5

While being fascinated by how it is possible to create hidden services with Tor, there's a few details around the address collision issue I can't seem to wrap my head around.

Quote from Hidden Service Names on the Tor wiki (my emphasis):

The output of SHA1 has a length of 160 bit. To make handling the URLs more convenient we only use the first half of the hash, so 80 bit remain. Taking advantage of the ​Birthday Attack, entropy can be reduced to 40 bit. That's why collisions could be found with moderate means. This is not a problem for Tor since all an attacker might be able to do is create two different public keys that match the same .onion name. He would not be able to impersonate already existing hidden services.

So if I were to trust only the address of a hidden service, how is it that it cannot be impersonated?

  • If two services had announced themselves with each their own public key, where both hash to the same address, how do I know which service is my intended one when I try to visit the address?

  • How, for that matter, is the destination decided? Will my onion proxy tell me that there are 2 services for this address, present each public key and ask me to choose?

  • If my service for some reason went down and another had announced itself, again its public key hashing to the same address, how do I know that this service is not the one I intend to visit? If I have visited it before, will my onion proxy warn me that the key has changed? What if I hadn't ever visited it?

It seems to me that in order to authenticate a service, it's not enough to trust its address, I need to obtain and trust its public key separately and in advance of looking up the service in the Tor network. Am I incorrect in this conclusion?

  • 3
    I think this will be migrated to the Tor Stack Exchange, but you don't seem incorrect in your conclusion. The papers I've read on the Tor design state that the entire hash should be used to index a hidden service. Partials seem like a bad idea. – RoraΖ Nov 18 '14 at 17:05
1

Being able to generate a pair of keys with the same .onion address is of no help when trying to impersonate an existing service. Impersonation requires generating a key with an existing address, which is a preimage attack, not a collision attack, and so the full 80 bits of address length are providing security.

80 bits of security is considered adequate at present, although just barely so.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.