from Hacker News

Most TOR servers are vulnerable (NSA crackable)

by cklaus on 9/7/13, 9:34 PM with 49 comments

  • by anologwintermut on 9/8/13, 3:48 AM

    Given the extent of the five eyes (NSA,GCHQ,DSD, etc) taping of major fiber lines, Tor is almost certainly useless against the NSA even without backdoors. The NSA doesn't need to resort to expensive key cracking operations to break either the anonymity or confidentiality of Tor. They just have to be able to see entry and exit node traffic.

    From the original paper by the Tor developers:

    "A global passive adversary is the most commonly assumed threat when analyzing theoretical anonymity designs. But like all practical low-latency systems, Tor does not protect against such a strong adversary." --- Tor: The Second-Generation Onion Router http://www.dtic.mil/dtic/tr/fulltext/u2/a465464.pdf

  • by reirob on 9/8/13, 4:02 AM

    "Of course, this is still just guessing about the NSA's capabilities. As it turns out, the newer Elliptical keys may turn out to be relatively easier to crack than people thought, meaning that the older software may in fact be more secure. But since 1024 bit RSA/DH has been the most popular SSL encryption for the past decade, I'd assume that it's that, rather than curves, that the NSA is best at cracking."

    So it is suggested to update to a newer version that uses EC, but we are not sure if EC is not breakable? Others ([1], [2]) suggest that RSA is more secure than EC!?

    I wish that the security experts could give "clear" advise.

    EDIT: Added proper links to sources suggesting RSA over EC.

    [1] Bruce Schneider in http://www.theguardian.com/world/2013/sep/05/nsa-how-to-rema...

    "Prefer symmetric cryptography over public-key cryptography. Prefer conventional discrete-log-based systems over elliptic-curve systems; the latter have constants that the NSA influences when they can."

    [2] Fefe (it's in German) http://blog.fefe.de/?ts=acd52294

  • by m_ram on 9/8/13, 2:02 AM

    2.3.25 is the current stable version. 2.4.* is in development. Tor server operators would have to compile from source or use the upstream deb/rpm repos.

    https://www.torproject.org/download/download-unix.html.en

  • by contingencies on 9/8/13, 3:41 AM

  • by eksith on 9/7/13, 10:14 PM

    Debian/Ubuntu isn't alone in this. It should be noted that the majority of nodes are using Linux and of those, the 0.2.4 package is still not available unless you're running some flavor of "untested" or other bleeding edge distro.

    Of course that doesn't stop operators from simply downloading the latest package themselves from the Tor project or compiling from source.

  • by tptacek on 9/8/13, 2:27 PM

    Of course, this is still just guessing about the NSA's capabilities. As it turns out, the newer Elliptical keys may turn out to be relatively easier to crack than people thought, meaning that the older software may in fact be more secure.

    Wait, what?

  • by coopdog on 9/8/13, 1:19 AM

    So why isn't the repo up to date?

    I honestly don't know the answer as I don't deal with Linux repo's much

  • by doomrobo on 9/8/13, 8:48 AM

    I don't see how ECDHE has any effect on the (in)security mentioned in the article. It clearly states that the RSA keys being only 1024 bits is the problem. How does using ECDHE-RSA change this?

  • by thingummywut on 9/8/13, 5:08 PM

    Why is ECDHE+3DES a "lulz-worthy combination"?