Onion names reserved by the IETF

https://blog.torproject.org/blog/landmark-hidden-services-onion-names-reserved-ietf

by finnn • 11 years ago

161 66 11 years ago

blog.torproject.org

duskwuff• 11 years ago

It's the sensible, pragmatic thing for them to do. Allowing .onion to be allocated as a "real" TLD would just be disruptive and confusing at this point.

The implications with regard to SSL certificates are interesting, though, and I'm curious how long it'll take for SSL providers to start supporting that. :)

finnn• 11 years ago

Digicert has already issued at least one certificate to a .onion address[0]. See [1] for additional info

[0] https://blog.digicert.com/anonymous-facebook-via-tor/

[1] https://blog.digicert.com/the-current-state-of-onion-certifi...

celticninja• 11 years ago

blockchain.info also has an SSL cert on their .onion site

jlgaddis5• 11 years ago

What are the benefits to using SSL/TLS certificates on a hidden service?

Perhaps a better question is: are there any benefits other than just providing an additional layer of encryption that a potential attacker would have to defeat -- there's already end-to-end encryption when using hidden services (even if there isn't any encryption at the application layer)?

ETA: I just remembered that hidden services use 1024-bit RSA keys and there's been some arguments lately that that may not be enough bits. For some sites, using (at least) a 2048-bit key may be necessary.

jandrese• 11 years ago

Well, it would encrypt the traffic from your TOR endpoint to the application. Usually this is on the same box so it's not a big deal, but not always.

vbezhenar• 11 years ago

EV certificates add green buttons with company names. Registrar checked that this company indeed exists and legal. So you can be sure, that you didn't mistype URL. And may be some users are comfortable with HTTPS scheme.

Another concern is that major browsers might obsolete HTTP scheme, so their UI will warn user about insecure connection. I'm not sure whether browsers will be able to distinct between onion sites and regular sites in that aspect.

Natanael_L7• 11 years ago

Facebook does Tor - load balancer - SSL terminator - servers, and the load balancers might not be trusted. So here using SSL protects against malicious load balancers.

JulianMorrison• 11 years ago

Authentication. You're talking to foo.onion, not a man in the middle - either at the start, or the end of the Tor pipeline.

vegabook3• 11 years ago

Tor gets an upvote from the establishment. Is that furthering the cause of privacy? So we'll now get more exit nodes?

Personally believe that nothing less than a wholesale transport-layer alternative to the internet is necessary to maintain communications freedom. Not far fetched to suggest that rooftop antennae running peer-to-peer mesh networks will gather momentum in coming years. Not to replace the internet, just as backup, to keep centralised government interests and moneymen at bay.

DasIch2• 11 years ago

It's not far fetched to suggest people start seriously running peer-to-peer mesh networks, it's ridiculous. You won't be able to convince the people who know about them to run them and you'd need to convince far more people than that to actually get mesh networks to run reasonably well.

This is ignoring the technical and legal challenges not to mention the fact that people have tried this for a very long time now and they've failed to get anywhere significant for just as long.

vegabook3• 11 years ago

If your criteria for "getting anywhere significant" is to be even within two orders of magnitude as performant as the current internet, then you are correct. If however the aim is to build a distributed, no single point of failure/control, kbps-class, backup communications system, that's primarily community-based, and that is NOT controlled by any corporation, ISP, or government, then there are many such networks already in existence. They're based on wifi, and completely legal. Clearly they're hobby projects but that doesn't make them uninteresting or indeed, potentially extremely useful in low-delta scenarios of societal breakdown and/or centralised oppression.

splitdisk• 11 years ago

Now we just need to find a Tor user with enough money to buy EV certificates...

detaro4• 11 years ago

like facebook?

https://facebookcorewwwi.onion/

banthar2• 11 years ago

Isn't SSL on .onion domains redundant? It makes sense for onion -> open web, but shouldn't onion -> onion connections be already both authenticated and encrypted?

radlad4• 11 years ago

I believe the exit node may still be able to view traffic in plaintext. This is part of the reason that running an exit node is so "dangerous" in the US.

edit: Though with a quick Google, I'm led to believe that an exit node is only important when you are leaving the onion network (i.e. when entering into the Internet), and thus it sounds like SSL on a hidden service would indeed be superfluous to me.

However, SSL also proves authenticity, not just encryption. It would let you know that the hidden service you are accessing is indeed who you think it is.

banthar2• 11 years ago

That's onion -> web. If you are connecting to onion address, your packets do not enter plain text internet. Unless you are using some sort of "enter node".

noondip• 11 years ago

Exit nodes are not involved when making connections to Hidden Services. See https://www.torproject.org/docs/hidden-services.html.en

icebraining2• 11 years ago

However, SSL also proves authenticity, not just encryption. It would let you know that the hidden service you are accessing is indeed who you think it is.

So do .onion address; they are an hash of the key pair you get when you generate a new one, and the client verifies that the server it's connecting to does in fact control the associated private key.

By abdicating readable domains, the Tor hidden services system eliminates the need for external authentication mechanisms like CAs; the address is all you need.

https://www.torproject.org/docs/hidden-services.html.en

wanderfowl• 11 years ago

I think you're right. But I also think this is more important, symbolically. This gives .onion a status which prevents outbacksteakhouse.onion from being plausible, and ensures that "Any domain ending in .onion needs to be routed to Tor" is consistently true.

jlgaddis5• 11 years ago

I would expect Outback Steakhouse to go with "blooming.onion" instead.

austerity• 11 years ago

Somewhat. However there are some marginal benefits such as SSL supporting stronger encryption than what Tor provides, availability of extended validation and the browser being aware of the encryption (secure cookies, same-origin policy, etc.).

jlgaddis5• 11 years ago

I asked the same question and the answer is yes. However, I recalled that hidden services use 1024-bit RSA keys and there's been some question lately as to whether that's enough bits. For some sites/hidden services, (at least) a 2048-bit key may be desired.

Natanael_L7• 11 years ago

Both Tor and I2P are actively working on upgrading their cipher suites

tadfisher2• 11 years ago

I'm not too knowledgable about Tor, but I'd imagine there's a benefit to well-known CAs issuing certificates that are trusted by existing browser infrastructure. As far as I gather, Tor authentication merely verifies that the owner of the server you're connecting to also has ownership over the .onion domain, not necessarily that that owner is who they say they are.

Granted, I'm not sure the HTTPS cert infrastructure guarantees that either. I'd love to be more informed about this.

antsar• 11 years ago

Regular certs are Domain Validated, meaning the CA only verified that you do, in fact, own the domain in question.

EV (Extended Validation) certificates actually require the CA to verify that you are who you claim to be. This is mostly used by banks and payment processors, as it costs more money. Most browsers will identify an EV cert by turning the URL bar green, and/or displaying the name of whoever owns the cert.

    https://en.wikipedia.org/wiki/Domain-validated_certificate
    https://en.wikipedia.org/wiki/Extended_Validation_Certificate

detaro4• 11 years ago

You could use cert that is valid for both a clearnet and an onion domain to "prove" that they belong to the same entity.

Natanael_L7• 11 years ago

In addition to this, Facebook does Tor - load balancer - SSL terminator - servers. This way the cert protects your against untrusted load balancers.

ape4• 11 years ago

What's Facebook (privacy enemy) doing in there.

jlgaddis5• 11 years ago

Damage control?

shpx• 11 years ago

facebookcorewwwi.onion

You can use fb from tor, so they have an interest in that staying the case. The reason was that their fraud detection was going off on tor users, so they just made a service https://www.facebook.com/notes/protect-the-graph/making-conn...

elros• 11 years ago

They're not the enemy of privacy in general. They're the enemy of privacy between you and them.

If they can make sure that not only they can get your data, but also that noone else can get it too, that's a win in their book.

Natanael_L7• 11 years ago

A leaky data silo isn't a silo anymore

pcl2• 11 years ago

I've always thought that these addresses should have a different scheme, not a different TLD. For example, onion://aoeusnth instead of http://aoeusnth.onion

Is there any reason in particular why the TLD approach was settled upon instead of a scheme-based approach?

HeavenFox• 11 years ago

Because xxx.onion is essentially hostname. One can conceivably have https://example.onion, ftp://example.onion, telnet://example.onion, and so on.

rys• 11 years ago

The reason it has to be done at the DNS level, rather than at the URI scheme level, is because any protocol can be routed over TOR.

pcl2• 11 years ago

Well, there's nothing keeping a well-defined tor scheme from including the protocol information in it, is there? For example, I could imagine specifying a tor URI in my git config: onion:ssh:pcl@aoeusnth or onion:http:aoeusnth

detaro4• 11 years ago

Because you then would have to patch all your software to understand the scheme. Which might actually be a good idea from a security POV, but is harder.

AndyMcConachie• 11 years ago

I think the simple answer is that they started doing it a certain way and then didn't want to change it.

telescope7• 11 years ago

Measuring the Leakage of Onion at the Root “A measurement of Tor’s .onion pseudo-top-level domain in the global domain name system”

[https://www.petsymposium.org/2014/papers/Thomas.pdf]

Onion names reserved by the IETF

Related Stories