#23969 closed defect (invalid)

Scallion/cathugger attack on Tor

Reported by: cypherpunks Owned by:
Priority: High Milestone:
Component: Core Tor/Tor Version:
Severity: Major Keywords:
Cc: Actual Points:
Parent ID: Points:
Reviewer: Sponsor:

Description

A used scallion to search public key for "abcde*", and got "abcdeyyyyyyyyy.onion"
A used it to host his website

B want to takedown A.
B used scallion to search public key for "abcde*", and got "abcdeyyyyyyyyy.onion"

This is a possible attack of Tor's hidden service.
Unfortunately, V3 onion namesystem are already cracked:
github.com/cathugger/mkp224o

What can you do to stop this from happening?
How can I block other people from generating my onion's hidden key?

Why not add a protection?
"If 2nd connection tried to connect with known hostname(B), deny it and raise error."

Child Tickets

Change History (3)

comment:1 Changed 21 months ago by cypherpunks

In recent days, many hidden websites are hacked/takedown by the FBI.
So I really think Tor Hidden Service's hostname system is cracked.

comment:2 Changed 21 months ago by cypherpunks

Already happened;
https://www.reddit.com/r/TOR/comments/30eyqa/what_happens_when_two_servers_have_the_same_onion/cprywyy/

I know that site is illegal, but still, this is the evidence that any other people can create private key and attack the traffic.

comment:3 Changed 21 months ago by yawning

Resolution: invalid
Status: newclosed

This is a possible attack of Tor's hidden service.

This requires a large but not totally unfeasible amount of work, or breaking SHA-1's pre-image resistance.

Unfortunately, V3 onion namesystem are already cracked

Generating a fully colliding v3 onion service address requires a quantum computer, and the algorithm to do accelerated ed25519 key pair generation, which you're calling an "attack" is even mentioned in the v3 onion service spec (Appendix C).

Closing as invalid, since this does not impact v3 services unless adversaries have hardware that's capable of totally breaking all of Tor.

Note: See TracTickets for help on using tickets.