full-disclosure - Re: tor vulnerabilities?

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <6629.1372871409@turing-police.cc.vt.edu>
Date: Wed, 03 Jul 2013 13:10:09 -0400
From: Valdis.Kletnieks@...edu
To: Michael T <mt2410689@...il.com>
Cc: "full-disclosure@...ts.grok.org.uk" <full-disclosure@...ts.grok.org.uk>
Subject: Re: tor vulnerabilities?

On Wed, 03 Jul 2013 10:54:09 -0500, Michael T said:

> What about keysigning among tor operators?  I trust top_op1, and he trusts
> top_op2, 3, and 4, so I can trust them as well.

Chunk it through - if you make keysigning mandatory, you're probably going
to see a drop from the current 4,000 or so relays down to maybe 500 or so.
At which point it becomes *easier* for a group to subvert enough servers
to deanonymize people.

And how do you get a new Tor relay set up if a key signing is mandatory?

There's also a more subtle problem. A PGP-style web-of-trust doesn't say
anything about whether you should actually trust the *content* of signed data
as far as content goes, only that it's from the signature it claims to be.  So
if you sign my Tor key, what are you *actually* attesting to?  Only the fact
that I run a Tor relay or three.  You aren't actually saying anything about
whether or not I'm part of the cabal trying to take over Tor.

So unless signing a key includes an attestation/verification that the key
you're signing isn't for a server that's part of the cabal (and how would
you verify that before you sign?), the key signing doesn't actually add any
real security.

Content of type "application/pgp-signature" skipped

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/