Opened 9 years ago

Last modified 3 years ago

#3501 new enhancement

Teach Tor to run the Control Port over TLS

Reported by: ioerror Owned by:
Priority: Low Milestone: Tor: unspecified
Component: Core Tor/Tor Version:
Severity: Normal Keywords: torouter tor-client
Cc: nickm, chiiph, arma Actual Points:
Parent ID: Points: 5
Reviewer: Sponsor:


I've been discussing how we can use Vidalia with chiiph as a Tor controller over a network - this would be useful for the Torouter for example.

I think that a TOFU (Trust On First Use) model is probably best and that would mean we'd simply need a Tor Control Port that uses a static TLS cert/key combo. I guess we could do a bare key or we could do the full x509 nightmare. I don't really have a preference.

This would allow us to control Tor safely as the control port data exported by Vidalia doesn't seem safe to expose to an attacker.

Child Tickets

Change History (6)

comment:1 Changed 9 years ago by nickm

Milestone: Tor: unspecified

This needs a proposal to specify how the authentication model would work exactly, but IMO it's doable. We would need to refactor some of Tor's current code, which assumes that having a TLS connection is the same as being an or_connection_t. This would be an easy switch if the feature required bufferevents; it might still be easy to do with the old buf_t style connections.

comment:2 Changed 9 years ago by ioerror

I think the authentication would not be in Tor at all. The main question is about keys and Tor could easily just generate a key per TLS Control Port - similar to how we generate an onion key per onion.

I'd be happy to write up a patch to the current control-spec or a new one entirely but it would mostly be about the actual Controller, not the Control Port, I think.

comment:3 Changed 8 years ago by nickm

Keywords: tor-client added

comment:4 Changed 8 years ago by nickm

Component: Tor ClientTor

comment:5 Changed 8 years ago by runa

Cc: nickm chiiph arma added; nickm chiiph arma runa removed

comment:6 Changed 3 years ago by nickm

Points: 5
Priority: MediumLow
Severity: Normal
Type: taskenhancement
Note: See TracTickets for help on using tickets.