mirror of
https://gitlab.torproject.org/tpo/core/tor.git
synced 2024-11-24 04:13:28 +01:00
538 lines
22 KiB
Plaintext
538 lines
22 KiB
Plaintext
$Id$
|
|
|
|
TOR (The Onion Router) Spec
|
|
|
|
Note: This is an attempt to specify TOR as it exists as implemented in
|
|
early March, 2003. It is not recommended that others implement this
|
|
design as it stands; future versions of TOR will implement improved
|
|
protocols.
|
|
|
|
0. Notation:
|
|
|
|
PK -- a public key.
|
|
SK -- a private key
|
|
K -- a key for a symmetric cypher
|
|
|
|
a|b -- concatenation of 'a' with 'b'.
|
|
a[i:j] -- Bytes 'i' through 'j'-1 (inclusive) of the string a.
|
|
|
|
All numeric values are encoded in network (big-endian) order.
|
|
|
|
Unless otherwise specified, all symmetric ciphers are DES in OFB
|
|
mode, with an IV of all 0 bytes. All asymmetric ciphers are RSA
|
|
with 1024-bit keys, and exponents of 65537.
|
|
|
|
[We will move to AES once we can assume everybody will have it. -RD]
|
|
|
|
1. System overview
|
|
|
|
[Something to start with here. Do feel free to change/expand. -RD]
|
|
|
|
Tor is an implementation of version 2 of Onion Routing.
|
|
|
|
Onion Routing is a connection-oriented anonymizing communication
|
|
service. Users build a layered block of asymmetric encryptions
|
|
(an "onion") which describes a source-routed path through a set of
|
|
nodes. Those nodes build a "virtual circuit" through the network, in which
|
|
each node knows its predecessor and successor, but no others. Traffic
|
|
flowing down the circuit is unwrapped by a symmetric key at each node,
|
|
which reveals the downstream node.
|
|
|
|
|
|
|
|
2. Connections
|
|
|
|
2.1. Establishing OR-to-OR connections
|
|
|
|
When one onion router opens a connection to another, the initiating
|
|
OR (called the 'client') and the listening OR (called the 'server')
|
|
perform the following handshake.
|
|
|
|
Before the handshake begins, the client and server know one
|
|
another's (1024-bit) public keys, IPV4 addresses, and ports.
|
|
|
|
1. Client connects to server:
|
|
|
|
The client generates a pair of 8-byte symmetric keys (one
|
|
[K_f] for the 'forward' stream from client to server, and one
|
|
[K_b] for the 'backward' stream from server to client.
|
|
|
|
The client then generates a 'Client authentication' message [M]
|
|
containing:
|
|
The client's published IPV4 address [4 bytes]
|
|
The client's published port [2 bytes]
|
|
The server's published IPV4 address [4 bytes]
|
|
The server's published port [2 bytes]
|
|
The forward key (K_f) [16 bytes]
|
|
The backward key (K_f) [16 bytes]
|
|
The maximum bandwidth (bytes/s) [4 bytes]
|
|
[Total: 48 bytes]
|
|
|
|
The client then RSA-encrypts the message with the server's
|
|
public key, and PKCS1 padding to given an encrypted message
|
|
|
|
[Commentary: 1024 bytes is probably too short, and this protocol can't
|
|
support IPv6. -NM]
|
|
[1024 is too short for a high-latency remailer; but perhaps it's
|
|
fine for us, given our need for speed and also given our greater
|
|
vulnerability to other attacks? Onions are infrequent enough now
|
|
that maybe we could handle it; but I worry it will impact
|
|
scalability, and handling more users is important.-RD]
|
|
|
|
The client then opens a TCP connection to the server, sends
|
|
the 128-byte RSA-encrypted data to the server, and waits for a
|
|
reply.
|
|
|
|
2. Server authenticates to client:
|
|
|
|
Upon receiving a TCP connection, the server waits to receive
|
|
128 bytes from the client. It decrypts the message with its
|
|
private key, and checks the PKCS1 padding. If the padding is
|
|
incorrect, or if the message's length is other than 32 bytes,
|
|
the server closes the TCP connection and stops handshaking.
|
|
|
|
The server then checks the list of known ORs for one with the
|
|
address and port given in the client's authentication. If no
|
|
such OR is known, or if the server is already connected to
|
|
that OR, the server closes the current TCP connection and
|
|
stops handshaking.
|
|
|
|
For later use, the server sets its keys for this connection,
|
|
setting K_f to the client's K_b, and K_b to the client's K_f.
|
|
|
|
The server then creates a server authentication message[M2] as
|
|
follows:
|
|
Modified client authentication [48 bytes]
|
|
A random nonce [N] [8 bytes]
|
|
[Total: 56 bytes]
|
|
The client authentication is generated from M by replacing
|
|
the client's preferred bandwidth [B_c] with the server's
|
|
preferred bandwidth [B_s], if B_s < B_c.
|
|
|
|
The server encrypts M2 with the client's public key (found
|
|
from the list of known routers), using PKCS1 padding.
|
|
|
|
The server sends the 128-byte encrypted message to the client,
|
|
and waits for a reply.
|
|
|
|
3. Client authenticates to server.
|
|
|
|
Once the client has received 128 bytes, it decrypts them with
|
|
its public key, and checks the PKCS1 padding. If the padding
|
|
is invalid, or the decrypted message's length is other than 40
|
|
bytes, the client closes the TCP connection.
|
|
|
|
The client checks that the addresses and keys in the reply
|
|
message are the same as the ones it originally sent. If not,
|
|
it closes the TCP connection.
|
|
|
|
The client updates the connection's bandwidth to that set by
|
|
the server, and generates the following authentication message [M3]:
|
|
The client's published IPV4 address [4 bytes]
|
|
The client's published port [2 bytes]
|
|
The server's published IPV4 address [4 bytes]
|
|
The server's published port [2 bytes]
|
|
The server-generated nonce [N] [8 bytes]
|
|
[Total: 20 bytes]
|
|
|
|
Once again, the client encrypts this message using the
|
|
server's public key and PKCS1 padding, and sends the resulting
|
|
128-byte message to the server.
|
|
|
|
4. Server checks client authentication
|
|
|
|
The server once again waits to receive 128 bytes from the
|
|
client, decrypts the message with its private key, and checks
|
|
the PKCS1 padding. If the padding is incorrect, or if the
|
|
message's length is other than 20 bytes, the server closes the
|
|
TCP connection and stops handshaking.
|
|
|
|
If the addresses in the decrypted message M3 match those in M
|
|
and M2, and if the nonce in M3 is the same as in M2, the
|
|
handshake is complete, and the client and server begin sending
|
|
cells to one another. Otherwise, the server closes the TCP
|
|
connection.
|
|
|
|
2.2. Establishing OP-to-OR connections
|
|
|
|
When an Onion Proxy (OP) needs to establish a connection to an OR,
|
|
the handshake is simpler because the OR does not need to verify the
|
|
OP's identity. The OP and OR establish the following steps:
|
|
|
|
1. OP connects to OR:
|
|
|
|
First, the OP generates a pair of 8-byte symmetric keys (one
|
|
[K_f] for the 'forward' stream from OP to OR, and one
|
|
[K_b] for the 'backward' stream from OR to OP.
|
|
|
|
The OP generates a message [M] in the following format:
|
|
Maximum bandwidth (bytes/s) [4 bytes]
|
|
Forward key [K_f] [16 bytes]
|
|
Backward key [K_b] [16 bytes]
|
|
[Total: 32 bytes]
|
|
|
|
The OP encrypts M with the OR's public key and PKCS1 padding,
|
|
opens a TCP connection to the OR's TCP port, and sends the
|
|
resulting 128-byte encrypted message to the OR.
|
|
|
|
2. OR receives keys:
|
|
|
|
When the OR receives a connection from an OP [This is on a
|
|
different port, right? How does it know the difference? -NM],
|
|
[Correct. The 'or_port' config variable specifies the OR port,
|
|
and the op_port variable specified the OP port. -RD]
|
|
it waits for 128 bytes of data, and decrypts the resulting
|
|
data with its private key, checking the PKCS1 padding. If the
|
|
padding is invalid, or the message is not 20 bytes long, the
|
|
OR closes the connection.
|
|
|
|
Otherwise, the connection is established, and the O is ready
|
|
to receive cells.
|
|
|
|
The server sets its keys for this connection, setting K_f to
|
|
the client's K_b, and K_b to the client's K_f.
|
|
|
|
2.3. Sending cells and link encryption
|
|
|
|
Once the handshake is complete, the ORs or OR and OP send cells
|
|
(specified below) to one another. Cells are sent serially,
|
|
encrypted with the 3DES-OFB keystream specified by the handshake
|
|
protocol. Over a connection, communicants encrypt outgoing cells
|
|
with the connection's K_f, and decrypt incoming cells with the
|
|
connection's K_b.
|
|
|
|
[Commentary: This means that OR/OP->OR connections are malleable; I
|
|
can flip bits in cells as they go across the wire, and see flipped
|
|
bits coming out the cells as they are decrypted at the next
|
|
server. I need to look more at the data format to see whether
|
|
this is exploitable, but if there's no integrity checking there
|
|
either, I suspect we may have an attack here. -NM]
|
|
[Yes, this protocol is open to tagging attacks. The payloads are
|
|
encrypted inside the network, so it's only at the edge node and beyond
|
|
that it's a worry. But adversaries can already count packets and
|
|
observe/modify timing. It's not worth putting in hashes; indeed, it
|
|
would be quite hard, because one of the sides of the circuit doesn't
|
|
know the keys that are used for de/encrypting at each hop, so couldn't
|
|
craft hashes anyway. See the Bandwidth Throttling (threat model)
|
|
thread on http://archives.seul.org/or/dev/Jul-2002/threads.html. -RD]
|
|
[Even if I don't control both sides of the connection, I can still
|
|
do evil stuff. For instance, if I can guess that a cell is a
|
|
TOPIC_COMMAND_BEGIN cell to www.slashdot.org:80 , I can change the
|
|
address and port to point to a machine I control. -NM]
|
|
|
|
3. Cell Packet format
|
|
|
|
The basic unit of communication for onion routers and onion
|
|
proxies is a fixed-width "Cell." Each Cell contains the following
|
|
fields:
|
|
|
|
ACI (anonymous circuit identifier) [2 bytes]
|
|
Command [1 byte]
|
|
Length [1 byte]
|
|
Sequence number (unused, set to 0) [4 bytes]
|
|
Payload (padded with 0 bytes) [120 bytes]
|
|
[Total size: 128 bytes]
|
|
|
|
The 'Command' field holds one of the following values:
|
|
0 -- PADDING (Padding) (See Sec 6.2)
|
|
1 -- CREATE (Create a circuit) (See Sec 4)
|
|
2 -- DATA (End-to-end data) (See Sec 5)
|
|
3 -- DESTROY (Stop using a circuit) (See Sec 4)
|
|
4 -- SENDME (For flow control) (See Sec 6.1)
|
|
|
|
The interpretation of 'Length' and 'Payload' depend on the type of
|
|
the cell.
|
|
PADDING: Length is 0; Payload is 120 bytes of 0's.
|
|
CREATE: Length is a value between 1 and 120; the first 'length'
|
|
bytes of payload contain a portion of an onion.
|
|
DATA: Length is a value between 4 and 120; the first 'length'
|
|
bytes of payload contain useful data.
|
|
DESTROY: Neither field is used.
|
|
SENDME: Length encodes a window size, payload is unused.
|
|
|
|
Unused fields are filled with 0 bytes. The payload is padded with
|
|
0 bytes.
|
|
|
|
PADDING cells are currently used to implement connection
|
|
keepalive. ORs and OPs send one another a PADDING cell every few
|
|
minutes.
|
|
|
|
CREATE and DESTROY cells are used to manage circuits; see section
|
|
4 below.
|
|
|
|
DATA cells are used to send commands and data along a circuit; see
|
|
section 5 below.
|
|
|
|
SENDME cells are used for flow control; see section 6 below.
|
|
|
|
4. Onions and circuit management
|
|
|
|
4.1. Setting up circuits
|
|
|
|
An onion is a multi-layered structure, with one layer for each node
|
|
in a circuit. Each (unencrypted) layer has the following fields:
|
|
|
|
Version [1 byte]
|
|
Back cipher [4 bits]
|
|
Forward cipher [4 bits]
|
|
Port [2 bytes]
|
|
Address [4 bytes]
|
|
Expiration time [4 bytes]
|
|
Key seed material [16 bytes]
|
|
[Total: 28 bytes]
|
|
|
|
The value of Version is currently 2.
|
|
|
|
The forward and backward ciphers fields can take the following values:
|
|
0: Identity
|
|
1: Single DES in OFB
|
|
2: RC4
|
|
3: Triple DES in OFB
|
|
|
|
The port and address field denote the IPV4 address and port of
|
|
the next onion router in the circuit, or are set to 0 for the
|
|
last hop.
|
|
|
|
The expiration time is a number of seconds since the epoch (1
|
|
Jan 1970); by default, it is set to the current time plus one
|
|
day.
|
|
|
|
When constructing an onion to create a circuit from OR_1,
|
|
OR_2... OR_N, the onion creator performs the following steps:
|
|
|
|
1. Let M = 100 random bytes.
|
|
|
|
2. For I=N downto 1:
|
|
|
|
A. Create an onion layer L, setting Version=2,
|
|
BackCipher=DES/OFB(1), ForwardCipher=DES/OFB(2),
|
|
ExpirationTime=now + 1 day, and Seed=16 random bytes.
|
|
|
|
If I=N, set Port=Address=0. Else, set Port and Address to
|
|
the IPV4 port and address of OR_{I+1}.
|
|
|
|
B. Let M = L | M.
|
|
|
|
C. Let K1_I = SHA1(Seed).
|
|
Let K2_I = SHA1(K1_I).
|
|
Let K3_I = SHA1(K2_I).
|
|
|
|
D. Encrypt the first 128 bytes of M with the RSA key of
|
|
OR_I, using no padding. Encrypt the remaining portion of
|
|
M with DES/OFB, using K1_I as a key and an all-0 IV.
|
|
|
|
3. M is now the onion.
|
|
|
|
To create a connection using the onion M, an OP or OR performs the
|
|
following steps:
|
|
|
|
1. If not already connected to the first router in the chain,
|
|
open a new connection to that router.
|
|
|
|
2. Choose an ACI not already in use on the connection with the
|
|
first router in the chain. If our address/port pair is
|
|
numerically higher than the address/port pair of the other
|
|
side, then let the high bit of the ACI be 1, else 0.
|
|
|
|
3. To send M over the wire, prepend a 4-byte integer containing
|
|
Len(M). Call the result M'. Let N=ceil(Len(M')/120).
|
|
Divide M' into N chunks, such that:
|
|
Chunk_I = M'[(I-1)*120:I*120] for 1 <= I <= N-1
|
|
Chunk_N = M'[(N-1)*120:Len(M')]
|
|
|
|
4. Send N CREATE cells along the connection, setting the ACI
|
|
on each to the selected ACI, setting the payload on each to
|
|
the corresponding 'Chunk_I', and setting the length on each
|
|
to the length of the payload.
|
|
|
|
Upon receiving a CREATE cell along a connection, an OR performs
|
|
the following steps:
|
|
|
|
1. If we already have an 'open' circuit along this connection
|
|
with this ACI, drop the cell.
|
|
|
|
Otherwise, if we have no circuit along this connection with
|
|
this ACI, let L = the integer value of the first 4 bytes of
|
|
the payload. Create a half-open circuit with this ACI, and
|
|
begin queueing CREATE cells for this circuit.
|
|
|
|
Otherwise, we have a half-open circuit. If the total payload
|
|
length of the CREATE cells for this circuit is exactly equal
|
|
to the onion length specified in the first cell (minus 4), then
|
|
process the onion. If it is more, then tear down the circuit.
|
|
|
|
2. Once we have a complete onion, decrypt the first 128 bytes
|
|
of the onion with this OR's RSA private key, and extract
|
|
the outmost onion layer. If the version, back cipher, or
|
|
forward cipher is unrecognized, or the expiration time is
|
|
in the past, then tear down the circuit (see section 4.2).
|
|
|
|
Compute K1 through K3 as above. Use K1 to decrypt the rest
|
|
of the onion using DES/OFB.
|
|
|
|
If we are not the exit node, remove the first layer from the
|
|
decrypted onion, and send the remainder to the next OR
|
|
on the circuit, as specified above. (Note that we'll
|
|
choose a different ACI for this circuit on the connection
|
|
with the next OR.)
|
|
|
|
As an optimization, OR implementations may delay processing onions
|
|
until a break in traffic allows time to do so without harming
|
|
network latency too greatly.
|
|
|
|
4.2. Tearing down circuits
|
|
|
|
Circuits are torn down when an unrecoverable error occurs along
|
|
the circuit, or when all topics on a circuit are closed and the
|
|
circuit's intended lifetime is over.
|
|
|
|
To tear down a circuit, an OR or OP sends a DESTROY cell with that
|
|
direction's ACI to the adjacent nodes on that circuit.
|
|
|
|
Upon receiving a DESTROY cell, an OR frees resources associated
|
|
with the corresponding circuit. If it's not the start or end of the
|
|
circuit, it sends a DESTROY cell for that circuit to the next OR in
|
|
the circuit. If the node is the start or end of the circuit, then
|
|
it tears down any associated edge connections (see section 5.1).
|
|
|
|
After a DESTROY cell has been processed, an OR ignores all data or
|
|
destroy cells for the corresponding circuit.
|
|
|
|
4.3. Routing data cells
|
|
|
|
When an OR receives a DATA cell, it checks the cell's ACI and
|
|
determines whether it has a corresponding circuit along that
|
|
connection. If not, the OR drops the DATA cell.
|
|
|
|
Otherwise, if the OR is not at the OP edge of the circuit (that is,
|
|
either an 'exit node' or a non-edge node), it de/encrypts the length
|
|
field and the payload with DES/OFB, as follows:
|
|
'Forward' data cell (same direction as onion):
|
|
Use K2 as key; encrypt.
|
|
'Back' data cell (opposite direction from onion):
|
|
Use K3 as key; decrypt.
|
|
|
|
Otherwise, if the data cell has arrived to the OP edge of the circuit,
|
|
the OP de/encrypts the length and payload fields with DES/OFB as
|
|
follows:
|
|
OP sends data cell:
|
|
For I=1...N, decrypt with K2_I.
|
|
OP receives data cell:
|
|
For I=N...1, encrypt with K3_I.
|
|
|
|
Edge nodes process the length and payload fields of DATA cells as
|
|
described in section 5 below.
|
|
|
|
5. Application connections and topic management
|
|
|
|
5.1. Topics and TCP streams
|
|
|
|
Within a circuit, the OP and the exit node use the contents of DATA
|
|
packets to tunnel TCP connections ("Topics") across circuits.
|
|
These connections are initiated by the OP.
|
|
|
|
The first 4 bytes of each data cell are reserved as follows:
|
|
Topic command [1 byte]
|
|
Unused, set to 0. [1 byte]
|
|
Topic ID [2 bytes]
|
|
|
|
The recognized topic commands are:
|
|
1 -- TOPIC_BEGIN
|
|
2 -- TOPIC_DATA
|
|
3 -- TOPIC_END
|
|
4 -- TOPIC_CONNECTED
|
|
5 -- TOPIC_SENDME
|
|
|
|
All DATA cells pertaining to the same tunneled connection have the
|
|
same topic ID.
|
|
|
|
To create a new anonymized TCP connection, the OP sends a
|
|
TOPIC_BEGIN data cell with a payload encoding the address and port
|
|
of the destination host. The payload format is:
|
|
ADDRESS | ',' | PORT | '\000'
|
|
where ADDRESS may be a DNS hostname, or an IPv4 address in
|
|
dotted-quad format; and where PORT is encoded in decimal.
|
|
|
|
Upon receiving this packet, the exit node resolves the address as
|
|
necessary, and opens a new TCP connection to the target port. If
|
|
the address cannot be resolved, or a connection can't be
|
|
established, the exit node replies with a TOPIC_END cell.
|
|
Otherwise, the exit node replies with a TOPIC_CONNECTED cell.
|
|
|
|
The OP waits for a TOPIC_CONNECTED cell before sending any data.
|
|
Once a connection has been established, the OP and exit node
|
|
package stream data in TOPIC_DATA cells, and upon receiving such
|
|
cells, echo their contents to the corresponding TCP stream.
|
|
[XXX Mention zlib encoding. -NM]
|
|
|
|
When one side of the TCP stream is closed, the corresponding edge
|
|
node sends a TOPIC_END cell along the circuit; upon receiving a
|
|
TOPIC_END cell, the edge node closes the corresponding TCP stream.
|
|
|
|
[This should probably become:
|
|
|
|
When one side of the TCP stream is closed, the corresponding edge
|
|
node sends a TOPIC_END cell along the circuit; upon receiving a
|
|
TOPIC_END cell, the edge node closes its side of the corresponding
|
|
TCP stream (by sending a FIN packet), but continues to accept and
|
|
package incoming data until both sides of the TCP stream are
|
|
closed. At that point, the edge node sends a second TOPIC_END
|
|
cell, and drops its record of the topic. -NM]
|
|
|
|
6. Flow control
|
|
|
|
6.1. Link throttling
|
|
|
|
As discussed above in section 2.1, ORs and OPs negotiate a maximum
|
|
bandwidth upon startup. The communicants only read up to that
|
|
number of bytes per second on average, though they may use mechanisms
|
|
to handle spikes (eg token buckets).
|
|
|
|
Communicants rely on TCP's default flow control to push back when they
|
|
stop reading, so nodes that don't obey this bandwidth limit can't do
|
|
too much damage.
|
|
|
|
6.2. Link padding
|
|
|
|
Currently nodes are not required to do any sort of link padding or
|
|
dummy traffic. Because strong attacks exist even with link padding,
|
|
and because link padding greatly increases the bandwidth requirements
|
|
for running a node, we plan to leave out link padding until this
|
|
tradeoff is better understood.
|
|
|
|
6.3. Circuit flow control
|
|
|
|
To control a circuit's bandwidth usage, each node keeps track of
|
|
how many data cells it is allowed to send to the next hop in the
|
|
circuit. This 'window' value is initially set to 1000 data cells
|
|
in each direction (cells that are not data cells do not affect
|
|
the window). Each edge node on a circuit sends a SENDME cell
|
|
(with length=100) every time it has received 100 data cells on the
|
|
circuit. When a node receives a SENDME cell for a circuit, it increases
|
|
the circuit's window in the corresponding direction (that is, for
|
|
sending data cells back in the direction from which the sendme arrived)
|
|
by the value of the cell's length field. If it's not an edge node,
|
|
it passes an equivalent SENDME cell to the next node in the circuit.
|
|
|
|
If the window value reaches 0 at the edge of a circuit, the OR stops
|
|
reading from the edge connections. (It may finish processing what
|
|
it's already read, and queue those cells for when a SENDME cell
|
|
arrives.) Otherwise (when not at the edge of a circuit), if the
|
|
window value is 0 and a data cell arrives, the node must tear down
|
|
the circuit.
|
|
|
|
6.4. Topic flow control
|
|
|
|
Edge nodes use TOPIC_SENDME data cells to implement end-to-end flow
|
|
control for individual connections across circuits. As with circuit
|
|
flow control, edge nodes begin with a window of cells (500) per
|
|
topic, and increment the window by a fixed value (50) upon receiving
|
|
a TOPIC_SENDME data cell. Edge nodes initiate TOPIC_SENDME data
|
|
cells when
|
|
|
|
7. Directories and routers
|
|
|
|
[????]
|
|
|
|
|