[tor-dev] Alternative directory format for v3 client auth

[Michael Rogers]

On 11/07/18 14:22, George Kadianakis wrote:
> Michael Rogers <michael at briarproject.org> writes:
> 
>> On 10/07/18 19:58, George Kadianakis wrote:
>>> here is a patch with an alternative directory format for v3 client auth
>>> crypto key bookkeeping as discussed yesterday on IRC:
>>>        https://github.com/torproject/torspec/pull/23
>>>
>>> Thanks for making me edit the spec because it made me think of various
>>> details that had to be thought of.
>>>
>>> Let me know if you don't like it or if something is wrong.
>>
>> Minor clarification: line 2298 says the keypair is stored, it might be
>> clearer to say the private key is stored.
>>
>> Nitpick: should the directory be called "client_authorized_privkeys" if
>> it might contain private keys, public keys, or a mixture of the two?
>>
> 
> Good points in both cases. Will fix soon (along with other feedback if received).
> 
> Other than that, what do you think about the whole concept? Too complex?
> Logical? Too much?
> 
> Cheers for the feedback! :)

Sorry for being late to the party - I just this morning finished reading
the thread from 2016 where the client auth design was hashed out. :-/

I think putting each client's keys in a separate file makes a lot of sense.

At a higher level there are some things I'm not sure about. Sorry if
this is threadjacking, but you said the magic words "whole concept". ;-)

First, Ed25519-based authentication ("intro auth"). Could this be punted
to the application layer, or is there a reason it has to happen at the
Tor layer?

Second, X25519-based authorization ("desc auth"). If I understand right,
using asymmetric keypairs here rather than symmetric keys makes it
possible for the client to generate a keypair and send the public key to
the service over an authenticated but not confidential channel. But the
client may not know how to do that, so we also need to support an
alternative workflow where the service generates the keypair and sends
the private key to the client over an authenticated and confidential
channel.

The upside of this design is the ability to use an authenticated but not
confidential channel (as long as the client and service understand which
workflow they need to use). The downside is extra complexity. I'm not
really convinced this is a good tradeoff. But I'm guessing this argument
has already been had, and my side lost. :-)

Third, what's the purpose of the fake auth-client lines for a service
that doesn't use client auth? I understand that when a service does use
client auth, it may not want clients (or anyone else who knows the onion
address) to know the exact number of clients. But when a service doesn't
use client auth, anyone who can decrypt the first layer of the
descriptor can also decrypt the second layer, and therefore knows that
the auth-client lines are fake. So are they just for padding in that
case? But the first layer's padded before encryption anyway.

Fourth, what goals does desc auth achieve in the v3 design? If I
understand right, in v2 its major goal was to hide the intro points from
everyone except authorised clients (including HSDirs). In v3 the intro
points are already hidden from anyone who doesn't know the onion address
(including HSDirs), so this goal can be achieved by not revealing the
onion address to anyone except authorised clients.

I'm probably missing something, but as far as I can see the only other
goal achieved by desc auth is the ability to revoke a client's access
without needing to distribute a new onion address to other clients. This
seems useful. But again, I'd ask whether it could be punted to the
application layer. The only advantage I can see from putting it at the
Tor layer is that the list of intro points is hidden from revoked
clients. Is there a real world use case where that's a big enough
advantage to justify putting all this authorisation machinery at the Tor
layer? Or maybe there are other things this design achieves that I
haven't thought of.

Anyway, sorry for the bag of assorted questions. I've been meaning to
catch up on all the discussions where they've probably been answered
already, but it's becoming clear that's a losing battle, so I'd better
just send them. Apologies if they're redundant or uninformed.

Cheers,
Michael
-------------- next part --------------
A non-text attachment was scrubbed...
Name: 0x11044FD19FC527CC.asc
Type: application/pgp-keys
Size: 14690 bytes
Desc: not available
URL: <http://lists.torproject.org/pipermail/tor-dev/attachments/20180711/c69ab579/attachment-0001.key>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 473 bytes
Desc: OpenPGP digital signature
URL: <http://lists.torproject.org/pipermail/tor-dev/attachments/20180711/c69ab579/attachment-0001.sig>