[Author Prev][Author Next][Thread Prev][Thread Next][Author Index][Thread Index]

Re: [tor-bugs] #18787 [Tor Browser]: Initialize the SOCKS password to random offset at start

#18787: Initialize the SOCKS password to random offset at start
-------------------------+--------------------------
 Reporter:  cypherpunks  |          Owner:  tbb-team
     Type:  enhancement  |         Status:  new
 Priority:  Medium       |      Milestone:
Component:  Tor Browser  |        Version:
 Severity:  Normal       |     Resolution:
 Keywords:               |  Actual Points:
Parent ID:               |         Points:
 Reviewer:               |        Sponsor:
-------------------------+--------------------------

Old description:

> When Tor Browser starts, the SOCKS password is initialized to 0. Each
> time a new circuit is to be used, it is incremented. Unfortunately, if
> the browser is restarted, it is reset to 0, and it may cause the browser
> to re-use the same circuits. This is obviously bad for likability. A
> workaround for this would be to randomize the SOCKS password to a random
> offset when Tor Browser starts up, so it is never initialized with a
> previously used password and thus previously used circuit.

New description:

 When Tor Browser starts, the SOCKS password is initialized to 0. Each time
 a new circuit is to be used, it is incremented. Unfortunately, if the
 browser is restarted, it is reset to 0, and it may cause the browser to
 re-use the same circuits. This is obviously bad for linkability. A
 workaround for this would be to randomize the SOCKS password to a random
 offset when Tor Browser starts up, so it is never initialized with a
 previously used password and thus previously used circuit.

--

Comment (by arma):

 I was the one who suggested the random offset approach -- like other
 crypto protocols do it. I'm open to hearing an even better idea though.

 (Another nice side effect of initializing it to a random number is that
 something that later breaks in and learns the number can't discover how
 many times it's been incremented. Not a big deal but a nice side effect.)

--
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/18787#comment:1>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online
_______________________________________________
tor-bugs mailing list
tor-bugs@xxxxxxxxxxxxxxxxxxxx
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs