[tor-dev] documentation for new offline master key functionality (--keygen is undocumented)

[nusenu]

Hi,

since tor 0.2.7.5 is apparently not very far [1] from being released I
was wondering whether there is any documentation about the new offline
master key functionality?
(or is this undocumented because it is not considered for general use yet?)

tor v0.2.7.4-rc's manual has the following:

"
SigningKeyLifetime N days|weeks|months

For how long should each Ed25519 signing key be valid? Tor uses a
permanent master identity key that can be kept offline, and periodically
generates new "signing" keys that it uses online. This option configures
their lifetime. (Default: 30 days)

OfflineMasterKey 0|1

If non-zero, the Tor relay will never generate or load its master
secret key. Instead, you’ll have to use "tor --keygen" to manage the
master secret key. (Default: 0)
"

but doesn't say anything about --keygen itself [2].

The 0.2.7.x mentions also a '--newpass' option that I wasn't able to
find in the manpage:

"
- Add a new OfflineMasterKey option to tell Tor never to try loading
  or generating a secret Ed25519 identity key. You can use this in
  combination with tor --keygen to manage offline and/or encrypted
  Ed25519 keys. Implements ticket 16944.
- Add a --newpass option to allow changing or removing the
  passphrase of an encrypted key with tor --keygen. Implements part
  of ticket 16769.
- On receiving a HUP signal, check to see whether the Ed25519
  signing key has changed, and reload it if so. Closes ticket 16790.
"

Can a tor operator use one offline master key for several relays (that
are running at the same time) or is one master key required for every
relay? (I assume the latter)

How does the process of renewing the signing keys look like?

According to the logs I assume simple run tor --keygen again
and copy ed25519_signing_cert + ed25519_signing_secret_key to the
relay's /keys folder

the logs say: "It looks like I need to generate and sign a new
medium-term signing key, because you asked me to make one with --keygen.
To do that, I need to load the permanent master identity key."

Does a tor operator has to SIGHUP a running tor instance after copying
the new signing keys to the appropriate folder or will tor attempt to
reload that file as soon as this signing key expires?

How can a tor relay op display a given signing key's expiry date?

Does using the offline master key functionality imply that the relay
will only have an ed25519 and no RSA key?

Is the offline master key limited to ed25519 keys and useless while
using ed25519 + RSA keys at the same time? (because the RSA key is not
offline?)

thanks!



[1]
https://lists.torproject.org/pipermail/tor-consensus-health/2015-November/006427.html

[2] https://trac.torproject.org/projects/tor/ticket/17583



signature.asc
Description: OpenPGP digital signature
___
tor-dev mailing list
tor-dev@lists.torproject.org
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-dev

Re: [tor-dev] documentation for new offline master key functionality (--keygen is undocumented)

[Nick Mathewson]

On Fri, Nov 13, 2015 at 1:51 PM, nusenu  wrote:
> Hi,
>
> since tor 0.2.7.5 is apparently not very far [1] from being released I
> was wondering whether there is any documentation about the new offline
> master key functionality?

Hi! There's a draft faq at https://trac.torproject.org/projects/tor/ticket/17021

and a ticket to improve the documentation at
https://trac.torproject.org/projects/tor/ticket/16645#comment:7

I hope that somebody can pick up writing this all up and/or reviewing
what's there now to make sure that it's working and right?

peace,
-- 
Nick
___
tor-dev mailing list
tor-dev@lists.torproject.org
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-dev

Re: [tor-dev] documentation for new offline master key functionality (--keygen is undocumented)

[nusenu]

>> since tor 0.2.7.5 is apparently not very far [1] from being released I
>> was wondering whether there is any documentation about the new offline
>> master key functionality?
> 
> Hi! There's a draft faq at 
> https://trac.torproject.org/projects/tor/ticket/17021
> 
> and a ticket to improve the documentation at
> https://trac.torproject.org/projects/tor/ticket/16645#comment:7
> 
> I hope that somebody can pick up writing this all up and/or reviewing
> what's there now to make sure that it's working and right?

Hi,
thanks for the pointers. Looks like s7r takes care of the "guide", but
for starters I would already be happy if the basic tor cli switches
would be in the man page.



signature.asc
Description: OpenPGP digital signature
___
tor-dev mailing list
tor-dev@lists.torproject.org
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-dev