How insecure are self-signed certificates?
Why does Tor still use them?
Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.Sign up to join this community
To answer this question, we first have to think about why our instinct is to not trust self-signed certificates. For example, on the world wide web, browsers inherently do not trust self-signed certificates for good reason. When we connect to https://www.paypal.com/, we want to be sure that the certificate that our browser sees for www.paypal.com does in fact belong to Paypal. We rely on certificate authorities (CA's) for this verification, and our browser warns us if the certificate served by a site is not signed by a trusted CA. Through this process, we feel assured that we are truly connecting to www.paypal.com, and not an MITM attacker running a server using a self-signed certificate to impersonate www.paypal.com. Then, we feel safe in proceeding with entering our login credentials and banking information into the site.
But, connections to Tor relay nodes are different. We don't enter login credentials into Tor relay nodes, nor do we enter banking or other sensitive information into Tor relay nodes. Tor relay nodes simply strip-off one layer of encryption from the Tor onion, then pass the rest onto the next node. In most cases, Tor relay nodes cannot see the plaintext requests and responses to/from the end server, because they are encrypted with at least one more layer of encryption (unless the node is an exit node, and the user is connecting to a server through Tor using in insecure protocol such as http).
Notwithstanding, every Tor relay node has a long term identity signing key. The node's certificate is self-signed using its identity key, and the identity key appears in the directory listing for the node. Then, when the Tor client builds a circuit, it uses this identity key to authenticate the node. For more information, see https://support.torproject.org/ca/about/key-management/ and https://gitweb.torproject.org/torspec.git/tree/tor-spec.txt (section 2).
So, an attempt by an attacker to impersonate a relay using a MITM attack would be unlikely to succeed. And, even if it did succeed, it would not bear any more fruit for the attacker than he would reap by simply running his own Tor node. But, bear in mind that anyone can run a Tor node, including bad actors. This is why the Tor protocol ensures that the user's circuit will consist of at least three relay nodes (so that no single node can see both the user's IP and the IP of the server that they are connection to), and the user hopes that these three nodes do not collude.