I wanted to know that if we are using onion routing in P2P networks, and when the data comes from the provider to onion proxy(proxy connected with requester), the data is not any more encrypted, meaning after removal of its encryption layer, Onion Proxy sends the plain text to requester. Is there a way to solve that message from provider to requester remains hidden from Onion Proxy? Regards

  • ToR provides anonymity, not (strictly) confidentiality. You should look elsewhere for tools that provide confidentiality, and use them alongside ToR to yield confidentiality and anonymity. This is all just a very formal way of saying; ToR mixes your traffic up, the traffic itself, and any encryption thereof, is down to you. – lynks Jan 24 '13 at 12:51
  • @lynks Thankyou. Yes I think I need crypto tool maybe to solve the confidentiality prob elm. – Alexandera Jan 24 '13 at 13:08

Tor and similar anonymity networks work by reducing or removing the correlation between the requester's address, the server's address, and the content. So, in the case of Tor at least, an encrypted chain of nodes is created such that each node can only decrypt one layer of crypto.

  • The first node knows the source IP and the second node IP.
  • The second node knows the first node IP and the third node (exit node) IP.
  • The third node (exit node) knows the second node IP, the target server IP, and the content.
  • The target server knows the exit node IP and the content.

There are two ways to mitigate the plaintext content issue. The first is to provide a server that operates entirely within the network, which in Tor is a hidden service. This allows the target server to be a Tor node too, so that all content is encrypted during transport. This also makes route correlation attacks more difficult, since the nodes in the chain can't tell if they're talking to another proxy node or the real target.

The second option is to use HTTPS on the server, so that all traffic between the exit node and the target server is encrypted. This provides similar content security to normal web browsing, with the added anonymity benefits. The downside of this technique is that a compromised exit node might use a tool such as sslstrip or sslsniff to man-in-the-middle the connection and interfere with the content. There are many ways to protect against this, but one of the best is to use HSTS alongside a proper CA-issued SSL certificate instead of a self-signed one.

  • @Polynomail..Thanks a lot for your answer,Your first solution sounds interesting. Actually I am implementing fingerprinting protocol for P2P network. And for transferring of data between provider and requester, I am using Onion-routing. The problem is where the Onion-Proxy knows the plain-text. Many Onion-Proxies can collude together to get the fingerprinted copy as they know the plain text version. – Alexandera Jan 24 '13 at 13:03
  • Using a Tor hidden service is a good way to mitigate that risk. Either that, or use a VPN with IPsec tunnelling. – Polynomial Jan 24 '13 at 13:04

Put briefly. Yes, it is possible to protect the content, but that isn't onion routing. Networking is based on the concept of multiple layers building on each other, providing different capabilities. Current turning on and off on a wire becomes ones and zeroes between two interfaces, which then understand those ones and zeros to form a channel to exchange information to be passed on to some IP and then on top of the IP addressing you have a protocal that determines the format of the packets. This is just the first 4 levels that are used by all TCP/IP or UDP/IP traffic.

Onion routing is a similar layer put on top of all that to handle routing of information in a way that is difficult to track. It isn't designed to provide encryption. Any protocol that is designed to provide that can simply be used along the channel that onion routing produces though. This is no different from an SSL tunnel operating on the normal IP routing of the internet. The only difference is how the information is routed.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.