[tor-bugs] #7202 [Tor]: Implement ntor handshake or its successor

[Tor Bug Tracker & Wiki]

#7202: Implement ntor handshake or its successor
--------------------------------+-------------------------------------------
 Reporter:  karsten             |          Owner:                    
     Type:  project             |         Status:  new               
 Priority:  normal              |      Milestone:  Tor: 0.2.4.x-final
Component:  Tor                 |        Version:                    
 Keywords:  SponsorZ tor-relay  |         Parent:                    
   Points:                      |   Actualpoints:                    
--------------------------------+-------------------------------------------

Comment(by nickm):

 Replying to [comment:3 mikeperry]:
 > Hrmm. I am worried that ntor is even more asymmetric and DoS-vulnerable

 How?

 Suppose a DoS-ing attacker who takes the minimal effort and just generates
 random bits.

 In the current case, a server has to respond to a randomly generated
 CREATE cell by doing a futile RSA1024 private-key operation and noticing
 that the padding's wrong after the RSA decrypt.

 With ntor+curve25519, the server has to respond by doing two curve25519
 operations and some hashing.

 curve25519 is well more than twice as fast as private-key RSA1024 (an
 order of magnitude faster on my laptop), so this is *less* "asymmetric and
 DOS-vulnerable" than the current RSA approach.

 What am I missing?

 I agree that solving CREATE-based DoS matters, but it seems like this
 isn't a step backwards.

-- 
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/7202#comment:5>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online