Re: [tor-dev] common/aes.c troubles

2011-12-17 Thread Nick Mathewson
On Wed, Dec 14, 2011 at 6:28 AM, Gisle Vanem wrote: > How about it? I'd say "not so good" if it only applies to MSVC builds. The orconfig.h files is supposed to correspond exactly to the one that would ordinarily be generated by the autoconf script for on other platforms. Of course, if we patc

Re: [tor-dev] Is Taking Checksum of Packet Payloads a Vulnerability?

2011-12-17 Thread Watson Ladd
Note that the data sent from Alice to En is encrypted with a key only they share, rendering this attack impossible. On Dec 17, 2011 11:25 AM, "Daniel Cohen" wrote: > Hi, > > I am new to Tor, but after reading about its design, and reading a few > research papers on its vulnerabilities (specifical

Re: [tor-dev] Is Taking Checksum of Packet Payloads a Vulnerability?

2011-12-17 Thread Dave Jevans
This attach will not work. Alice's tor client on her computer creates a Multi layered encrypted connection, hence the term onion routing. If Alice's connection to the exit node goes through 3 tor nodes (eg entry, middle, exit) then the connection is encrypted three times with different keys a

[tor-dev] Is Taking Checksum of Packet Payloads a Vulnerability?

2011-12-17 Thread Daniel Cohen
Hi, I am new to Tor, but after reading about its design, and reading a few research papers on its vulnerabilities (specifically timing attacks), I had the following thought: Suppose Alice is connecting to Bob via Tor, using HTTPS encryption. She sends a packet to the Tor entry node (call it En).

Re: [tor-dev] [tor-announce] Tor 0.2.2.35 is released (security patches)

2011-12-17 Thread Fabio Pietrosanti (naif)
Should we think to have all tor-users that run a version minor than X, go automatically off-the-network? I mean, if we have let's say 10% of outdated users, it means that 10% of the network can be compromised with a single remote exploit. I mean, running a Tor node today it's a responsibility. I