torproject/torspec
1
0
Fork 0
mirror of https://github.com/torproject/torspec.git synced 2024-12-15 06:28:46 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Document that rend-spec.txt uses KDF-Tor like TAP does

Browse Source 
Fix for #8809
This commit is contained in:
Nick Mathewson 2014-03-27 16:03:48 -04:00
parent f13c1960c9
commit 4d3041c6fe
1 changed files with 6 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
rend-spec.txt
View File

@ -733,19 +733,17 @@
received a reply, it uses g^y and H(g^xy) to complete the handshake as in received a reply, it uses g^y and H(g^xy) to complete the handshake as in
the Tor circuit extend process: they establish a 60-octet string as the Tor circuit extend process: they establish a 60-octet string as
K = SHA1(g^xy | [00]) | SHA1(g^xy | [01]) | SHA1(g^xy | [02]) K = SHA1(g^xy | [00]) | SHA1(g^xy | [01]) | SHA1(g^xy | [02])
and generate and generate KH, Df, Db, Kf, and Kb as in the KDF-TOR key derivation
KH = K[0..15] approach documented in tor-spec.txt.
Kf = K[16..31]
Kb = K[32..47]
Subsequently, the rendezvous point passes relay cells, unchanged, from Subsequently, the rendezvous point passes relay cells, unchanged, from
each of the two circuits to the other. When Alice's OP sends each of the two circuits to the other. When Alice's OP sends RELAY cells
RELAY cells along the circuit, it first encrypts them with the along the circuit, it authenticates with Df, and encrypts them with the
Kf, then with all of the keys for the ORs in Alice's side of the circuit; Kf, then with all of the keys for the ORs in Alice's side of the circuit;
and when Alice's OP receives RELAY cells from the circuit, it decrypts and when Alice's OP receives RELAY cells from the circuit, it decrypts
them with the keys for the ORs in Alice's side of the circuit, then them with the keys for the ORs in Alice's side of the circuit, then
decrypts them with Kb. Bob's OP does the same, with Kf and Kb decrypts them with Kb, and checks integrity with Db. Bob's OP does the
interchanged. same, with Kf and Kb interchanged.
1.11. Creating streams 1.11. Creating streams