tor-spec.txt 23 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541
  1. $Id$
  2. Tor Spec
  3. Note: This is an attempt to specify Tor as it exists as implemented in
  4. early June, 2003. It is not recommended that others implement this
  5. design as it stands; future versions of Tor will implement improved
  6. protocols.
  7. TODO: (very soon)
  8. - Specify truncate/truncated payloads?
  9. - Specify RELAY_END payloads. [It's 1 byte of reason, then X bytes of
  10. data, right? -NM]
  11. [Right, where X=4 and it's an IP, currently. -RD]
  12. - Sendme w/stream0 is circuit sendme
  13. - Integrate -NM and -RD comments
  14. - EXTEND cells should have hostnames or nicknames, so that OPs never
  15. resolve OR hostnames. Else DNS servers can give different answers to
  16. different OPs, and compromise their anonymity.
  17. EVEN LATER:
  18. - Do TCP-style sequencing and ACKing of DATA cells so that we can afford
  19. to lose some data cells. [Actually, we'll probably never do this. -RD]
  20. 0. Notation:
  21. PK -- a public key.
  22. SK -- a private key
  23. K -- a key for a symmetric cypher
  24. a|b -- concatenation of 'a' with 'b'.
  25. All numeric values are encoded in network (big-endian) order.
  26. Unless otherwise specified, all symmetric ciphers are AES in counter
  27. mode, with an IV of all 0 bytes. Asymmetric ciphers are either RSA
  28. with 1024-bit keys and exponents of 65537, or DH with the safe prime
  29. from rfc2409, section 6.2, whose hex representation is:
  30. "FFFFFFFFFFFFFFFFC90FDAA22168C234C4C6628B80DC1CD129024E08"
  31. "8A67CC74020BBEA63B139B22514A08798E3404DDEF9519B3CD3A431B"
  32. "302B0A6DF25F14374FE1356D6D51C245E485B576625E7EC6F44C42E9"
  33. "A637ED6B0BFF5CB6F406B7EDEE386BFB5A899FA5AE9F24117C4B1FE6"
  34. "49286651ECE65381FFFFFFFFFFFFFFFF"
  35. 1. System overview
  36. Onion Routing is a distributed overlay network designed to anonymize
  37. low-latency TCP-based applications such as web browsing, secure shell,
  38. and instant messaging. Clients choose a path through the network and
  39. build a ``circuit'', in which each node (or ``onion router'' or ``OR'')
  40. in the path knows its predecessor and successor, but no other nodes in
  41. the circuit. Traffic flowing down the circuit is sent in fixed-size
  42. ``cells'', which are unwrapped by a symmetric key at each node (like
  43. the layers of an onion) and relayed downstream.
  44. 2. Connections
  45. There are two ways to connect to an onion router (OR). The first is
  46. as an onion proxy (OP), which allows the OP to authenticate the OR
  47. without authenticating itself. The second is as another OR, which
  48. allows mutual authentication.
  49. Tor uses TLS for link encryption, using the cipher suite
  50. "TLS_DHE_RSA_WITH_AES_128_CBC_SHA".
  51. [That's cool, except it's not what we use currently. We use
  52. 3DES because most people don't have openssl 0.9.7 and thus
  53. don't have AES. -RD]
  54. An OR always sends a
  55. self-signed X.509 certificate whose commonName is the server's
  56. nickname, and whose public key is in the server directory.
  57. All parties receiving certificates must confirm that the public
  58. key is as it appears in the server directory, and close the
  59. connection if it is not.
  60. Once a TLS connection is established, the two sides send cells
  61. (specified below) to one another. Cells are sent serially. All
  62. cells are 512 bytes long. Cells may be sent embedded in TLS
  63. records of any size or divided across TLS records, but the framing
  64. of TLS records must not leak information about the type or
  65. contents of the cells.
  66. OR-to-OR connections are never deliberately closed. An OP should
  67. close a connection to an OR if there are no circuits running over
  68. the connection, and an amount of time (KeepalivePeriod, defaults to
  69. 5 minutes) has passed.
  70. 3. Cell Packet format
  71. The basic unit of communication for onion routers and onion
  72. proxies is a fixed-width "cell". Each cell contains the following
  73. fields:
  74. CircID [2 bytes]
  75. Command [1 byte]
  76. Payload (padded with 0 bytes) [509 bytes]
  77. [Total size: 512 bytes]
  78. The 'Command' field holds one of the following values:
  79. 0 -- PADDING (Padding) (See Sec 6.2)
  80. 1 -- CREATE (Create a circuit) (See Sec 4)
  81. 2 -- CREATED (Acknowledge create) (See Sec 4)
  82. 3 -- RELAY (End-to-end data) (See Sec 5)
  83. 4 -- DESTROY (Stop using a circuit) (See Sec 4)
  84. The interpretation of 'Payload' depends on the type of the cell.
  85. PADDING: Unused.
  86. CREATE: Payload contains the handshake challenge.
  87. CREATED: Payload contains the handshake response.
  88. RELAY: Payload contains the relay header and relay body.
  89. DESTROY: Unused.
  90. The payload is padded with 0 bytes.
  91. PADDING cells are currently used to implement connection
  92. keepalive. ORs and OPs send one another a PADDING cell every few
  93. minutes.
  94. CREATE, CREATED, and DESTROY cells are used to manage circuits;
  95. see section 4 below.
  96. RELAY cells are used to send commands and data along a circuit; see
  97. section 5 below.
  98. 4. Circuit management
  99. 4.1. CREATE and CREATED cells
  100. Users set up circuits incrementally, one hop at a time. To create a
  101. new circuit, users send a CREATE cell to the first node, with the
  102. first half of the DH handshake; that node responds with a CREATED
  103. cell with the second half of the DH handshake plus the first 20 bytes
  104. of derivative key data (see section 4.2). To extend a circuit past
  105. the first hop, the user sends an EXTEND relay cell (see section 5)
  106. which instructs the last node in the circuit to send a CREATE cell
  107. to extend the circuit.
  108. The payload for a CREATE cell is an 'onion skin', consisting of:
  109. RSA-encrypted data [128 bytes]
  110. Symmetrically-encrypted data [16 bytes]
  111. The RSA-encrypted portion contains:
  112. Symmetric key [16 bytes]
  113. First part of DH data (g^x) [112 bytes]
  114. The symmetrically encrypted portion contains:
  115. Second part of DH data (g^x) [16 bytes]
  116. The two parts of DH data, once decrypted and concatenated, form
  117. g^x as calculated by the client.
  118. The relay payload for an EXTEND relay cell consists of:
  119. Address [4 bytes]
  120. Port [2 bytes]
  121. Onion skin [144 bytes]
  122. The port and address field denote the IPV4 address and port of the
  123. next onion router in the circuit.
  124. 4.2. Setting circuit keys
  125. Once the handshake between the OP and an OR is completed, both
  126. servers can now calculate g^xy with ordinary DH. From the base key
  127. material g^xy, they compute derivative key material as follows.
  128. First, the server represents g^xy as a big-endian unsigned integer.
  129. Next, the server computes 60 bytes of key data as K = SHA1(g^xy |
  130. [00]) | SHA1(g^xy | [01]) | SHA1(g^xy | [02]) where "00" is a single
  131. octet whose value is zero, "01" is a single octet whose value is
  132. one, etc. The first 20 bytes of K form KH, the next 16 bytes of K
  133. form Kf, and the next 16 bytes of K form Kb.
  134. KH is used in the handshake response to demonstrate knowledge of the
  135. computed shared key. Kf is used to encrypt the stream of data going
  136. from the OP to the OR, and Kb is used to encrypt the stream of data
  137. going from the OR to the OP.
  138. 4.3. Creating circuits
  139. When creating a circuit through the network, the circuit creator
  140. performs the following steps:
  141. 1. Choose a chain of N onion routers (R_1...R_N) to constitute
  142. the path, such that no router appears in the path twice.
  143. [this is wrong, now we choose the last hop and then choose
  144. new hops lazily -RD]
  145. 2. If not already connected to the first router in the chain,
  146. open a new connection to that router.
  147. 3. Choose a circID not already in use on the connection with the
  148. first router in the chain. If we are an onion router and our
  149. nickname is lexicographically greater than the nickname of the
  150. other side, then let the high bit of the circID be 1, else 0.
  151. 4. Send a CREATE cell along the connection, to be received by
  152. the first onion router.
  153. 5. Wait until a CREATED cell is received; finish the handshake
  154. and extract the forward key Kf_1 and the backward key Kb_1.
  155. 6. For each subsequent onion router R (R_2 through R_N), extend
  156. the circuit to R.
  157. To extend the circuit by a single onion router R_M, the circuit
  158. creator performs these steps:
  159. 1. Create an onion skin, encrypting the RSA-encrypted part with
  160. R's public key.
  161. 2. Encrypt and send the onion skin in a relay EXTEND cell along
  162. the circuit (see section 5).
  163. 3. When a relay EXTENDED cell is received, calculate the shared
  164. keys. The circuit is now extended.
  165. When an onion router receives an EXTEND relay cell, it sends a
  166. CREATE cell to the next onion router, with the enclosed onion skin
  167. as its payload. The initiating onion router chooses some circID not
  168. yet used on the connection between the two onion routers. (But see
  169. section 4.3. above, concerning choosing circIDs. [What? This
  170. is 4.3. Maybe we mean to remind about lexicographic order of
  171. nicknames? -RD])
  172. As an extension (called router twins), if the desired next onion
  173. router R in the circuit is down, and some other onion router R'
  174. has the same key as R, then it's ok to extend to R' rather than R.
  175. When an onion router receives a CREATE cell, if it already has a
  176. circuit on the given connection with the given circID, it drops the
  177. cell. Otherwise, after receiving the CREATE cell, it completes
  178. the DH handshake, and replies with a CREATED cell, containing g^y
  179. as its [128 byte] payload. Upon receiving a CREATED cell, an onion
  180. router packs it payload into an EXTENDED relay cell (see section 5),
  181. and sends that cell up the circuit. Upon receiving the EXTENDED
  182. relay cell, the OP can retrieve g^y.
  183. (As an optimization, OR implementations may delay processing onions
  184. until a break in traffic allows time to do so without harming
  185. network latency too greatly.)
  186. 4.4. Tearing down circuits
  187. Circuits are torn down when an unrecoverable error occurs along
  188. the circuit, or when all streams on a circuit are closed and the
  189. circuit's intended lifetime is over. Circuits may be torn down
  190. either completely or hop-by-hop.
  191. To tear down a circuit completely, an OR or OP sends a DESTROY
  192. cell to the adjacent nodes on that circuit, using the appropriate
  193. direction's circID.
  194. Upon receiving an outgoing DESTROY cell, an OR frees resources
  195. associated with the corresponding circuit. If it's not the end of
  196. the circuit, it sends a DESTROY cell for that circuit to the next OR
  197. in the circuit. If the node is the end of the circuit, then it tears
  198. down any associated edge connections (see section 5.1).
  199. After a DESTROY cell has been processed, an OR ignores all data or
  200. destroy cells for the corresponding circuit.
  201. [This next paragraph is never used, and should perhaps go away. -RD]
  202. To tear down part of a circuit, the OP sends a RELAY_TRUNCATE cell
  203. signaling a given OR (Stream ID zero). That OR sends a DESTROY
  204. cell to the next node in the circuit, and replies to the OP with a
  205. RELAY_TRUNCATED cell.
  206. When an unrecoverable error occurs along one connection in a
  207. circuit, the nodes on either side of the connection should, if they
  208. are able, act as follows: the node closer to the OP should send a
  209. RELAY_TRUNCATED cell towards the OP; the node farther from the OP
  210. should send a DESTROY cell down the circuit.
  211. [We'll have to reevaluate this section once we figure out cleaner
  212. circuit/connection killing conventions. Possibly the right answer
  213. is to not use most of the extensions. -RD]
  214. 4.5. Routing relay cells
  215. When an OR receives a RELAY cell, it checks the cell's circID and
  216. determines whether it has a corresponding circuit along that
  217. connection. If not, the OR drops the RELAY cell.
  218. Otherwise, if the OR is not at the OP edge of the circuit (that is,
  219. either an 'exit node' or a non-edge node), it de/encrypts the length
  220. field and the payload with AES/CTR, as follows:
  221. 'Forward' relay cell (same direction as CREATE):
  222. Use Kf as key; encrypt.
  223. 'Back' relay cell (opposite direction from CREATE):
  224. Use Kb as key; decrypt.
  225. [This part is now wrong. There's a 'recognized' field. If it crypts
  226. to 0, then check the digest. Speaking of which, there's a digest
  227. field. We should mention this. -RD]
  228. If the OR recognizes the stream ID on the cell (it is either the ID
  229. of an open stream or the signaling (zero) ID), the OR processes the
  230. contents of the relay cell. Otherwise, it passes the decrypted
  231. relay cell along the circuit if the circuit continues, or drops the
  232. cell if it's the end of the circuit. [Getting an unrecognized
  233. relay cell at the end of the circuit must be allowed for now;
  234. we can reexamine this once we've designed full tcp-style close
  235. handshakes. -RD [No longer true, an unrecognized relay cell at
  236. the end can be met with a destroy cell -- I think. -RD]]
  237. Otherwise, if the data cell is coming from the OP edge of the
  238. circuit, the OP decrypts the length and payload fields with AES/CTR as
  239. follows:
  240. OP sends data cell to node R_M:
  241. For I=1...M, decrypt with Kf_I.
  242. Otherwise, if the data cell is arriving at the OP edge if the
  243. circuit, the OP encrypts the length and payload fields with AES/CTR as
  244. follows:
  245. OP receives data cell:
  246. For I=N...1,
  247. Encrypt with Kb_I. If the stream ID is a recognized
  248. stream for R_I, or if the stream ID is the signaling
  249. ID (zero), then stop and process the payload.
  250. For more information, see section 5 below.
  251. 5. Application connections and stream management
  252. 5.1. Streams
  253. Within a circuit, the OP and the exit node use the contents of
  254. RELAY packets to tunnel end-to-end commands and TCP connections
  255. ("Streams") across circuits. End-to-end commands can be initiated
  256. by either edge; streams are initiated by the OP.
  257. The first 8 bytes of each relay cell are reserved as follows:
  258. Relay command [1 byte]
  259. Stream ID [7 bytes]
  260. [command 1 byte, recognized 2 bytes, streamid 2 bytes, digest 4 bytes,
  261. length 2 bytes == 11 bytes of header -RD]
  262. The relay commands are:
  263. 1 -- RELAY_BEGIN
  264. 2 -- RELAY_DATA
  265. 3 -- RELAY_END
  266. 4 -- RELAY_CONNECTED
  267. 5 -- RELAY_SENDME
  268. 6 -- RELAY_EXTEND
  269. 7 -- RELAY_EXTENDED
  270. 8 -- RELAY_TRUNCATE
  271. 9 -- RELAY_TRUNCATED
  272. 10 -- RELAY_DROP
  273. All RELAY cells pertaining to the same tunneled stream have the
  274. same stream ID. Stream ID's are chosen randomly by the OP. A
  275. stream ID is considered "recognized" on a circuit C by an OP or an
  276. OR if it already has an existing stream established on that
  277. circuit, or if the stream ID is equal to the signaling stream ID,
  278. which is all zero: [00 00 00 00 00 00 00]
  279. [This next paragraph is wrong: to begin a new stream, it simply
  280. uses the new streamid. No need to send it separately. -RD]
  281. To create a new anonymized TCP connection, the OP sends a
  282. RELAY_BEGIN data cell with a payload encoding the address and port
  283. of the destination host. The stream ID is zero. The payload format is:
  284. NEWSTREAMID | ADDRESS | ':' | PORT | '\000'
  285. where NEWSTREAMID is the newly generated Stream ID to use for
  286. this stream, ADDRESS may be a DNS hostname, or an IPv4 address in
  287. dotted-quad format; and where PORT is encoded in decimal.
  288. Upon receiving this packet, the exit node resolves the address as
  289. necessary, and opens a new TCP connection to the target port. If
  290. the address cannot be resolved, or a connection can't be
  291. established, the exit node replies with a RELAY_END cell.
  292. Otherwise, the exit node replies with a RELAY_CONNECTED cell.
  293. The OP waits for a RELAY_CONNECTED cell before sending any data.
  294. Once a connection has been established, the OP and exit node
  295. package stream data in RELAY_DATA cells, and upon receiving such
  296. cells, echo their contents to the corresponding TCP stream.
  297. Relay RELAY_DROP cells are long-range dummies; upon receiving such
  298. a cell, the OR or OP must drop it.
  299. 5.2. Closing streams
  300. [Note -- TCP streams can only be half-closed for reading. Our
  301. Bickford's conversation was incorrect. -NM]
  302. Because TCP connections can be half-open, we follow an equivalent
  303. to TCP's FIN/FIN-ACK/ACK protocol to close streams.
  304. An exit connection can have a TCP stream in one of three states:
  305. 'OPEN', 'DONE_PACKAGING', and 'DONE_DELIVERING'. For the purposes
  306. of modeling transitions, we treat 'CLOSED' as a fourth state,
  307. although connections in this state are not, in fact, tracked by the
  308. onion router.
  309. A stream begins in the 'OPEN' state. Upon receiving a 'FIN' from
  310. the corresponding TCP connection, the edge node sends a 'RELAY_END'
  311. cell along the circuit and changes its state to 'DONE_PACKAGING'.
  312. Upon receiving a 'RELAY_END' cell, an edge node sends a 'FIN' to
  313. the corresponding TCP connection (e.g., by calling
  314. shutdown(SHUT_WR)) and changing its state to 'DONE_DELIVERING'.
  315. When a stream in already in 'DONE_DELIVERING' receives a 'FIN', it
  316. also sends a 'RELAY_END' along the circuit, and changes its state
  317. to 'CLOSED'. When a stream already in 'DONE_PACKAGING' receives a
  318. 'RELAY_END' cell, it sends a 'FIN' and changes its state to
  319. 'CLOSED'.
  320. [Note: Please rename 'RELAY_END2'. :) -NM ]
  321. If an edge node encounters an error on any stram, it sends a
  322. 'RELAY_END2' cell along the circuit (if possible) and closes the
  323. TCP connection immediately. If an edge node receives a
  324. 'RELAY_END2' cell for any stream, it closes the TCP connection
  325. completely, and sends nothing along the circuit.
  326. 6. Flow control
  327. 6.1. Link throttling
  328. Each node should do appropriate bandwidth throttling to keep its
  329. user happy.
  330. Communicants rely on TCP's default flow control to push back when they
  331. stop reading.
  332. 6.2. Link padding
  333. Currently nodes are not required to do any sort of link padding or
  334. dummy traffic. Because strong attacks exist even with link padding,
  335. and because link padding greatly increases the bandwidth requirements
  336. for running a node, we plan to leave out link padding until this
  337. tradeoff is better understood.
  338. 6.3. Circuit-level flow control
  339. To control a circuit's bandwidth usage, each OR keeps track of
  340. two 'windows', consisting of how many RELAY_DATA cells it is
  341. allowed to package for transmission, and how many RELAY_DATA cells
  342. it is willing to deliver to streams outside the network.
  343. Each 'window' value is initially set to 1000 data cells
  344. in each direction (cells that are not data cells do not affect
  345. the window). When an OR is willing to deliver more cells, it sends a
  346. RELAY_SENDME cell towards the OP, with Stream ID zero. When an OR
  347. receives a RELAY_SENDME cell with stream ID zero, it increments its
  348. packaging window.
  349. Each of these cells increments the corresponding window by 100.
  350. The OP behaves identically, except that it must track a packaging
  351. window and a delivery window for every OR in the circuit.
  352. An OR or OP sends cells to increment its delivery window when the
  353. corresponding window value falls under some threshold (900).
  354. If a packaging window reaches 0, the OR or OP stops reading from
  355. TCP connections for all streams on the corresponding circuit, and
  356. sends no more RELAY_DATA cells until receiving a RELAY_SENDME cell.
  357. [this stuff is badly worded; copy in the tor-design section -RD]
  358. 6.4. Stream-level flow control
  359. Edge nodes use RELAY_SENDME cells to implement end-to-end flow
  360. control for individual connections across circuits. Similarly to
  361. circuit-level flow control, edge nodes begin with a window of cells
  362. (500) per stream, and increment the window by a fixed value (50)
  363. upon receiving a RELAY_SENDME cell. Edge nodes initiate RELAY_SENDME
  364. cells when both a) the window is <= 450, and b) there are less than
  365. ten cell payloads remaining to be flushed at that edge.
  366. 7. Directories and routers
  367. 7.1. Router descriptor format.
  368. (Unless otherwise noted, tokens on the same line are space-separated.)
  369. Router ::= Router-Line Date-Line Onion-Key Link-Key Signing-Key Exit-Policy Router-Signature NL
  370. Router-Line ::= "router" nickname address ORPort SocksPort DirPort bandwidth NL
  371. Date-Line ::= "published" YYYY-MM-DD HH:MM:SS NL
  372. Onion-key ::= "onion-key" NL a public key in PEM format NL
  373. Link-key ::= "link-key" NL a public key in PEM format NL
  374. Signing-Key ::= "signing-key" NL a public key in PEM format NL
  375. Exit-Policy ::= Exit-Line*
  376. Exit-Line ::= ("accept"|"reject") string NL
  377. Router-Signature ::= "router-signature" NL Signature
  378. Signature ::= "-----BEGIN SIGNATURE-----" NL
  379. Base-64-encoded-signature NL "-----END SIGNATURE-----" NL
  380. ORport ::= port where the router listens for routers/proxies (speaking cells)
  381. SocksPort ::= where the router listens for applications (speaking socks)
  382. DirPort ::= where the router listens for directory download requests
  383. bandwidth ::= maximum bandwidth, in bytes/s
  384. nickname ::= between 1 and 32 alphanumeric characters. case-insensitive.
  385. Example:
  386. router moria1 moria.mit.edu 9001 9021 9031 100000
  387. published 2003-09-24 19:36:05
  388. -----BEGIN RSA PUBLIC KEY-----
  389. MIGJAoGBAMBBuk1sYxEg5jLAJy86U3GGJ7EGMSV7yoA6mmcsEVU3pwTUrpbpCmwS
  390. 7BvovoY3z4zk63NZVBErgKQUDkn3pp8n83xZgEf4GI27gdWIIwaBjEimuJlEY+7K
  391. nZ7kVMRoiXCbjL6VAtNa4Zy1Af/GOm0iCIDpholeujQ95xew7rQnAgMA//8=
  392. -----END RSA PUBLIC KEY-----
  393. signing-key
  394. -----BEGIN RSA PUBLIC KEY-----
  395. 7BvovoY3z4zk63NZVBErgKQUDkn3pp8n83xZgEf4GI27gdWIIwaBjEimuJlEY+7K
  396. MIGJAoGBAMBBuk1sYxEg5jLAJy86U3GGJ7EGMSV7yoA6mmcsEVU3pwTUrpbpCmwS
  397. f/GOm0iCIDpholeujQ95xew7rnZ7kVMRoiXCbjL6VAtNa4Zy1AQnAgMA//8=
  398. -----END RSA PUBLIC KEY-----
  399. reject 18.0.0.0/24
  400. Note: The extra newline at the end of the router block is intentional.
  401. 7.2. Directory format
  402. Directory ::= Directory-Header Directory-Router Router* Signature
  403. Directory-Header ::= "signed-directory" NL Software-Line NL
  404. Software-Line: "recommended-software" comma-separated-version-list
  405. Directory-Router ::= Router
  406. Directory-Signature ::= "directory-signature" NL Signature
  407. Signature ::= "-----BEGIN SIGNATURE-----" NL
  408. Base-64-encoded-signature NL "-----END SIGNATURE-----" NL
  409. Note: The router block for the directory server must appear first.
  410. The signature is computed by computing the SHA-1 hash of the
  411. directory, from the characters "signed-directory", through the newline
  412. after "directory-signature". This digest is then padded with PKCS.1,
  413. and signed with the directory server's signing key.
  414. 7.3. Behavior of a directory server
  415. lists nodes that are connected currently
  416. speaks http on a socket, spits out directory on request
  417. -----------
  418. (for emacs)
  419. Local Variables:
  420. mode:text
  421. indent-tabs-mode:nil
  422. fill-column:77
  423. End: