013-September/003622.html
[10] https://mailman.boum.org/pipermail/tails-dev/2013-September/003621.html
The future of Tor cryptography
------------------------------
After the last round of revelations from Edward Snowden, described as
âexplosiveâ by Bruce SchneierÂ[11], several threads started on the
tor-talk mailing list to discuss Tor cryptography.
A lot of what has been written is speculative at this point. But some
have raised concernsÂ[12] about 1024 bit DiffieâHellman key
exchangeÂ[13]. This has already been addressed with the introduction of
the ântorâ handshakeÂ[14] in 0.2.4 and Nick Mathewson encourages
everybody to upgradeÂ[15].
Another threadÂ[16] prompted Nick to summarizeÂ[17] his views on the
future of Tor cryptography. Regarding public keys, âwith Tor 0.2.4,
forward secrecy uses 256-bit ECC, which is certainly better, but
RSA-1024 is still used in some places for signatures. I want to fix all
that in 0.2.5 â see proposal 220Â[18], and George Kadianakisâ draft
hidden service improvementsÂ[19,20], and so forth.â Regarding symmetric
keys, Nick wrote: âWeâre using AES128. Iâm hoping to move to XSalsa20 or
something like it.â In response to a query, Nick clarifies that he
doesnât think AES is broken: only hard to implement right, and only
provided in TLS in concert with modes that are somewhat (GCM) or
fairlyÂ(CBC) problematic.
The effort to design better cryptography for the Tor protocols is not
new. More than a year ago, Nick Mathewson presented proposal 202Â[21]
outlining two possible new relay encryption protocols for Tor cells.
Nick mentioned that heâs waiting for a promising paper to get finished
here before implementation.
A third question was raisedÂ[22] regarding the trust in algorithms
certified by the US NISTÂ[23]. Nickâs speculations put aside, he also
emphasized that several NIST algorithms were âhard to implement
correctlyâÂ[24].
Nick also plans to change more algorithmsÂ[25]: âOver the 0.2.5 series,
I want to move even more things (including hidden services) to
curve25519 and its allies for public key crypto. I also want to add more
hard-to-implement-wrong protocols to our mix: Salsa20 is looking like a
much better choice to me than AES nowadays, for instance.â
Nick concluded one of his emails with the words: âthese are interesting
times for cryptoâ, which sounds like a good way to put it.
[11] https://www.schneier.com/blog/archives/2013/09/the_nsa_is_brea.html
[12] https://lists.torproject.org/pipermail/tor-talk/2013-September/029917.html
[13] https://en.wikipedia.org/wiki/DiffieâHellman_key_exchange
[14] https://gitweb.torproject.org/torspec.git/blob_plain/HEAD:/proposals/216-ntor-handshake.txt
[15] https://lists.torproject.org/pipermail/tor-talk/2013-September/029930.html
[16] https://lists.torproject.org/pipermail/tor-talk/2013-September/029927.html
[17] https://lists.torproject.org/pipermail/tor-talk/2013-September/029941.html
[18] https://gitweb.torproject.org/torspec.git/blob_plain/HEAD:/proposals/220-ecc-id-keys.txt
[19] https://lists.torproject.org/pipermail/tor-dev/2013-August/005279.html
[20] https://lists.torproject.org/pipermail/tor-dev/2013-August/005280.html
[21] https://gitweb.torproject.org/torspec.git/blob_plain/HEAD:/proposals/202-improved-relay-crypto.txt
[22] https://lists.torproject.org/pipermail/tor-talk/2013-September/029933.html
[23] https://en.wikipedia.org/wiki/National_Institute_of_Standards_and_Technology
[24] https://lists.torproject.org/pipermail/tor-talk/2013-September/029937.html
[25] https://lists.torproject.org/pipermail/tor-talk/2013-September/029929.html
Toward a better performance measurement tool
--------------------------------------------
âI just finished [â] sketching out the requirements and a software
design for a new Torperf implementationâ announced Karsten LoesingÂ[26]
on the tor-dev mailing list.
The report begins with: âFour years ago, we presented a simple tool to
measure performance of the Tor network. This tool, called Torperf,
requests static files of three different sizes over the Tor network and
logs timestamps of various request substeps. These data turned out to be
quite useful to observe user-perceived network performance over
timeÂ[27]. However, static file downloads are not the typical use case
of a user browsing the web using Tor, so absolute numbers are not very
meaningful. Also, Torperf consists of a bunch of shell scripts which
makes it neither very user-friendly to set up and run, nor extensible to
cover new use cases.â
The specification lays out the various requirements for the new tool,
and details several experiments like visiting high profile websites with
an automated graphical web browser, downloading static files, crafting a
canonical web page, measuring hidden service performance, and checking
on upload capacity.
Karsten added âneither the requirements nor the software design are set
in stone, and the implementation, well, does not exist yet. Plenty of
options for giving feedback and helping out, and most parts donât even
require specific experience with hacking on Tor. Just in case somebodyâs
looking for an introductory Tor project to hack on.â
Saytha already wrote that this was enough material to get the
implementation startedÂ[28]. The project needs enough work that anyone
interested should get involved. Feel free to join him!
[26] https://lists.torproject.org/pipermail/tor-dev/2013-September/005386.html
[27] https://metrics.torproject.org/performance.html
[28] https://lists.torproject.org/pipermail/tor-dev/2013-September/005388.html
More monthly status reports for August 2013
-------------------------------------------
The wave of regular monthly reports from Tor project members continued
this week with Sukhbir SinghÂ[29], Matt PaganÂ[30], Ximin LuoÂ[31],
mrphsÂ[32], Pearl CrescentÂ[33], Andrew LewmanÂ[34], Mike PerryÂ[35],
Kelley MisataÂ[36], Nick MathewsonÂ[37], Jason TsaiÂ[38], TailsÂ[39],
AaronÂ[40], and Damian JohnsonÂ[41].
[29] https://lists.torproject.org/pipermail/tor-reports/2013-September/000326.html
[30] https://lists.torproject.org/pipermail/tor-reports/2013-September/000327.html
[31] https://lists.torproject.org/pipermail/tor-reports/2013-September/000328.html
[32] https://lists.torproject.org/pipermail/tor-reports/2013-September/000329.html
[33] https://lists.torproject.org/pipermail/tor-reports/2013-September/000330.html
[34] https://lists.torproject.org/pipermail/tor-reports/2013-September/000331.html
[35] https://lists.torproject.org/pipermail/tor-reports/2013-September/000332.html
[36] https://lists.torproject.org/pipermail/tor-reports/2013-September/000333.html
[37] https://lists.torproject.org/pipermail/tor-reports/2013-September/000334.html
[38] https://lists.torproject.org/pipermail/tor-reports/2013-September/000335.html
[39] https://lists.torproject.org/pipermail/tor-reports/2013-September/000336.html
[40] https://lists.torproject.org/pipermail/tor-reports/2013-September/000337.html
[41] https://lists.torproject.org/pipermail/tor-reports/2013-September/000338.html
Miscellaneous news
------------------
Not all new Tor users are computer programs! According to their latest
reportÂ[42], Tails is now booted twice as much as it was six months ago
(from 100,865 to 190,521 connections to the security feed).
[42] https://lists.torproject.org/pipermail/tor-reports/2013-September/000336.html
Thanks to Frenn vun der EnnÂ[43] for setting up a new mirrorÂ[44] of the
Tor project website.
[43] http://enn.lu/
[44] https://lists.torproject.org/pipermail/tor-mirrors/2013-September/000351.html
With the Google Summer of Code ending in two weeks, the students have
sent their penultimate reports: Kostas Jakeliunas for the
Searchable metrics archiveÂ[45], Johannes FÃrmann for EvilGeniusÂ[46],
Hareesan for the Steganography Browser ExtensionÂ[47], and
Cristian-Matei Toader for Tor capabilitiesÂ[48].
[45] https://lists.torproject.org/pipermail/tor-dev/2013-September/005380.html
[46] https://lists.torproject.org/pipermail/tor-dev/2013-September/005394.html
[47] https://lists.torproject.org/pipermail/tor-dev/2013-September/005409.html
[48] https://lists.torproject.org/pipermail/tor-dev/2013-September/005412.html
Damian Johnson announcedÂ[49] that he had completed the rewrite of
DocTor in PythonÂ[50], âa service that pulls hourly consensus
information and checks it for a host of issues (directory authority
outages, expiring certificates, etc). In the case of a problem it
notifies tor-consensus-health@Â[51], and we in turn give the authority
operator a heads up.â
[49] https://lists.torproject.org/pipermail/tor-reports/2013-September/000338.html
[50] https://gitweb.torproject.org/doctor.git
[51] https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-consensus-health
Matt Pagan has migratedÂ[52] several Frequently-Asked Questions from the
wiki to the official Tor websiteÂ[53]. This should enable more users to
find the answers they need!
[52] https://svn.torproject.org/cgi-bin/viewvc.cgi/Tor?view=revision&revision=26333
[53] https://www.torproject.org/docs/faq.html
In his previous call for help to collect more statisticsÂ[54], addressed
to bridge operators, George Kadianakis forgot to mention that an extra
line with âExtORPort 6669â needed to be added to the tor configuration
fileÂ[55]. Make sure you do have it if you are running a bridge on the
tor master branch.
[54] https://lists.torproject.org/pipermail/tor-relays/2013-August/002477.html
[55] https://lists.torproject.org/pipermail/tor-relays/2013-September/002691.html
For the upgrade of tor to the 0.2.4.x series in Tails, a tester spotted
a regression while âplaying with an ISO built from experimental, thanks
to our Jenkins autobuilderâÂ[56]. This marks a significant milestone in
the work on automated buildsÂ[57] done by several members of the
Tails team in the course of the last year!
[56] https://mailman.boum.org/pipermail/tails-dev/2013-September/003617.html
[57] https://labs.riseup.net/code/issues/5324
Tailsâ next âlow-hanging fruitâ session will be on September 21st at
08:00 UTCÂ[58]. Mark the date if you want to get involved!
[58] https://mailman.boum.org/pipermail/tails-dev/2013-September/003566.html
David Fifield gave some tips on how to setup a test infrastructureÂ[59]
for flash proxyÂ[60].
[59] https://lists.torproject.org/pipermail/tor-dev/2013-September/005402.html
[60] https://crypto.stanford.edu/flashproxy/
Marek Majkowski reportedÂ[61] on how one can use his fluxcapacitor
toolÂ[62] to get a test Tor network started with ChutneyÂ[63] ready in
only 6.5 seconds. A vast improvement over the 5 minutes he initially had
to waitÂ[64]!
[61] https://lists.torproject.org/pipermail/tor-dev/2013-September/005403.html
[62] https://github.com/majek/fluxcapacitor.git
[63] https://gitweb.torproject.org/chutney.git
[64] https://lists.torproject.org/pipermail/tor-dev/2013-September/005413.html
Eugen Leitl drew attentionÂ[65] to a new research paper which aims to
analyze the content and popularity of Hidden Services by Alex Biryukov,
Ivan Pustogarov, and Ralf-Philipp Weinmann from the University of
LuxembourgÂ[66].
[65] https://lists.torproject.org/pipermail/tor-talk/2013-September/029856.html
[66] http://cryptome.org/2013/09/tor-analysis-hidden-services.pdf
Tor Help Desk roundup
---------------------
The Tor help desk had a number of emails this week asking about the
recent stories in the New York Times, the Guardian, and ProPublica
regarding NSAâs cryptographic capabilities. Some users asked whether
there was a backdoor in Tor. Others asked if Torâs crypto was broken.
There is absolutely no backdoor in Tor. Tor project members have been
vocal in the past about how tremendously irresponsible it would be to
backdoor our usersÂ[67]. As it is a frequently-asked question, users
have been encouraged to read how the project would respond to
institutional pressureÂ[68].
The Tor project does not have any more facts about NSAâs cryptanalysis
capabilities than what has been published in newspapers. Even if there
is no actual evidence that Tor encryption is actually broken, the idea
is to remain on the safe side by using more trusted algorithms for the
Tor protocols. See above for a more detailed write-up.
[67] https://blog.torproject.org/blog/calea-2-and-tor
[68] http://www.torproject.org/docs/faq.html.en#Backdoor
Help the Tor community!
-----------------------
Tor is about protecting everyoneâs freedom and privacy. There are many
ways to helpÂ[69] but getting involved in such a busy community can be
daunting. Hereâs a selection of tasks on which one could get started:
Get tor to log the source of control port connectionsÂ[70]. It would
help in developing controller applications or libraries (like StemÂ[71])
to know which program is responsible for a given access to the control
facilities of the tor daemon. Knowledge required: C programming, basic
understanding of network sockets.
Diagnose what is currently wrong with Tor Cloud imagesÂ[72]. Tor
CloudÂ[73] is an easy way to deploy bridges and it looks like the
automatic upgrade procedure caused problems. Letâs make these virtual
machines useful again for censored users. Knowledge required: basic
understanding of Ubuntu system administration.
[69] https://www.torproject.org/getinvolved/volunteer.html.en
[70] https://bugs.torproject.org/9698
[71] https://stem.torproject.org/
[72] https://lists.torproject.org/pipermail/tor-dev/2013-September/005417.html
[73] https://cloud.torproject.org/
Upcoming events
---------------
Sep 29 | Colin at the Winnipeg Cryptoparty
| Winnipeg, Manitoba, Canada
| http://wiki.skullspace.ca/index.php/CryptoParty
|
Sep 29-01 | Tor at OpenITP Circumvention Tech Summit IV
| Berlin, Germany
| https://www.openitp.org/openitp/circumvention-tech-summit.html
|
Oct 09-10 | Andrew speaking at Secure Poland 2013
| Warszawa, Poland
| http://www.secure.edu.pl/
This issue of Tor Weekly News has been assembled by Lunar, dope457,
mttp, malaparte, harmony, Karsten Loesing, and Nick Mathewson.
Want to continue reading TWN? Please help us create this newsletter.
We still need more volunteers to watch the Tor community and report
important news. Please see the project pageÂ[74], write down your
name and subscribe to the team mailing listÂ[75] if you want to
get involved!
[74] https://trac.torproject.org/projects/tor/wiki/TorWeeklyNews
[75] https://lists.torproject.org/cgi-bin/mailman/listinfo/news-team
Attachment:
signature.asc
Description: Digital signature
-- tor-talk mailing list - tor-talk@xxxxxxxxxxxxxxxxxxxx To unsusbscribe or change other settings go to https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-talk