tor-spec.txt 45 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586587588589590591592593594595596597598599600601602603604605606607608609610611612613614615616617618619620621622623624625626627628629630631632633634635636637638639640641642643644645646647648649650651652653654655656657658659660661662663664665666667668669670671672673674675676677678679680681682683684685686687688689690691692693694695696697698699700701702703704705706707708709710711712713714715716717718719720721722723724725726727728729730731732733734735736737738739740741742743744745746747748749750751752753754755756757758759760761762763764765766767768769770771772773774775776777778779780781782783784785786787788789790791792793794795796797798799800801802803804805806807808809810811812813814815816817818819820821822823824825826827828829830831832833834835836837838839840841842843844845846847848849850851852853854855856857858859860861862863864865866867868869870871872873874875876877878879880881882883884885886887888889890891892893894895896897898899900901902903904905906907908909910911912913914915916917918919920921922923924925926927928929930931932933934935936937938939940941942943944945946947948949950951952953954955956957958959960961962963964965966967968969970971972973974975976977978979980981982983984985986987988989990991992993994995996997
  1. Tor Protocol Specification
  2. Roger Dingledine
  3. Nick Mathewson
  4. Note: This document aims to specify Tor as implemented in 0.2.1.x. Future
  5. versions of Tor may implement improved protocols, and compatibility is not
  6. guaranteed. Compatibility notes are given for versions 0.1.1.15-rc and
  7. later; earlier versions are not compatible with the Tor network as of this
  8. writing.
  9. This specification is not a design document; most design criteria
  10. are not examined. For more information on why Tor acts as it does,
  11. see tor-design.pdf.
  12. 0. Preliminaries
  13. The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL
  14. NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and
  15. "OPTIONAL" in this document are to be interpreted as described in
  16. RFC 2119.
  17. 0.1. Notation and encoding
  18. PK -- a public key.
  19. SK -- a private key.
  20. K -- a key for a symmetric cipher.
  21. a|b -- concatenation of 'a' and 'b'.
  22. [A0 B1 C2] -- a three-byte sequence, containing the bytes with
  23. hexadecimal values A0, B1, and C2, in that order.
  24. All numeric values are encoded in network (big-endian) order.
  25. H(m) -- a cryptographic hash of m.
  26. 0.2. Security parameters
  27. Tor uses a stream cipher, a public-key cipher, the Diffie-Hellman
  28. protocol, and a hash function.
  29. KEY_LEN -- the length of the stream cipher's key, in bytes.
  30. PK_ENC_LEN -- the length of a public-key encrypted message, in bytes.
  31. PK_PAD_LEN -- the number of bytes added in padding for public-key
  32. encryption, in bytes. (The largest number of bytes that can be encrypted
  33. in a single public-key operation is therefore PK_ENC_LEN-PK_PAD_LEN.)
  34. DH_LEN -- the number of bytes used to represent a member of the
  35. Diffie-Hellman group.
  36. DH_SEC_LEN -- the number of bytes used in a Diffie-Hellman private key (x).
  37. HASH_LEN -- the length of the hash function's output, in bytes.
  38. PAYLOAD_LEN -- The longest allowable cell payload, in bytes. (509)
  39. CELL_LEN -- The length of a Tor cell, in bytes.
  40. 0.3. Ciphers
  41. For a stream cipher, we use 128-bit AES in counter mode, with an IV of all
  42. 0 bytes.
  43. For a public-key cipher, we use RSA with 1024-bit keys and a fixed
  44. exponent of 65537. We use OAEP-MGF1 padding, with SHA-1 as its digest
  45. function. We leave the optional "Label" parameter unset. (For OAEP
  46. padding, see ftp://ftp.rsasecurity.com/pub/pkcs/pkcs-1/pkcs-1v2-1.pdf)
  47. For Diffie-Hellman, we use a generator (g) of 2. For the modulus (p), we
  48. use the 1024-bit safe prime from rfc2409 section 6.2 whose hex
  49. representation is:
  50. "FFFFFFFFFFFFFFFFC90FDAA22168C234C4C6628B80DC1CD129024E08"
  51. "8A67CC74020BBEA63B139B22514A08798E3404DDEF9519B3CD3A431B"
  52. "302B0A6DF25F14374FE1356D6D51C245E485B576625E7EC6F44C42E9"
  53. "A637ED6B0BFF5CB6F406B7EDEE386BFB5A899FA5AE9F24117C4B1FE6"
  54. "49286651ECE65381FFFFFFFFFFFFFFFF"
  55. As an optimization, implementations SHOULD choose DH private keys (x) of
  56. 320 bits. Implementations that do this MUST never use any DH key more
  57. than once.
  58. [May other implementations reuse their DH keys?? -RD]
  59. [Probably not. Conceivably, you could get away with changing DH keys once
  60. per second, but there are too many oddball attacks for me to be
  61. comfortable that this is safe. -NM]
  62. For a hash function, we use SHA-1.
  63. KEY_LEN=16.
  64. DH_LEN=128; DH_SEC_LEN=40.
  65. PK_ENC_LEN=128; PK_PAD_LEN=42.
  66. HASH_LEN=20.
  67. When we refer to "the hash of a public key", we mean the SHA-1 hash of the
  68. DER encoding of an ASN.1 RSA public key (as specified in PKCS.1).
  69. All "random" values should be generated with a cryptographically strong
  70. random number generator, unless otherwise noted.
  71. The "hybrid encryption" of a byte sequence M with a public key PK is
  72. computed as follows:
  73. 1. If M is less than PK_ENC_LEN-PK_PAD_LEN, pad and encrypt M with PK.
  74. 2. Otherwise, generate a KEY_LEN byte random key K.
  75. Let M1 = the first PK_ENC_LEN-PK_PAD_LEN-KEY_LEN bytes of M,
  76. and let M2 = the rest of M.
  77. Pad and encrypt K|M1 with PK. Encrypt M2 with our stream cipher,
  78. using the key K. Concatenate these encrypted values.
  79. [XXX Note that this "hybrid encryption" approach does not prevent
  80. an attacker from adding or removing bytes to the end of M. It also
  81. allows attackers to modify the bytes not covered by the OAEP --
  82. see Goldberg's PET2006 paper for details. We will add a MAC to this
  83. scheme one day. -RD]
  84. 0.4. Other parameter values
  85. CELL_LEN=512
  86. 1. System overview
  87. Tor is a distributed overlay network designed to anonymize
  88. low-latency TCP-based applications such as web browsing, secure shell,
  89. and instant messaging. Clients choose a path through the network and
  90. build a ``circuit'', in which each node (or ``onion router'' or ``OR'')
  91. in the path knows its predecessor and successor, but no other nodes in
  92. the circuit. Traffic flowing down the circuit is sent in fixed-size
  93. ``cells'', which are unwrapped by a symmetric key at each node (like
  94. the layers of an onion) and relayed downstream.
  95. 1.1. Keys and names
  96. Every Tor server has multiple public/private keypairs:
  97. - A long-term signing-only "Identity key" used to sign documents and
  98. certificates, and used to establish server identity.
  99. - A medium-term "Onion key" used to decrypt onion skins when accepting
  100. circuit extend attempts. (See 5.1.) Old keys MUST be accepted for at
  101. least one week after they are no longer advertised. Because of this,
  102. servers MUST retain old keys for a while after they're rotated.
  103. - A short-term "Connection key" used to negotiate TLS connections.
  104. Tor implementations MAY rotate this key as often as they like, and
  105. SHOULD rotate this key at least once a day.
  106. Tor servers are also identified by "nicknames"; these are specified in
  107. dir-spec.txt.
  108. 2. Connections
  109. Connections between two Tor servers, or between a client and a server,
  110. use TLS/SSLv3 for link authentication and encryption. All
  111. implementations MUST support the SSLv3 ciphersuite
  112. "SSL_DHE_RSA_WITH_3DES_EDE_CBC_SHA", and SHOULD support the TLS
  113. ciphersuite "TLS_DHE_RSA_WITH_AES_128_CBC_SHA" if it is available.
  114. There are three acceptable ways to perform a TLS handshake when
  115. connecting to a Tor server: "certificates up-front", "renegotiation", and
  116. "backwards-compatible renegotiation". ("Backwards-compatible
  117. renegotiation" is, as the name implies, compatible with both other
  118. handshake types.)
  119. Before Tor 0.2.0.21, only "certificates up-front" was supported. In Tor
  120. 0.2.0.21 or later, "backwards-compatible renegotiation" is used.
  121. In "certificates up-front", the connection initiator always sends a
  122. two-certificate chain, consisting of an X.509 certificate using a
  123. short-term connection public key and a second, self- signed X.509
  124. certificate containing its identity key. The other party sends a similar
  125. certificate chain. The initiator's ClientHello MUST NOT include any
  126. ciphersuites other than:
  127. TLS_DHE_RSA_WITH_AES_256_CBC_SHA
  128. TLS_DHE_RSA_WITH_AES_128_CBC_SHA
  129. SSL_DHE_RSA_WITH_3DES_EDE_CBC_SHA
  130. SSL_DHE_DSS_WITH_3DES_EDE_CBC_SHA
  131. In "renegotiation", the connection initiator sends no certificates, and
  132. the responder sends a single connection certificate. Once the TLS
  133. handshake is complete, the initiator renegotiates the handshake, with each
  134. party sending a two-certificate chain as in "certificates up-front".
  135. The initiator's ClientHello MUST include at least one ciphersuite not in
  136. the list above. The responder SHOULD NOT select any ciphersuite besides
  137. those in the list above.
  138. [The above "should not" is because some of the ciphers that
  139. clients list may be fake.]
  140. In "backwards-compatible renegotiation", the connection initiator's
  141. ClientHello MUST include at least one ciphersuite other than those listed
  142. above. The connection responder examines the initiator's ciphersuite list
  143. to see whether it includes any ciphers other than those included in the
  144. list above. If extra ciphers are included, the responder proceeds as in
  145. "renegotiation": it sends a single certificate and does not request
  146. client certificates. Otherwise (in the case that no extra ciphersuites
  147. are included in the ClientHello) the responder proceeds as in
  148. "certificates up-front": it requests client certificates, and sends a
  149. two-certificate chain. In either case, once the responder has sent its
  150. certificate or certificates, the initiator counts them. If two
  151. certificates have been sent, it proceeds as in "certificates up-front";
  152. otherwise, it proceeds as in "renegotiation".
  153. All new implementations of the Tor server protocol MUST support
  154. "backwards-compatible renegotiation"; clients SHOULD do this too. If
  155. this is not possible, new client implementations MUST support both
  156. "renegotiation" and "certificates up-front" and use the router's
  157. published link protocols list (see dir-spec.txt on the "protocols" entry)
  158. to decide which to use.
  159. In all of the above handshake variants, certificates sent in the clear
  160. SHOULD NOT include any strings to identify the host as a Tor server. In
  161. the "renegotiation" and "backwards-compatible renegotiation" steps, the
  162. initiator SHOULD choose a list of ciphersuites and TLS extensions
  163. to mimic one used by a popular web browser.
  164. Responders MUST NOT select any TLS ciphersuite that lacks ephemeral keys,
  165. or whose symmetric keys are less then KEY_LEN bits, or whose digests are
  166. less than HASH_LEN bits. Responders SHOULD NOT select any SSLv3
  167. ciphersuite other than those listed above.
  168. Even though the connection protocol is identical, we will think of the
  169. initiator as either an onion router (OR) if it is willing to relay
  170. traffic for other Tor users, or an onion proxy (OP) if it only handles
  171. local requests. Onion proxies SHOULD NOT provide long-term-trackable
  172. identifiers in their handshakes.
  173. In all handshake variants, once all certificates are exchanged, all
  174. parties receiving certificates must confirm that the identity key is as
  175. expected. (When initiating a connection, the expected identity key is
  176. the one given in the directory; when creating a connection because of an
  177. EXTEND cell, the expected identity key is the one given in the cell.) If
  178. the key is not as expected, the party must close the connection.
  179. When connecting to an OR, all parties SHOULD reject the connection if that
  180. OR has a malformed or missing certificate. When accepting an incoming
  181. connection, an OR SHOULD NOT reject incoming connections from parties with
  182. malformed or missing certificates. (However, an OR should not believe
  183. that an incoming connection is from another OR unless the certificates
  184. are present and well-formed.)
  185. [Before version 0.1.2.8-rc, ORs rejected incoming connections from ORs and
  186. OPs alike if their certificates were missing or malformed.]
  187. Once a TLS connection is established, the two sides send cells
  188. (specified below) to one another. Cells are sent serially. All
  189. cells are CELL_LEN bytes long. Cells may be sent embedded in TLS
  190. records of any size or divided across TLS records, but the framing
  191. of TLS records MUST NOT leak information about the type or contents
  192. of the cells.
  193. TLS connections are not permanent. Either side MAY close a connection
  194. if there are no circuits running over it and an amount of time
  195. (KeepalivePeriod, defaults to 5 minutes) has passed since the last time
  196. any traffic was transmitted over the TLS connection. Clients SHOULD
  197. also hold a TLS connection with no circuits open, if it is likely that a
  198. circuit will be built soon using that connection.
  199. (As an exception, directory servers may try to stay connected to all of
  200. the ORs -- though this will be phased out for the Tor 0.1.2.x release.)
  201. To avoid being trivially distinguished from servers, client-only Tor
  202. instances are encouraged but not required to use a two-certificate chain
  203. as well. Clients SHOULD NOT keep using the same certificates when
  204. their IP address changes. Clients MAY send no certificates at all.
  205. 3. Cell Packet format
  206. The basic unit of communication for onion routers and onion
  207. proxies is a fixed-width "cell".
  208. On a version 1 connection, each cell contains the following
  209. fields:
  210. CircID [2 bytes]
  211. Command [1 byte]
  212. Payload (padded with 0 bytes) [PAYLOAD_LEN bytes]
  213. On a version 2 connection, all cells are as in version 1 connections,
  214. except for the initial VERSIONS cell, whose format is:
  215. Circuit [2 octets; set to 0]
  216. Command [1 octet; set to 7 for VERSIONS]
  217. Length [2 octets; big-endian integer]
  218. Payload [Length bytes]
  219. The CircID field determines which circuit, if any, the cell is
  220. associated with.
  221. The 'Command' field holds one of the following values:
  222. 0 -- PADDING (Padding) (See Sec 7.2)
  223. 1 -- CREATE (Create a circuit) (See Sec 5.1)
  224. 2 -- CREATED (Acknowledge create) (See Sec 5.1)
  225. 3 -- RELAY (End-to-end data) (See Sec 5.5 and 6)
  226. 4 -- DESTROY (Stop using a circuit) (See Sec 5.4)
  227. 5 -- CREATE_FAST (Create a circuit, no PK) (See Sec 5.1)
  228. 6 -- CREATED_FAST (Circuit created, no PK) (See Sec 5.1)
  229. 7 -- VERSIONS (Negotiate proto version) (See Sec 4)
  230. 8 -- NETINFO (Time and address info) (See Sec 4)
  231. 9 -- RELAY_EARLY (End-to-end data; limited)(See Sec 5.6)
  232. The interpretation of 'Payload' depends on the type of the cell.
  233. PADDING: Payload is unused.
  234. CREATE: Payload contains the handshake challenge.
  235. CREATED: Payload contains the handshake response.
  236. RELAY: Payload contains the relay header and relay body.
  237. DESTROY: Payload contains a reason for closing the circuit.
  238. (see 5.4)
  239. Upon receiving any other value for the command field, an OR must
  240. drop the cell. Since more cell types may be added in the future, ORs
  241. should generally not warn when encountering unrecognized commands.
  242. The payload is padded with 0 bytes.
  243. PADDING cells are currently used to implement connection keepalive.
  244. If there is no other traffic, ORs and OPs send one another a PADDING
  245. cell every few minutes.
  246. CREATE, CREATED, and DESTROY cells are used to manage circuits;
  247. see section 5 below.
  248. RELAY cells are used to send commands and data along a circuit; see
  249. section 6 below.
  250. VERSIONS and NETINFO cells are used to set up connections. See section 4
  251. below.
  252. 4. Negotiating and initializing connections
  253. 4.1. Negotiating versions with VERSIONS cells
  254. There are multiple instances of the Tor link connection protocol. Any
  255. connection negotiated using the "certificates up front" handshake (see
  256. section 2 above) is "version 1". In any connection where both parties
  257. have behaved as in the "renegotiation" handshake, the link protocol
  258. version is 2 or higher.
  259. To determine the version, in any connection where the "renegotiation"
  260. handshake was used (that is, where the server sent only one certificate
  261. at first and where the client did not send any certificates until
  262. renegotiation), both parties MUST send a VERSIONS cell immediately after
  263. the renegotiation is finished, before any other cells are sent. Parties
  264. MUST NOT send any other cells on a connection until they have received a
  265. VERSIONS cell.
  266. The payload in a VERSIONS cell is a series of big-endian two-byte
  267. integers. Both parties MUST select as the link protocol version the
  268. highest number contained both in the VERSIONS cell they sent and in the
  269. versions cell they received. If they have no such version in common,
  270. they cannot communicate and MUST close the connection.
  271. Since the version 1 link protocol does not use the "renegotiation"
  272. handshake, implementations MUST NOT list version 1 in their VERSIONS
  273. cell.
  274. 4.2. NETINFO cells
  275. If version 2 or higher is negotiated, each party sends the other a
  276. NETINFO cell. The cell's payload is:
  277. Timestamp [4 bytes]
  278. Other OR's address [variable]
  279. Number of addresses [1 byte]
  280. This OR's addresses [variable]
  281. The address format is a type/length/value sequence as given in section
  282. 6.4 below. The timestamp is a big-endian unsigned integer number of
  283. seconds since the Unix epoch.
  284. Implementations MAY use the timestamp value to help decide if their
  285. clocks are skewed. Initiators MAY use "other OR's address" to help
  286. learn which address their connections are originating from, if they do
  287. not know it. Initiators SHOULD use "this OR's address" to make sure
  288. that they have connected to another OR at its canonical address.
  289. [As of 0.2.0.23-rc, implementations use none of the above values.]
  290. 5. Circuit management
  291. 5.1. CREATE and CREATED cells
  292. Users set up circuits incrementally, one hop at a time. To create a
  293. new circuit, OPs send a CREATE cell to the first node, with the
  294. first half of the DH handshake; that node responds with a CREATED
  295. cell with the second half of the DH handshake plus the first 20 bytes
  296. of derivative key data (see section 5.2). To extend a circuit past
  297. the first hop, the OP sends an EXTEND relay cell (see section 5)
  298. which instructs the last node in the circuit to send a CREATE cell
  299. to extend the circuit.
  300. The payload for a CREATE cell is an 'onion skin', which consists
  301. of the first step of the DH handshake data (also known as g^x).
  302. This value is hybrid-encrypted (see 0.3) to Bob's onion key, giving
  303. an onion-skin of:
  304. PK-encrypted:
  305. Padding [PK_PAD_LEN bytes]
  306. Symmetric key [KEY_LEN bytes]
  307. First part of g^x [PK_ENC_LEN-PK_PAD_LEN-KEY_LEN bytes]
  308. Symmetrically encrypted:
  309. Second part of g^x [DH_LEN-(PK_ENC_LEN-PK_PAD_LEN-KEY_LEN)
  310. bytes]
  311. The relay payload for an EXTEND relay cell consists of:
  312. Address [4 bytes]
  313. Port [2 bytes]
  314. Onion skin [DH_LEN+KEY_LEN+PK_PAD_LEN bytes]
  315. Identity fingerprint [HASH_LEN bytes]
  316. The port and address field denote the IPv4 address and port of the next
  317. onion router in the circuit; the public key hash is the hash of the PKCS#1
  318. ASN1 encoding of the next onion router's identity (signing) key. (See 0.3
  319. above.) Including this hash allows the extending OR verify that it is
  320. indeed connected to the correct target OR, and prevents certain
  321. man-in-the-middle attacks.
  322. The payload for a CREATED cell, or the relay payload for an
  323. EXTENDED cell, contains:
  324. DH data (g^y) [DH_LEN bytes]
  325. Derivative key data (KH) [HASH_LEN bytes] <see 5.2 below>
  326. The CircID for a CREATE cell is an arbitrarily chosen 2-byte integer,
  327. selected by the node (OP or OR) that sends the CREATE cell. To prevent
  328. CircID collisions, when one node sends a CREATE cell to another, it chooses
  329. from only one half of the possible values based on the ORs' public
  330. identity keys: if the sending node has a lower key, it chooses a CircID with
  331. an MSB of 0; otherwise, it chooses a CircID with an MSB of 1.
  332. (An OP with no public key MAY choose any CircID it wishes, since an OP
  333. never needs to process a CREATE cell.)
  334. Public keys are compared numerically by modulus.
  335. As usual with DH, x and y MUST be generated randomly.
  336. 5.1.1. CREATE_FAST/CREATED_FAST cells
  337. When initializing the first hop of a circuit, the OP has already
  338. established the OR's identity and negotiated a secret key using TLS.
  339. Because of this, it is not always necessary for the OP to perform the
  340. public key operations to create a circuit. In this case, the
  341. OP MAY send a CREATE_FAST cell instead of a CREATE cell for the first
  342. hop only. The OR responds with a CREATED_FAST cell, and the circuit is
  343. created.
  344. A CREATE_FAST cell contains:
  345. Key material (X) [HASH_LEN bytes]
  346. A CREATED_FAST cell contains:
  347. Key material (Y) [HASH_LEN bytes]
  348. Derivative key data [HASH_LEN bytes] (See 5.2 below)
  349. The values of X and Y must be generated randomly.
  350. If an OR sees a circuit created with CREATE_FAST, the OR is sure to be the
  351. first hop of a circuit. ORs SHOULD reject attempts to create streams with
  352. RELAY_BEGIN exiting the circuit at the first hop: letting Tor be used as a
  353. single hop proxy makes exit nodes a more attractive target for compromise.
  354. 5.2. Setting circuit keys
  355. Once the handshake between the OP and an OR is completed, both can
  356. now calculate g^xy with ordinary DH. Before computing g^xy, both client
  357. and server MUST verify that the received g^x or g^y value is not degenerate;
  358. that is, it must be strictly greater than 1 and strictly less than p-1
  359. where p is the DH modulus. Implementations MUST NOT complete a handshake
  360. with degenerate keys. Implementations MUST NOT discard other "weak"
  361. g^x values.
  362. (Discarding degenerate keys is critical for security; if bad keys
  363. are not discarded, an attacker can substitute the server's CREATED
  364. cell's g^y with 0 or 1, thus creating a known g^xy and impersonating
  365. the server. Discarding other keys may allow attacks to learn bits of
  366. the private key.)
  367. If CREATE or EXTEND is used to extend a circuit, the client and server
  368. base their key material on K0=g^xy, represented as a big-endian unsigned
  369. integer.
  370. If CREATE_FAST is used, the client and server base their key material on
  371. K0=X|Y.
  372. From the base key material K0, they compute KEY_LEN*2+HASH_LEN*3 bytes of
  373. derivative key data as
  374. K = H(K0 | [00]) | H(K0 | [01]) | H(K0 | [02]) | ...
  375. The first HASH_LEN bytes of K form KH; the next HASH_LEN form the forward
  376. digest Df; the next HASH_LEN 41-60 form the backward digest Db; the next
  377. KEY_LEN 61-76 form Kf, and the final KEY_LEN form Kb. Excess bytes from K
  378. are discarded.
  379. KH is used in the handshake response to demonstrate knowledge of the
  380. computed shared key. Df is used to seed the integrity-checking hash
  381. for the stream of data going from the OP to the OR, and Db seeds the
  382. integrity-checking hash for the data stream from the OR to the OP. Kf
  383. is used to encrypt the stream of data going from the OP to the OR, and
  384. Kb is used to encrypt the stream of data going from the OR to the OP.
  385. 5.3. Creating circuits
  386. When creating a circuit through the network, the circuit creator
  387. (OP) performs the following steps:
  388. 1. Choose an onion router as an exit node (R_N), such that the onion
  389. router's exit policy includes at least one pending stream that
  390. needs a circuit (if there are any).
  391. 2. Choose a chain of (N-1) onion routers
  392. (R_1...R_N-1) to constitute the path, such that no router
  393. appears in the path twice.
  394. 3. If not already connected to the first router in the chain,
  395. open a new connection to that router.
  396. 4. Choose a circID not already in use on the connection with the
  397. first router in the chain; send a CREATE cell along the
  398. connection, to be received by the first onion router.
  399. 5. Wait until a CREATED cell is received; finish the handshake
  400. and extract the forward key Kf_1 and the backward key Kb_1.
  401. 6. For each subsequent onion router R (R_2 through R_N), extend
  402. the circuit to R.
  403. To extend the circuit by a single onion router R_M, the OP performs
  404. these steps:
  405. 1. Create an onion skin, encrypted to R_M's public onion key.
  406. 2. Send the onion skin in a relay EXTEND cell along
  407. the circuit (see section 5).
  408. 3. When a relay EXTENDED cell is received, verify KH, and
  409. calculate the shared keys. The circuit is now extended.
  410. When an onion router receives an EXTEND relay cell, it sends a CREATE
  411. cell to the next onion router, with the enclosed onion skin as its
  412. payload. As special cases, if the extend cell includes a digest of
  413. all zeroes, or asks to extend back to the relay that sent the extend
  414. cell, the circuit will fail and be torn down. The initiating onion
  415. router chooses some circID not yet used on the connection between the
  416. two onion routers. (But see section 5.1. above, concerning choosing
  417. circIDs based on lexicographic order of nicknames.)
  418. When an onion router receives a CREATE cell, if it already has a
  419. circuit on the given connection with the given circID, it drops the
  420. cell. Otherwise, after receiving the CREATE cell, it completes the
  421. DH handshake, and replies with a CREATED cell. Upon receiving a
  422. CREATED cell, an onion router packs it payload into an EXTENDED relay
  423. cell (see section 5), and sends that cell up the circuit. Upon
  424. receiving the EXTENDED relay cell, the OP can retrieve g^y.
  425. (As an optimization, OR implementations may delay processing onions
  426. until a break in traffic allows time to do so without harming
  427. network latency too greatly.)
  428. 5.3.1. Canonical connections
  429. It is possible for an attacker to launch a man-in-the-middle attack
  430. against a connection by telling OR Alice to extend to OR Bob at some
  431. address X controlled by the attacker. The attacker cannot read the
  432. encrypted traffic, but the attacker is now in a position to count all
  433. bytes sent between Alice and Bob (assuming Alice was not already
  434. connected to Bob.)
  435. To prevent this, when an OR we gets an extend request, it SHOULD use an
  436. existing OR connection if the ID matches, and ANY of the following
  437. conditions hold:
  438. - The IP matches the requested IP.
  439. - The OR knows that the IP of the connection it's using is canonical
  440. because it was listed in the NETINFO cell.
  441. - The OR knows that the IP of the connection it's using is canonical
  442. because it was listed in the server descriptor.
  443. [This is not implemented in Tor 0.2.0.23-rc.]
  444. 5.4. Tearing down circuits
  445. Circuits are torn down when an unrecoverable error occurs along
  446. the circuit, or when all streams on a circuit are closed and the
  447. circuit's intended lifetime is over. Circuits may be torn down
  448. either completely or hop-by-hop.
  449. To tear down a circuit completely, an OR or OP sends a DESTROY
  450. cell to the adjacent nodes on that circuit, using the appropriate
  451. direction's circID.
  452. Upon receiving an outgoing DESTROY cell, an OR frees resources
  453. associated with the corresponding circuit. If it's not the end of
  454. the circuit, it sends a DESTROY cell for that circuit to the next OR
  455. in the circuit. If the node is the end of the circuit, then it tears
  456. down any associated edge connections (see section 6.1).
  457. After a DESTROY cell has been processed, an OR ignores all data or
  458. destroy cells for the corresponding circuit.
  459. To tear down part of a circuit, the OP may send a RELAY_TRUNCATE cell
  460. signaling a given OR (Stream ID zero). That OR sends a DESTROY
  461. cell to the next node in the circuit, and replies to the OP with a
  462. RELAY_TRUNCATED cell.
  463. When an unrecoverable error occurs along one connection in a
  464. circuit, the nodes on either side of the connection should, if they
  465. are able, act as follows: the node closer to the OP should send a
  466. RELAY_TRUNCATED cell towards the OP; the node farther from the OP
  467. should send a DESTROY cell down the circuit.
  468. The payload of a RELAY_TRUNCATED or DESTROY cell contains a single octet,
  469. describing why the circuit is being closed or truncated. When sending a
  470. TRUNCATED or DESTROY cell because of another TRUNCATED or DESTROY cell,
  471. the error code should be propagated. The origin of a circuit always sets
  472. this error code to 0, to avoid leaking its version.
  473. The error codes are:
  474. 0 -- NONE (No reason given.)
  475. 1 -- PROTOCOL (Tor protocol violation.)
  476. 2 -- INTERNAL (Internal error.)
  477. 3 -- REQUESTED (A client sent a TRUNCATE command.)
  478. 4 -- HIBERNATING (Not currently operating; trying to save bandwidth.)
  479. 5 -- RESOURCELIMIT (Out of memory, sockets, or circuit IDs.)
  480. 6 -- CONNECTFAILED (Unable to reach server.)
  481. 7 -- OR_IDENTITY (Connected to server, but its OR identity was not
  482. as expected.)
  483. 8 -- OR_CONN_CLOSED (The OR connection that was carrying this circuit
  484. died.)
  485. 9 -- FINISHED (The circuit has expired for being dirty or old.)
  486. 10 -- TIMEOUT (Circuit construction took too long)
  487. 11 -- DESTROYED (The circuit was destroyed w/o client TRUNCATE)
  488. 12 -- NOSUCHSERVICE (Request for unknown hidden service)
  489. 5.5. Routing relay cells
  490. When an OR receives a RELAY or RELAY_EARLY cell, it checks the cell's
  491. circID and determines whether it has a corresponding circuit along that
  492. connection. If not, the OR drops the cell.
  493. Otherwise, if the OR is not at the OP edge of the circuit (that is,
  494. either an 'exit node' or a non-edge node), it de/encrypts the payload
  495. with the stream cipher, as follows:
  496. 'Forward' relay cell (same direction as CREATE):
  497. Use Kf as key; decrypt.
  498. 'Back' relay cell (opposite direction from CREATE):
  499. Use Kb as key; encrypt.
  500. Note that in counter mode, decrypt and encrypt are the same operation.
  501. The OR then decides whether it recognizes the relay cell, by
  502. inspecting the payload as described in section 6.1 below. If the OR
  503. recognizes the cell, it processes the contents of the relay cell.
  504. Otherwise, it passes the decrypted relay cell along the circuit if
  505. the circuit continues. If the OR at the end of the circuit
  506. encounters an unrecognized relay cell, an error has occurred: the OR
  507. sends a DESTROY cell to tear down the circuit.
  508. When a relay cell arrives at an OP, the OP decrypts the payload
  509. with the stream cipher as follows:
  510. OP receives data cell:
  511. For I=N...1,
  512. Decrypt with Kb_I. If the payload is recognized (see
  513. section 6..1), then stop and process the payload.
  514. For more information, see section 6 below.
  515. 5.6. Handling relay_early cells
  516. A RELAY_EARLY cell is designed to limit the length any circuit can reach.
  517. When an OR receives a RELAY_EARLY cell, and the next node in the circuit
  518. is speaking v2 of the link protocol or later, the OR relays the cell as a
  519. RELAY_EARLY cell. Otherwise, it relays it as a RELAY cell.
  520. If a node ever receives more than 8 RELAY_EARLY cells on a given
  521. outbound circuit, it SHOULD close the circuit. (For historical reasons,
  522. we don't limit the number of inbound RELAY_EARLY cells; they should
  523. be harmless anyway because clients won't accept extend requests. See
  524. bug 1038.)
  525. When speaking v2 of the link protocol or later, clients MUST only send
  526. EXTEND cells inside RELAY_EARLY cells. Clients SHOULD send the first ~8
  527. RELAY cells that are not targeted at the first hop of any circuit as
  528. RELAY_EARLY cells too, in order to partially conceal the circuit length.
  529. [In a future version of Tor, servers will reject any EXTEND cell not
  530. received in a RELAY_EARLY cell. See proposal 110.]
  531. 6. Application connections and stream management
  532. 6.1. Relay cells
  533. Within a circuit, the OP and the exit node use the contents of
  534. RELAY packets to tunnel end-to-end commands and TCP connections
  535. ("Streams") across circuits. End-to-end commands can be initiated
  536. by either edge; streams are initiated by the OP.
  537. The payload of each unencrypted RELAY cell consists of:
  538. Relay command [1 byte]
  539. 'Recognized' [2 bytes]
  540. StreamID [2 bytes]
  541. Digest [4 bytes]
  542. Length [2 bytes]
  543. Data [CELL_LEN-14 bytes]
  544. The relay commands are:
  545. 1 -- RELAY_BEGIN [forward]
  546. 2 -- RELAY_DATA [forward or backward]
  547. 3 -- RELAY_END [forward or backward]
  548. 4 -- RELAY_CONNECTED [backward]
  549. 5 -- RELAY_SENDME [forward or backward] [sometimes control]
  550. 6 -- RELAY_EXTEND [forward] [control]
  551. 7 -- RELAY_EXTENDED [backward] [control]
  552. 8 -- RELAY_TRUNCATE [forward] [control]
  553. 9 -- RELAY_TRUNCATED [backward] [control]
  554. 10 -- RELAY_DROP [forward or backward] [control]
  555. 11 -- RELAY_RESOLVE [forward]
  556. 12 -- RELAY_RESOLVED [backward]
  557. 13 -- RELAY_BEGIN_DIR [forward]
  558. 32..40 -- Used for hidden services; see rend-spec.txt.
  559. Commands labelled as "forward" must only be sent by the originator
  560. of the circuit. Commands labelled as "backward" must only be sent by
  561. other nodes in the circuit back to the originator. Commands marked
  562. as either can be sent either by the originator or other nodes.
  563. The 'recognized' field in any unencrypted relay payload is always set
  564. to zero; the 'digest' field is computed as the first four bytes of
  565. the running digest of all the bytes that have been destined for
  566. this hop of the circuit or originated from this hop of the circuit,
  567. seeded from Df or Db respectively (obtained in section 5.2 above),
  568. and including this RELAY cell's entire payload (taken with the digest
  569. field set to zero).
  570. When the 'recognized' field of a RELAY cell is zero, and the digest
  571. is correct, the cell is considered "recognized" for the purposes of
  572. decryption (see section 5.5 above).
  573. (The digest does not include any bytes from relay cells that do
  574. not start or end at this hop of the circuit. That is, it does not
  575. include forwarded data. Therefore if 'recognized' is zero but the
  576. digest does not match, the running digest at that node should
  577. not be updated, and the cell should be forwarded on.)
  578. All RELAY cells pertaining to the same tunneled stream have the
  579. same stream ID. StreamIDs are chosen arbitrarily by the OP. RELAY
  580. cells that affect the entire circuit rather than a particular
  581. stream use a StreamID of zero -- they are marked in the table above
  582. as "[control]" style cells. (Sendme cells are marked as "sometimes
  583. control" because they can take include a StreamID or not depending
  584. on their purpose -- see Section 7.)
  585. The 'Length' field of a relay cell contains the number of bytes in
  586. the relay payload which contain real payload data. The remainder of
  587. the payload is padded with NUL bytes.
  588. If the RELAY cell is recognized but the relay command is not
  589. understood, the cell must be dropped and ignored. Its contents
  590. still count with respect to the digests, though.
  591. 6.2. Opening streams and transferring data
  592. To open a new anonymized TCP connection, the OP chooses an open
  593. circuit to an exit that may be able to connect to the destination
  594. address, selects an arbitrary StreamID not yet used on that circuit,
  595. and constructs a RELAY_BEGIN cell with a payload encoding the address
  596. and port of the destination host. The payload format is:
  597. ADDRESS | ':' | PORT | [00]
  598. where ADDRESS can be a DNS hostname, or an IPv4 address in
  599. dotted-quad format, or an IPv6 address surrounded by square brackets;
  600. and where PORT is a decimal integer between 1 and 65535, inclusive.
  601. [What is the [00] for? -NM]
  602. [It's so the payload is easy to parse out with string funcs -RD]
  603. Upon receiving this cell, the exit node resolves the address as
  604. necessary, and opens a new TCP connection to the target port. If the
  605. address cannot be resolved, or a connection can't be established, the
  606. exit node replies with a RELAY_END cell. (See 6.4 below.)
  607. Otherwise, the exit node replies with a RELAY_CONNECTED cell, whose
  608. payload is in one of the following formats:
  609. The IPv4 address to which the connection was made [4 octets]
  610. A number of seconds (TTL) for which the address may be cached [4 octets]
  611. or
  612. Four zero-valued octets [4 octets]
  613. An address type (6) [1 octet]
  614. The IPv6 address to which the connection was made [16 octets]
  615. A number of seconds (TTL) for which the address may be cached [4 octets]
  616. [XXXX No version of Tor currently generates the IPv6 format.]
  617. [Tor servers before 0.1.2.0 set the TTL field to a fixed value. Later
  618. versions set the TTL to the last value seen from a DNS server, and expire
  619. their own cached entries after a fixed interval. This prevents certain
  620. attacks.]
  621. The OP waits for a RELAY_CONNECTED cell before sending any data.
  622. Once a connection has been established, the OP and exit node
  623. package stream data in RELAY_DATA cells, and upon receiving such
  624. cells, echo their contents to the corresponding TCP stream.
  625. RELAY_DATA cells sent to unrecognized streams are dropped.
  626. Relay RELAY_DROP cells are long-range dummies; upon receiving such
  627. a cell, the OR or OP must drop it.
  628. 6.2.1. Opening a directory stream
  629. If a Tor server is a directory server, it should respond to a
  630. RELAY_BEGIN_DIR cell as if it had received a BEGIN cell requesting a
  631. connection to its directory port. RELAY_BEGIN_DIR cells ignore exit
  632. policy, since the stream is local to the Tor process.
  633. If the Tor server is not running a directory service, it should respond
  634. with a REASON_NOTDIRECTORY RELAY_END cell.
  635. Clients MUST generate an all-zero payload for RELAY_BEGIN_DIR cells,
  636. and servers MUST ignore the payload.
  637. [RELAY_BEGIN_DIR was not supported before Tor 0.1.2.2-alpha; clients
  638. SHOULD NOT send it to routers running earlier versions of Tor.]
  639. 6.3. Closing streams
  640. When an anonymized TCP connection is closed, or an edge node
  641. encounters error on any stream, it sends a 'RELAY_END' cell along the
  642. circuit (if possible) and closes the TCP connection immediately. If
  643. an edge node receives a 'RELAY_END' cell for any stream, it closes
  644. the TCP connection completely, and sends nothing more along the
  645. circuit for that stream.
  646. The payload of a RELAY_END cell begins with a single 'reason' byte to
  647. describe why the stream is closing, plus optional data (depending on
  648. the reason.) The values are:
  649. 1 -- REASON_MISC (catch-all for unlisted reasons)
  650. 2 -- REASON_RESOLVEFAILED (couldn't look up hostname)
  651. 3 -- REASON_CONNECTREFUSED (remote host refused connection) [*]
  652. 4 -- REASON_EXITPOLICY (OR refuses to connect to host or port)
  653. 5 -- REASON_DESTROY (Circuit is being destroyed)
  654. 6 -- REASON_DONE (Anonymized TCP connection was closed)
  655. 7 -- REASON_TIMEOUT (Connection timed out, or OR timed out
  656. while connecting)
  657. 8 -- (unallocated) [**]
  658. 9 -- REASON_HIBERNATING (OR is temporarily hibernating)
  659. 10 -- REASON_INTERNAL (Internal error at the OR)
  660. 11 -- REASON_RESOURCELIMIT (OR has no resources to fulfill request)
  661. 12 -- REASON_CONNRESET (Connection was unexpectedly reset)
  662. 13 -- REASON_TORPROTOCOL (Sent when closing connection because of
  663. Tor protocol violations.)
  664. 14 -- REASON_NOTDIRECTORY (Client sent RELAY_BEGIN_DIR to a
  665. non-directory server.)
  666. (With REASON_EXITPOLICY, the 4-byte IPv4 address or 16-byte IPv6 address
  667. forms the optional data, along with a 4-byte TTL; no other reason
  668. currently has extra data.)
  669. OPs and ORs MUST accept reasons not on the above list, since future
  670. versions of Tor may provide more fine-grained reasons.
  671. Tors SHOULD NOT send any reason except REASON_MISC for a stream that they
  672. have originated.
  673. [*] Older versions of Tor also send this reason when connections are
  674. reset.
  675. [**] Due to a bug in versions of Tor through 0095, error reason 8 must
  676. remain allocated until that version is obsolete.
  677. --- [The rest of this section describes unimplemented functionality.]
  678. Because TCP connections can be half-open, we follow an equivalent
  679. to TCP's FIN/FIN-ACK/ACK protocol to close streams.
  680. An exit connection can have a TCP stream in one of three states:
  681. 'OPEN', 'DONE_PACKAGING', and 'DONE_DELIVERING'. For the purposes
  682. of modeling transitions, we treat 'CLOSED' as a fourth state,
  683. although connections in this state are not, in fact, tracked by the
  684. onion router.
  685. A stream begins in the 'OPEN' state. Upon receiving a 'FIN' from
  686. the corresponding TCP connection, the edge node sends a 'RELAY_FIN'
  687. cell along the circuit and changes its state to 'DONE_PACKAGING'.
  688. Upon receiving a 'RELAY_FIN' cell, an edge node sends a 'FIN' to
  689. the corresponding TCP connection (e.g., by calling
  690. shutdown(SHUT_WR)) and changing its state to 'DONE_DELIVERING'.
  691. When a stream in already in 'DONE_DELIVERING' receives a 'FIN', it
  692. also sends a 'RELAY_FIN' along the circuit, and changes its state
  693. to 'CLOSED'. When a stream already in 'DONE_PACKAGING' receives a
  694. 'RELAY_FIN' cell, it sends a 'FIN' and changes its state to
  695. 'CLOSED'.
  696. If an edge node encounters an error on any stream, it sends a
  697. 'RELAY_END' cell (if possible) and closes the stream immediately.
  698. 6.4. Remote hostname lookup
  699. To find the address associated with a hostname, the OP sends a
  700. RELAY_RESOLVE cell containing the hostname to be resolved with a NUL
  701. terminating byte. (For a reverse lookup, the OP sends a RELAY_RESOLVE
  702. cell containing an in-addr.arpa address.) The OR replies with a
  703. RELAY_RESOLVED cell containing a status byte, and any number of
  704. answers. Each answer is of the form:
  705. Type (1 octet)
  706. Length (1 octet)
  707. Value (variable-width)
  708. TTL (4 octets)
  709. "Length" is the length of the Value field.
  710. "Type" is one of:
  711. 0x00 -- Hostname
  712. 0x04 -- IPv4 address
  713. 0x06 -- IPv6 address
  714. 0xF0 -- Error, transient
  715. 0xF1 -- Error, nontransient
  716. If any answer has a type of 'Error', then no other answer may be given.
  717. The RELAY_RESOLVE cell must use a nonzero, distinct streamID; the
  718. corresponding RELAY_RESOLVED cell must use the same streamID. No stream
  719. is actually created by the OR when resolving the name.
  720. 7. Flow control
  721. 7.1. Link throttling
  722. Each client or relay should do appropriate bandwidth throttling to
  723. keep its user happy.
  724. Communicants rely on TCP's default flow control to push back when they
  725. stop reading.
  726. The mainline Tor implementation uses token buckets (one for reads,
  727. one for writes) for the rate limiting.
  728. Since 0.2.0.x, Tor has let the user specify an additional pair of
  729. token buckets for "relayed" traffic, so people can deploy a Tor relay
  730. with strict rate limiting, but also use the same Tor as a client. To
  731. avoid partitioning concerns we combine both classes of traffic over a
  732. given OR connection, and keep track of the last time we read or wrote
  733. a high-priority (non-relayed) cell. If it's been less than N seconds
  734. (currently N=30), we give the whole connection high priority, else we
  735. give the whole connection low priority. We also give low priority
  736. to reads and writes for connections that are serving directory
  737. information. See proposal 111 for details.
  738. 7.2. Link padding
  739. Link padding can be created by sending PADDING cells along the
  740. connection; relay cells of type "DROP" can be used for long-range
  741. padding.
  742. Currently nodes are not required to do any sort of link padding or
  743. dummy traffic. Because strong attacks exist even with link padding,
  744. and because link padding greatly increases the bandwidth requirements
  745. for running a node, we plan to leave out link padding until this
  746. tradeoff is better understood.
  747. 7.3. Circuit-level flow control
  748. To control a circuit's bandwidth usage, each OR keeps track of two
  749. 'windows', consisting of how many RELAY_DATA cells it is allowed to
  750. originate (package for transmission), and how many RELAY_DATA cells
  751. it is willing to consume (receive for local streams). These limits
  752. do not apply to cells that the OR receives from one host and relays
  753. to another.
  754. Each 'window' value is initially set to 1000 data cells
  755. in each direction (cells that are not data cells do not affect
  756. the window). When an OR is willing to deliver more cells, it sends a
  757. RELAY_SENDME cell towards the OP, with Stream ID zero. When an OR
  758. receives a RELAY_SENDME cell with stream ID zero, it increments its
  759. packaging window.
  760. Each of these cells increments the corresponding window by 100.
  761. The OP behaves identically, except that it must track a packaging
  762. window and a delivery window for every OR in the circuit.
  763. An OR or OP sends cells to increment its delivery window when the
  764. corresponding window value falls under some threshold (900).
  765. If a packaging window reaches 0, the OR or OP stops reading from
  766. TCP connections for all streams on the corresponding circuit, and
  767. sends no more RELAY_DATA cells until receiving a RELAY_SENDME cell.
  768. [this stuff is badly worded; copy in the tor-design section -RD]
  769. 7.4. Stream-level flow control
  770. Edge nodes use RELAY_SENDME cells to implement end-to-end flow
  771. control for individual connections across circuits. Similarly to
  772. circuit-level flow control, edge nodes begin with a window of cells
  773. (500) per stream, and increment the window by a fixed value (50)
  774. upon receiving a RELAY_SENDME cell. Edge nodes initiate RELAY_SENDME
  775. cells when both a) the window is <= 450, and b) there are less than
  776. ten cell payloads remaining to be flushed at that edge.
  777. A.1. Differences between spec and implementation
  778. - The current specification requires all ORs to have IPv4 addresses, but
  779. allows servers to exit and resolve to IPv6 addresses, and to declare IPv6
  780. addresses in their exit policies. The current codebase has no IPv6
  781. support at all.