November 7, 2017 weblog
Tor to usher in better deal: A bigger, tastier, onion
(Tech Xplore)—"Dance like no one's watching. Encrypt like everyone is." That is a "Wednesday wisdom" pinned tweet on the Tor Project Twitter account and quite appropriate to describe their four-year resolve to keep on trucking with a next-generation onion services system.
Now Tor has let it out of the gate with an update. "We are hyped to present the next generation of onion services!" they blogged on November 2.
They released a video, earlier this month, "Celebrating Tor's Next Generation of Onion Services." They stated, "We believe that being able to express yourself and publish content with privacy is as important as being able to browse the web privately, and hence we consider onion services a critical part of the internet.
What is an onion service? Lucian Armasu, Tom's Hardware: It's essentially "a website or online service that uses a '.onion' domain name you can only access only through the Tor browser instead of using a more common Top Level Domain such as .com."
News organizations may use them for private information disclosure; a website may use it to avert censorship and to give users a secure gateway; the cryptocurrency system uses it for transactions; others, for reachability "and permanent onion address if they are behind NAT or dynamic IP."
Fossbytes said "they won't be pulling off the existing onion system which fuels the network for the users right now. The transition will take place eventually over time."
They said they do not plan on killing support for the legacy onion system version 2.0 just yet; Armasu said it will remain the default for the next few years.
In their own words: "we don't want to destabilize the current onion community and so we are not planning to kill the legacy system just yet. As a matter of fact, the legacy system will remain the default option for some more time, while the userbase migrates to the next generation and as we kill bugs and write features."
So what if users want to see what the new version is all about? The Tor alpha release is now available for download.
Fossbytes said to expect more security, more privacy. Fossbytes said Tor needed it.
"The legacy onion system has been around for over 10 years and its age has started to show," the group said on the Tor blog.
Launching Tor's next generation of onion services was a project four years in the making.
So how big are the changes?
Fossbytes said they are significant. The set of changes "involves next-generation crypto algorithms, improved authentication schemes, and redesigned directory."
Simply, as Saqib Shah put it in Engadget, "By using new encryption algorithms, improved authentication, and a redesigned directory, Tor claims its next-gen design will keep an onion address completely private.
Armasu said that "To make onion addresses less easy to find on the network, their address length is now much larger." (Or, as the Tor blog said, "new onions are bigger, tastier and they now look like this: 7fa6xlti5joarlmkuhjaifa47ukgcwz6tfndgax45ocyn4rixm632jid.onion.")
Armasu also provided a change list. These included: Improved directory protocol, leaking less information to directory servers and cleaner, more modular codebase.
In the revised version onion addresses are made completely private.
The Tor blog: "with this next-generation design, your onion address is completely private and only known to you and whoever you choose to disclose it to."
The Nov. 2 blog said that as the current code stabilizes further, "we plan to add features like offline service keys, advanced client authorization, a control port interface, improved guard algorithms, secure naming systems, statistics, mixed-latency routing, blockchain support, AI logic and a VR interface."
Still, this cannot be a rush job. They referred to "lots to do and many bugs to squash."
© 2017 Tech Xplore