|
@@ -41,7 +41,8 @@ Proposal:
|
|
|
The version of the Tor connection protocol implemented up to now is
|
|
|
"version 1". This proposal describes "version 2".
|
|
|
|
|
|
- "Old" or "Older" versions of Tor are ones not aware of this protocol;
|
|
|
+ "Old" or "Older" versions of Tor are ones not aware that version 2
|
|
|
+ of this protocol exists;
|
|
|
"New" or "Newer" versions are ones that are.
|
|
|
|
|
|
The connection initiator is referred to below as the Client; the
|
|
@@ -81,14 +82,14 @@ Proposal:
|
|
|
coming from a Tor server. The server does not ask the client for
|
|
|
certificates.
|
|
|
|
|
|
- Old Servers will (mostly) ignore the cipher list respond as in the v1
|
|
|
- protocol, and send back a two-certificate chain.
|
|
|
+ Old Servers will (mostly) ignore the cipher list and respond as in the v1
|
|
|
+ protocol, sending back a two-certificate chain.
|
|
|
|
|
|
After the Client gets a response from the server, it checks for the
|
|
|
- number of certificates. If there are two certificates, the client
|
|
|
- assumes a V1 connection and proceeds as in tor-spec.txt. But if there
|
|
|
- is only one certificate, the client assumes a V2 or later protocol and
|
|
|
- continues.
|
|
|
+ number of certificates it received. If there are two certificates,
|
|
|
+ the client assumes a V1 connection and proceeds as in tor-spec.txt.
|
|
|
+ But if there is only one certificate, the client assumes a V2 or later
|
|
|
+ protocol and continues.
|
|
|
|
|
|
At this point, the client has established a TLS connection with the
|
|
|
server, but the parties have not been authenticated: the server hasn't
|
|
@@ -131,9 +132,13 @@ Proposal:
|
|
|
SSL_MODE_NO_AUTO_CHAIN flag and sets the callback as for the V1
|
|
|
protocol. It then starts reading.
|
|
|
|
|
|
-
|
|
|
The other problem to take care of is missing ciphers and OpenSSL's
|
|
|
- cipher sorting algorithms. [XXXX more on this.]
|
|
|
+ cipher sorting algorithms. The two main issues are a) OpenSSL doesn't
|
|
|
+ support some of the default ciphers that Firefox advertises, and b)
|
|
|
+ OpenSSL sorts the list of ciphers it offers in a different way than
|
|
|
+ Firefox sorts them, so unless we fix that Tor will still look different
|
|
|
+ than Firefox.
|
|
|
+ [XXXX more on this.]
|
|
|
|
|
|
|
|
|
1.2. Compatibility for clients using libraries less hackable than OpenSSL.
|