aboutsummaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorNick Mathewson <nickm@torproject.org>2023-11-07 14:20:42 -0500
committerNick Mathewson <nickm@torproject.org>2023-11-07 14:20:42 -0500
commit6832f7fa81cb6cf0035179e093720cc79a04cc64 (patch)
treed460dc315196b2e5400b3325d2e52e8569c84430
parent78d05b3950da4223a0331b3440dd3c1dda4d600a (diff)
downloadtorspec-6832f7fa81cb6cf0035179e093720cc79a04cc64.tar.gz
torspec-6832f7fa81cb6cf0035179e093720cc79a04cc64.zip
relay-keys: reformat.
-rw-r--r--spec/tor-spec/relay-keys.md78
1 files changed, 38 insertions, 40 deletions
diff --git a/spec/tor-spec/relay-keys.md b/spec/tor-spec/relay-keys.md
index 69cce49..975c460 100644
--- a/spec/tor-spec/relay-keys.md
+++ b/spec/tor-spec/relay-keys.md
@@ -6,46 +6,44 @@ Every Tor relay has multiple public/private keypairs.
These are 1024-bit RSA keys:
-```text
- - A long-term signing-only "Identity key" used to sign documents and
- certificates, and used to establish relay identity.
- KP_relayid_rsa, KS_relayid_rsa.
- - A medium-term TAP "Onion key" used to decrypt onion skins when accepting
- circuit extend attempts. (See 5.1.) Old keys MUST be accepted for a
- while after they are no longer advertised. Because of this,
- relays MUST retain old keys for a while after they're rotated. (See
- "onion key lifetime parameters" in dir-spec.txt.)
- KP_onion_tap, KS_onion_tap.
- - A short-term "Connection key" used to negotiate TLS connections.
- Tor implementations MAY rotate this key as often as they like, and
- SHOULD rotate this key at least once a day.
- KP_conn_tls, KS_conn_tls.
-
- This is Curve25519 key:
-
- - A medium-term ntor "Onion key" used to handle onion key handshakes when
- accepting incoming circuit extend requests. As with TAP onion keys,
- old ntor keys MUST be accepted for at least one week after they are no
- longer advertised. Because of this, relays MUST retain old keys for a
- while after they're rotated. (See "onion key lifetime parameters" in
- dir-spec.txt.)
- KP_ntor, KS_ntor.
-
- These are Ed25519 keys:
-
- - A long-term "master identity" key. This key never
- changes; it is used only to sign the "signing" key below. It may be
- kept offline.
- KP_relayid_ed, KS_relayid_ed.
- - A medium-term "signing" key. This key is signed by the master identity
- key, and must be kept online. A new one should be generated
- periodically. It signs nearly everything else.
- KP_relaysign_ed, KS_relaysign_ed.
- - A short-term "link authentication" key, used to authenticate
- the link handshake: see section 4 below. This key is signed
- by the "signing" key, and should be regenerated frequently.
- KP_link_ed, KS_link_ed.
-```
+- A long-term signing-only "Identity key" used to sign documents and
+ certificates, and used to establish relay identity.
+ `KP_relayid_rsa`, `KS_relayid_rsa`.
+- A medium-term TAP "Onion key" used to decrypt onion skins when accepting
+ circuit extend attempts. (See 5.1.) Old keys MUST be accepted for a
+ while after they are no longer advertised. Because of this,
+ relays MUST retain old keys for a while after they're rotated. (See
+ "onion key lifetime parameters" in dir-spec.txt.)
+ `KP_onion_tap`, `KS_onion_tap`.
+- A short-term "Connection key" used to negotiate TLS connections.
+ Tor implementations MAY rotate this key as often as they like, and
+ SHOULD rotate this key at least once a day.
+ `KP_conn_tls`, `KS_conn_tls`.
+
+This is Curve25519 key:
+
+- A medium-term ntor "Onion key" used to handle onion key handshakes when
+ accepting incoming circuit extend requests. As with TAP onion keys,
+ old ntor keys MUST be accepted for at least one week after they are no
+ longer advertised. Because of this, relays MUST retain old keys for a
+ while after they're rotated. (See "onion key lifetime parameters" in
+ dir-spec.txt.)
+ `KP_ntor`, `KS_ntor`.
+
+These are Ed25519 keys:
+
+- A long-term "master identity" key. This key never
+ changes; it is used only to sign the "signing" key below. It may be
+ kept offline.
+ `KP_relayid_ed`, `KS_relayid_ed`.
+- A medium-term "signing" key. This key is signed by the master identity
+ key, and must be kept online. A new one should be generated
+ periodically. It signs nearly everything else.
+ `KP_relaysign_ed`, `KS_relaysign_ed`.
+- A short-term "link authentication" key, used to authenticate
+ the link handshake: see section 4 below. This key is signed
+ by the "signing" key, and should be regenerated frequently.
+ `KP_link_ed`, `KS_link_ed`.
KP_relayid\_\* together identify a router uniquely. Once a router
has used a KP_relayid_ed (an Ed25519 master identity key)