[Author Prev][Author Next][Thread Prev][Thread Next][Author Index][Thread Index]
Re: [tor-talk] Letsencrypt and Tor Hidden Services
Fabio Pietrosanti (naif) - lists writes:
> Hello,
>
> does anyone had looked into the upcoming Letsencrypt if it would also
> works fine with Tor Hidden Services and/or if there's some
> complexity/issues to be managed?
>
> As it would/could be interesting if Tor itself would support directly
> letsencrypt to load TLS certificate on TorHS.
Hi, I'm working on the Let's Encrypt project. A difficulty to contend
with is that the certificate industry doesn't want certs to be issued
for domain names in the long term unless the names are official in
some way -- to ensure that they have an unambiguous meaning worldwide.
The theoretical risk is that someone might use a name like .onion in
another way, for example by trying to register it as a DNS TLD through
ICANN. In that case, users might be confused because they meant to use
a name in one context but it had a different meaning that they didn't
know about in a different context.
Right now, the industry allows .onion certs temporarily, but only EV
certs, not DV certs (the kind that Let's Encrypt is going to issue),
and the approval to issue them under the current compromise is going
to expire.
It's seemed like the efforts at IETF to reserve specific "peer-to-peer
names" would be an important step in making it possible for CAs to issue
certs for these names permanently. These efforts appeared to get somewhat
bogged down at the last IETF meeting.
https://gnunet.org/ietf93dnsop
(I'm hoping to write something on the EFF site about this issue, which
may have kind of far-reaching consequences.)
Anyway, I would encourage anyone who wants to work on this issue to get
in touch with Christian Grothoff, the lead author of the P2P Names draft,
and ask what the status is and how to help out.
Theoretically the Tor Browser could come up with a different optional
mechanism for ensuring the integrity of TLS connections to hidden services
(based on the idea that virtually everyone who tries to use the hidden
services is using the Tor Browser code). I don't know whether the Tor
Browser developers currently think this is a worthwhile path. I can
think of arguments against it -- in particular, the next generation hidden
services design will provide much better cryptographic security than the
current HS mechanism does, so maybe it should just be a higher priority
to get that rolled out, rather than trying to make up new mechanisms to
help people use TLS on hidden services.
--
Seth Schoen <schoen@xxxxxxx>
Senior Staff Technologist https://www.eff.org/
Electronic Frontier Foundation https://www.eff.org/join
815 Eddy Street, San Francisco, CA 94109 +1 415 436 9333 x107
--
tor-talk mailing list - tor-talk@xxxxxxxxxxxxxxxxxxxx
To unsubscribe or change other settings go to
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-talk