iLab Onion Routing Benjamin Hof hof@in.tum.de Lehrstuhl für Netzarchitekturen und Netzdienste Fakultät für Informatik Technische Universität München Lab 9 – 18ss 1 / 36
Outline Introduction Trust architecture Protocols Attacks Further topics 2 / 36
Outline Introduction Trust architecture Protocols Attacks Further topics 3 / 36
Anonymity Anonymity set: set of people indistinguishable to the adversary ◮ size ◮ diversity This is not enough! 4 / 36
Separation of network identity and routing is the service provided by onion routing. 5 / 36
Overlay network 6 / 36
Overlay network 6 / 36
Onion skins server guard middle exit Circuits: nested encrypted connections via three relays 7 / 36
Design goals ◮ anonymous routing non-goals are, e.g. ◮ anonymity ◮ global passive adversary ◮ end to end correlation attacker power ◮ limited active and passive network attacks ◮ compromised relays 8 / 36
Attacker model 9 / 36
Attacker model 9 / 36
Attacker model 9 / 36
◮ you are anonymous to the service you visit ◮ your network does not see which services you visit 10 / 36
Tor Tor is an implementation of onion routing. ◮ censorship circumvention ◮ open design process ◮ low latency anonymity system Software ◮ tor ◮ obfsproxy ◮ Tor Browser ◮ . . . lots of ecosystem around it 11 / 36
Outline Introduction Trust architecture Protocols Attacks Further topics 12 / 36
Components onion router (OR) ◮ identity key ◮ relays traffic directory authority (DA) ◮ authority identity key ◮ manage list of onion routers ◮ agree on unified network view with other DAs onion proxy (OP) ◮ build circuit consisting of onion routers ◮ ingest application traffic 13 / 36
Relationships DA DA DA OR OP OR OP OR OR 14 / 36
Relationships DA DA DA OR OP OR OP OR OR 14 / 36
Directory authority: consensus directory authority 0 addr, port, pub key hourly vote addr, port, pub key other directory authorities . . . ◮ authority identity key ◮ authority signing key 15 / 36
Descriptor ◮ nickname ◮ IP, port ◮ identity key (long-term KSK) ◮ signing key (medium-term) ◮ onion key ◮ published date ◮ version ◮ lots of other info, e.g. bandwidth ◮ signature 16 / 36
Joining the network onion router ◮ upload descriptor ◮ retrieve consensus DA functionality check DA voting onion proxy ◮ retrieve consensus ◮ build circuits 17 / 36
Outline Introduction Trust architecture Protocols Attacks Further topics 18 / 36
Overview stream relay circuit extend OR1 OR2 OR3 TLS + link protocol 19 / 36
Overview ◮ OR connections protected with combined TLS and cell protocol handshake ◮ all Tor communication in cells inside TLS ◮ authenticated ECDH handshakes (ntor) to build circuits ◮ “onion skin” layered encryption on the relay subprotocol cells 20 / 36
Cells circuit id command length payload 4 octets 1 octet 2 octets may be padded ◮ VERSIONS: version negotiation ◮ CERTS: certificates ◮ CREATE2: ntor handshake DH ◮ CREATED2: ntor handshake DH, authenticator ◮ RELAY: subprotocol (data) ◮ DESTROY: reason for tearing down circuit ◮ and many more This is the version 4 link protocol. Most cells have fixed size 514 octets. 21 / 36
Relay subprotocol relay cmd recognized stream id digest length payload 1 octet 2 octets 2 octets 4 octets 2 octets padded ◮ RELAY_EXTEND2 (control): CREATE2 ◮ RELAY_EXTENDED2 (control): CREATED2 ◮ RELAY_RESOLVE: very simple DNS query ◮ RELAY_RESOLVED: DNS response ◮ RELAY_BEGIN: address, port ◮ RELAY_CONNECTED: address, port ◮ RELAY_DATA: original TCP SDU ◮ RELAY_END: termination reason ◮ and many more This is where the encryption happens. 22 / 36
Link handshake OR1 OR2 TLS VERSION T I N F O R T S , N E O N , C E V E R S I authenticate using TLS info N E T I N F O ◮ version 3 handshake flow ◮ TLS connection reused for all circuits between OR1 and OR2 23 / 36
Circuit setup ◮ extend circuits by one hop at at time ◮ connect a stream to a TCP/IP destination ◮ then: relay cells with application content Spare circuits are created ahead of time. 24 / 36
Relay protocol: circuit extension OP guard middle CREATE2 CREATED2 EXTEND2(CREATE2) C R E A T E 2 2 A T E D C R E EXTENDED2(CREATED2) 25 / 36
ntor handshake ◮ one-way authenticated DH key agreement ◮ no signatures or RSA involved ◮ two DH operations ◮ forward security ◮ responder authenticated ◮ initiator anonymous ◮ security proofs for: key agreement, authentication, anonymity 26 / 36
ntor (simplified) 1. Bob: ( b , B ) ← GenDH () 2. Alice learns authentic ID B , B . Alice Bob ( x , X ) ← GenDH () ID B , X ( y , Y ) ← GenDH () dh := yX || bX ( sk ′ , sk ) := H ( dh || ID B || X || Y ) t B := Mac sk ′ ( ID B || X || Y ) t B Y , dh := xY || xB ( sk ′ , sk ) := H ( dh || ID B || X || Y ) Vrfy sk ′ ( t B , ( ID B || X || Y )) 27 / 36
Processing of a relay cell cid cmd [encrypted] OR2: Dec k 2 ( · ) recog ? → pass along circuit = 0 OR3: Dec k 3 ( · ) recog ? = 0 Vrfy k ( MAC , cell ) cid cmd cmd recog sid digest len payload 28 / 36
Outline Introduction Trust architecture Protocols Attacks Further topics 29 / 36
sslstrip exit server 30 / 36
Correlation server 31 / 36
Correlation server → guard nodes 31 / 36
Outline Introduction Trust architecture Protocols Attacks Further topics 32 / 36
Censorship circumvention Bridges ◮ “secret” relays ◮ “pluggable transports” as obfuscation layer 33 / 36
Onion services ◮ location hidden services / responder anonymity ◮ service offering without disclosing network identity ◮ name/URL: hash of public key ◮ authenticating URL: tunnel TCP connections to an OR currently not all properties secure 34 / 36
Circuit setup (conceptual) DHT OP RP IP OS IP IP 35 / 36
Circuit setup (conceptual) DHT descriptor: IPs, k pub OP RP IP OS IP IP 35 / 36
Circuit setup (conceptual) DHT OP RP IP OS IP IP 35 / 36
Circuit setup (conceptual) DHT OP RP IP OS RP IP IP 35 / 36
Circuit setup (conceptual) DHT OP RP IP OS IP IP 35 / 36
Use cases ◮ responder authentication ◮ break out of NAT ◮ hide server location Example ◮ Facebook social network: https://facebookcorewwwi.onion ◮ DuckDuckGo search engine: http://3g2upl4pq6kufc4m.onion ◮ Debian GNU/Linux operating system mirror: http://vwakviie2ienjx6t.onion ◮ Ricochet messenger Always offer additionally to TLS. 36 / 36
Recommend
More recommend
