Opened 3 years ago

Closed 12 months ago

#13752 closed enhancement (implemented)

Extend TLS RSA link keys to 2048-bit

Reported by: nickm Owned by: nickm
Priority: High Milestone: Tor: 0.2.9.x-final
Component: Core Tor/Tor Version: Tor: 0.2.7
Severity: Normal Keywords: tor-relay, prop-220, 027-triaged-1-in, 028-triaged, TorCoreTeam201608
Cc: Actual Points: 0
Parent ID: #15055 Points: .1
Reviewer: Sponsor: SponsorU-must

Description

When we implement proposal 220 , we'll need to have stronger per-connection TLS link keys, or else the link key will be the weak point.

In #6088, we investigated this; I made a branch called "ticket6088_hax" to try out the right fix.

Child Tickets

Change History (25)

comment:1 Changed 3 years ago by nickm

Milestone: Tor: 0.2.6.x-finalTor: 0.2.7.x-final

comment:2 Changed 2 years ago by nickm

Parent ID: #12498#15054

comment:3 Changed 2 years ago by nickm

Hm. We can do something much simpler than the ticket6088_hax approach if we do this _after_ we remove more support for pre-v3 handshakes.

(Assuming we can remove support for pre-v3 handshakes.)

comment:4 Changed 2 years ago by nickm

Status: newassigned

comment:5 Changed 2 years ago by nickm

Keywords: 027-triaged-1-in added

Marking more tickets as triaged-in for 0.2.7

comment:6 Changed 2 years ago by isabela

Keywords: SponsorU added
Points: small
Priority: normalmajor
Version: Tor: 0.2.7

comment:7 Changed 2 years ago by nickm

My "ticket6088_hax_v2" branch is now rebased.

comment:8 Changed 2 years ago by nickm

Keywords: TorCoreTeam201507 added

comment:9 Changed 2 years ago by nickm

Keywords: TorCoreTeam201508 added; TorCoreTeam201507 removed

comment:10 Changed 2 years ago by nickm

Owner: set to nickm

comment:11 Changed 2 years ago by nickm

Keywords: TorCoreTeam201509 added; TorCoreTeam201508 removed
Milestone: Tor: 0.2.7.x-finalTor: 0.2.8.x-final

comment:12 Changed 23 months ago by nickm

Keywords: 028-triaged added

comment:13 Changed 23 months ago by nickm

Keywords: SponsorU removed
Sponsor: SponsorU

Bulk-replace SponsorU keyword with SponsorU field.

comment:14 Changed 19 months ago by nickm

Milestone: Tor: 0.2.8.x-finalTor: 0.2.???

It is impossible that we will fix all 252 currently open 028 tickets before 028 releases. Time to move some out. This is my first pass through the "assigned" tickets with no owner, looking for things to move to ???.

If somebody thinks they can get these done before the 0.2.8 timeout, please assign it to yourself and move it back?

comment:15 Changed 17 months ago by isabela

Sponsor: SponsorUSponsorU-must

comment:16 Changed 17 months ago by nickm

Keywords: TorCoreTeam201509 removed

Removing TorCoreTeam201509 from these tickets, since we do not own a time machine.

comment:17 Changed 17 months ago by arma

Severity: Blocker

Is this only for the edge case where we don't use the stronger ECC link crypto?

Seems like we should focus on getting everybody on to the better crypto, rather than doing this ticket.

comment:18 Changed 17 months ago by arma

Severity: BlockerNormal

(trac fail)

comment:19 in reply to:  17 Changed 17 months ago by cypherpunks

Replying to arma:

Is this only for the edge case where we don't use the stronger ECC link crypto?

Seems like we should focus on getting everybody on to the better crypto, rather than doing this ticket.

Why not both? This would be a trivial change, and 2048 has been the minimum recommended for a long time.

comment:20 in reply to:  17 Changed 17 months ago by nickm

Replying to arma:

Is this only for the edge case where we don't use the stronger ECC link crypto?

No. It's for the keys in the certificates. We're using RSA certificates for the authentication, and ECDH for the forward secrecy.

comment:21 Changed 15 months ago by nickm

Milestone: Tor: 0.2.???Tor: 0.2.9.x-final
Parent ID: #15054#15055

comment:22 Changed 15 months ago by nickm

Points: small.1

comment:23 Changed 13 months ago by nickm

Keywords: TorCoreTeam201608 added

comment:24 Changed 12 months ago by nickm

Actual Points: 0

Done as part of 15055_wip

comment:25 Changed 12 months ago by nickm

Resolution: implemented
Status: assignedclosed

These are implemented in 15055_wip; folding them into #15055 as their parent ticket.

Note: See TracTickets for help on using tickets.