networking - Attempting to understand Tor and it's relation to SSL -


i'm mathematics student trying understand tor. have little knowledge of networks , how function.

up i understand basic functionality of tor. route generated first consensus list, , packet (the message) sent through route. packet encrypted multiple times using public keys obtained consensus list, , each relay strips away layer of encryption before sending on next relay (side question: how work bridge relays? message sent bridge relay first , public tor network, or move exclusively through bridge relays?). means destination ip , ip of sender never in same header of packet , gives tor relative anonymity.

very notice ssl brought when discussions regarding tor made. understand ssl encrypts data sent between client , server. if case don't see how ssl related tor, since seemingly function on different layer.

edit: more specifically, i'm reading how iranian , chinese authorities did "deep package inspection" (i'm assuming means looked @ contents of each packet) ssl. because ssl used default encrypting different layers in onioned packet? if so, there reason looking ssl enough indentify tor connection?

i think find document on tor spec informative; sections 1 & 2.

you'll find tor might use sslv3 (specifically ssl_dhe_rsa_with_3des_ede_cbc_sha) more use tls communicating clients , other nodes.

clients encrypt data using keys belonging nodes circuit path chose unwrapped (peeled) data travels relay relay, data (and other protocol data communicating called cells) sent node node using tls or ssl. of data encrypted transport encrypted (for example contents of http request client view website on tor).

regarding deep packet inspection question, couldn't determine traffic tor traffic based solely on being ssl. use additional information make such assumptions such as:

  • source/destination ports: many relays use port 443 tor traffic, 9001 used strong indicator tor traffic
  • specific ciphers (common ciphers used tor)
  • src/dest ip address: tor relay ips known, if have list, can make conclusions tor traffic if packets tor ip encrypted or going to/from orport
  • look @ ssl handshakes identifying factors (i.e. certificates-up-front)

seeing ssl/tls packets alone not enough them determine traffic tor traffic.

hope helps some.


Comments

Popular posts from this blog

Hatching array of circles in AutoCAD using c# -

ios - UITEXTFIELD InputView Uipicker not working in swift -

Python Pig Latin Translator -