blob: 4f13835afd1e8c3bd8ef449a14d28d69d7dc30c0 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
|
```
Filename: 326-tor-relay-well-known-uri-rfc8615.md
Title: The "tor-relay" Well-Known Resource Identifier
Author: nusenu
Created: 14 August 2020
Status: Open
```
# The "tor-relay" Well-Known Resource Identifier
This is a specification for a well-known [registry](https://www.iana.org/assignments/well-known-uris/) entry according to [RFC8615](https://tools.ietf.org/html/rfc8615).
This resource identifier can be used for serving and finding proofs related to [Tor](https://www.torproject.org/) relay contact information.
It can also be used for autodiscovery of Tor relays run by a given entity, if the entity domain is known.
It solves the issue that Tor relay contact information is an unidirectional and unverified claim by nature.
This well-known URI aims to allow the verification of the unidirectional claim.
It aims to reduce the risk of impersonation attacks, where a Tor relay claims to be operated by a certain entity, but actually isn't.
The automated verification will also support the [visualization of relay groups](https://gitlab.torproject.org/tpo/metrics/relay-search/-/issues/40001).
* An initially (unverified) Tor relay contact information might claim to be related to an
organization by pointing to its website: Tor relay contact information field -> website
* The "tor-relay" URI allows for the verification of that claim by fetching the files containing Tor relay ID(s) under the specified URI,
because attackers can not easily place these files at the given location.
* By publishing Tor relay IDs under this URI the website operator claims to be the responsible entity for these Tor relays.
The verification of listed Tor relay IDs only succeeds if the claim can be verified bidirectionally (website -> relay and relay -> website).
* This URI is not related to Tor bridges or Tor onion services.
* The URL MUST be HTTPS and use a valid TLS certificate from a generally trusted root CA. Plain HTTP MUST not be used.
* The URL MUST be accessible by robots (no CAPTCHAs).
## /.well-known/tor-relay/rsa-fingerprint.txt
* The file contains one or more Tor relay RSA SHA1 fingerprints operated by the entity in control of this website.
* Each line contains one fingerprint.
* The file may contain comments (starting with #).
* Non-comment lines must be exactly 40 characters long and consist of the following characters [a-fA-F0-9].
* Fingerprints are not case-sensitive.
* Each fingerprint MUST appear at most once.
* The file MUST not be larger than one MByte.
* The file MUST NOT contain fingerprints of Tor bridges (or hashes of bridge fingerprints).
* The content MUST be a media type of "text/plain".
Example file content:
```
# we operate these Tor relays
A234567890123456789012345678901234567ABC
B234567890123456789012345678901234567890
```
The RSA SHA1 relay fingerprint can be found in the file named "fingerprint" located in the Tor data directory on the relay.
## /.well-known/tor-relay/ed25519-master-pubkey.txt
* The file contains one or more ed25519 Tor relay public master keys of relays operated by the entity in control of this website.
* Each line contains one public ed25519 master key in its base64 encoded form.
* The file may contain comments (starting with #).
* Non-comment lines must be exactly 43 characters long and consist of the following characters [a-zA-z0-9/+].
* Each key MUST appear at most once.
* The file MUST not be larger than one MByte.
* The content MUST be a media type of "text/plain".
Example file content:
```
# we operate these Tor relays
yp0fwtp4aa/VMyZJGz8vN7Km3zYet1YBZwqZEk1CwHI
kXdA5dmIhXblAquMx0M0ApWJJ4JGQGLsjUSn86cbIaU
bHzOT41w56KHh+w6TYwUhN4KrGwPWQWJX04/+tw/+RU
```
The base64 encoded ed25519 public master key can be found in the file named "fingerprint-ed25519" located in the Tor data directory on the relay.
# Change Controller
Tor Project Development Mailing List <tor-dev@lists.torproject.org>
# Related Information
* [https://gitweb.torproject.org/torspec.git/tree/tor-spec.txt](https://gitweb.torproject.org/torspec.git/tree/tor-spec.txt)
* [https://gitweb.torproject.org/torspec.git/tree/cert-spec.txt](https://gitweb.torproject.org/torspec.git/tree/cert-spec.txt)
* [https://nusenu.github.io/ContactInfo-Information-Sharing-Specification](https://nusenu.github.io/ContactInfo-Information-Sharing-Specification)
* [RFC8615](https://tools.ietf.org/html/rfc8615)
|
