authenticated links between nodes and a descriptor mirror
a relay now extends a circuit only to a node of its roster, over a link authenticated to that node, and the client takes the bundles of its chain from its entry alone.
one change reached the main branch since the last note. that note left links between nodes without authentication; with node authentication on, every link of a circuit is now authenticated to the node it leads to. the numbers on the research page are the same preliminary series as before.
every relay gets a roster
enrollment now ends by sending every relay a roster: the trust anchor and the name and address of every node of that issuance, the same bytes to each. a relay takes one roster per process, and only after its certificate.
with the roster a relay fetches the signed bundles of the other roster nodes, checks each one against the roster’s anchor and keeps them in memory only.
a link is authenticated to the node it leads to
a relay extends a circuit only to a node of its roster whose verified descriptor it holds. a setup cell that names any other address is refused without a connection.
the relay mixes the next node’s link key, taken from that verified descriptor, into the link handshake, as the client does for its entry. the responder then confirms the keys before any cell is sent: a responder without the expected link key cannot produce the confirmation, the handshake fails, and it is sent no setup cell.
why it matters: this is the countermeasure against an active party between nodes taking the place of the next node.
the entry mirrors the descriptors
every relay serves a mirror: its own bundle and the verified bundles of the other roster nodes. the client requests the bundles of its chain from its entry and from no other node.
the client trusts the entry with nothing. it verifies every bundle against its own anchor, so the entry can withhold bundles but cannot alter them.
why it matters: the entry is now the only node a client connects to, also for the bundles of the chain.
what this does not fix
- a link is authenticated in one direction. the responder does not authenticate the initiator, so a node still cannot tell a roster node from a client or from anyone else who connects to its cell port.
- the entry can withhold the bundles, which is a denial of service, and it sees when a client prepares a circuit: the request for the descriptors precedes the setup.
- a node keeps a peer’s descriptor until it expires. after a peer restarts, the mirror serves its previous bundle for up to the descriptor lifetime, and circuits through that peer fail at setup.
- whoever installs a roster chooses which hosts a relay polls for descriptors. an answer counts only if it verifies under the roster’s anchor.
- the baseline without node authentication stays for measurements on the testbed: it extends a circuit to any address named in the setup cell, and its links between nodes are not authenticated.
next on the roadmap are forward secrecy for circuit layers and a node list longer than three.
the full list is on the limits page and in limitations. the link handshake, the roster and the mirror are described in architecture, the threats and countermeasures in the threat model. all advisories of the repository are now published on its security advisories page.