Distributed Storage of Tor Hidden Service Descriptors

Tor provides a mechanism for responder anonymity via hidden services. As a part of these, Tor provides storage on its central directory servers to allow publishing and retrieving rendezvous service descriptors. This proposal suggests to replace the centralized approach by a distributed storage of descriptors to the larger set of onion routers. Benefits include (1) better load balancing which is vital for the further growing of the network, (2) a more scalable way to publish descriptors, and (3) extensibility of hidden services to features like human-readable names or client authentication. As possible drawback can be seen that new threats arise due to decentralization that need to be discussed and handled. In this project a structure is applied to the network of onion routers, based on concepts known from distributed hash tables and consistent hashing systems. Every participating router is made responsible for a limited set of descriptors. It is not necessary to maintain an own routing table, but possible to rely on the router list managed by the Tor directory. Some amount of replication needs to be added to overcome node failures and untrustworthy routers. This prevents the worst security threats, as descriptors are signed and have a limited time-to-live. Thus, they cannot be forged or replayed. Preliminary measurements show that routers exhibit a very low churn rate which makes them a perfect field for consistent hashing. The purpose of this project is to extend the current Tor sources to a running prototype that contains a distributed storage of rendezvous service descriptor. 1 Motivation The Tor system [1] provides a mechanism for responder anonymity via location-protected servers, the socalled hidden services. These enable any node which is running a Tor onion proxy to set up a server (e.g. web server, file server) and make it available for clients via the network of onion routers. Tor provides storage on its central directory servers to publish and retrieve contact information—so-called rendezvous service descriptors (RSDs)—from servers to clients. In this proposal we suggest to replace the centralized storage of RSDs by a decentralized approach. We argue that the task to store and lookup RSDs can equally be performed by the network of Tor onion routers. The Tor developers state that this task could be done “on any robust efficient key-value lookup system with authenticated updates, such as a distributed hash table” [1]. Overlier and Syverson argue that “authoritative directory servers for hidden services as a core part of the Tor network are not necessary” and that “the primary motivation for their use initially has been one of convenience” [2]. However, we did not find a design for a distributed storage of RSDs in Tor in the literature, yet. There are several benefits from distributing storage to multiple Tor routers. The most obvious is load balancing: publish and retrieve operations to the directory nodes cause additional network traffic, require computation (e.g. for validating signatures) and consume memory. In a decentralized solution, directory servers would no longer be burdened with these tasks.