Dark Web Website Name

Anatomy of a v3 Onion Address

Version 3 onion addresses are critical for secure communications on the Tor network. Each address consists of a 32-byte Ed25519 public key, a 2-byte checksum, and a 1-byte version field, resulting in a 56-character string encoded in Base32, followed by the ".onion" suffix (1). This structure enhances security compared to the deprecated version 2 addresses.

Key Components

1. Public Key: The 32-byte Ed25519 key establishes a secure connection. It enables public key cryptography, allowing users to communicate anonymously.

2. Checksum: The 2-byte checksum ensures the integrity of the address. It helps verify that the address has not been tampered with during transmission.

3. Version Field: The 1-byte version identifier distinguishes version 3 addresses from previous formats.

Differences from Version 2 Addresses

Version 2 addresses, which used a 16-character format and RSA-1024 cryptography, were deprecated in 2021 and no longer resolve on the network (1). The key differences include:

• Security: Version 3 addresses utilize Ed25519, which is more secure than RSA-1024.

• Address Length: v3 addresses are 56 characters long, while v2 addresses are only 16 characters.

• Cryptographic Enhancements: Version 3 implements cryptographic key blinding, allowing for daily rotation of identifiers. This prevents directory servers from tracking permanent metadata (2).

Summary of v3 Address Structure

Understanding this structure is essential for system administrators and network engineers when configuring hidden services. Always prefer version 3 addresses for better security and anonymity.

How Tor Names and Directory Services Resolve .onion Links

The Tor network uses a distributed hash table (DHT) to resolve .onion links. This approach eliminates the need for a central DNS, allowing hidden services to operate securely and anonymously. Each hidden service is identified by a unique v3 onion address, which is generated from a 32-byte Ed25519 public key, a 2-byte checksum, and a 1-byte version field. These components are encoded using Base32 into a 56-character string ending with the .onion suffix (1).

Hidden services publish their descriptors to relays that hold the HSDir flag within the DHT. These descriptors contain information about the service, including its introduction points. When a user wants to connect to a hidden service, their Tor client retrieves the service descriptor from the DHT. This process allows users to establish a connection without knowing the actual IP address of the hidden service (2).

Introduction and Rendezvous Points

To connect to a hidden service, two key types of points are involved: introduction points and rendezvous points.

1. Introduction Points: These are relays that the hidden service selects to receive connection requests. When a user wants to access the hidden service, they send a request to one of these introduction points.

2. Rendezvous Points: After the hidden service receives a request, it communicates with a rendezvous point, which facilitates the connection between the user and the service. This two-step process enhances anonymity, as neither the user nor the service directly knows the other's location (2).

Descriptor Encryption

Version 3 onion services utilize two layers of encryption to protect their hidden service descriptors. This means that even if a storage directory (HSDir) accesses the data, it cannot view the contents without the appropriate keys. This cryptographic approach ensures that hidden services maintain a high level of security and privacy (3).

For system administrators and network engineers, understanding this structure is crucial for managing hidden services effectively. It is important to regularly monitor and verify the health of your hidden service descriptors, ensuring they remain accessible and functional within the DHT framework.

Standardized Indexing and Directory Nomenclature

Onion site names and their metadata are categorized using specific conventions within directory services and search indexes on the Tor network. The most significant standard is the v3 onion address format, which consists of a 32-byte Ed25519 public key, a 2-byte checksum, and a 1-byte version field. This structure is encoded in Base32 to create a 56-character string followed by the .onion suffix (1).

Major directory services use hidden service descriptors to store metadata about onion sites. These descriptors are crucial for resolving .onion links without traditional DNS, utilizing a distributed hash table (DHT) composed of relays that hold the HSDir flag (2). Each hidden service publishes its descriptor, which includes the introduction points necessary for establishing connections with users.

Examples of Standard URI Paths

The configuration of hidden services typically follows a standard format within the torrc file. Here are a few common URI path examples for hidden services:

• Basic Configuration:

  HiddenServiceDir /var/lib/tor/hidden_service/
  HiddenServicePort 80 127.0.0.1:8080
  

• Using Custom Vanity Addresses:

  HiddenServiceAddress customprefix.onion
  

For generating custom vanity addresses, significant computational effort is required. This involves producing numerous key pairs until a desired prefix matches the public key output (4). The process can be resource-intensive and may take hours or days, depending on the prefix length.

Key Components of Onion Service Descriptors

1. Public Key: The foundation for establishing secure connections.

2. Checksum: Ensures the integrity of the address.

3. Version Field: Identifies the address format, with version 3 being the current standard.

Version 3 onion services also implement cryptographic key blinding, which helps maintain anonymity by rotating identifiers daily. This feature prevents directory servers from tracking permanent metadata associated with hidden services (2).

Network engineers should ensure that their hidden service descriptors are correctly configured and regularly monitored. This practice helps maintain accessibility and security on the Tor network. For more on organizing hidden services, refer to the Onions Site guide.

Security and Verification of Hidden Service Descriptors

Ensuring the security and integrity of hidden service descriptors is crucial for maintaining anonymity on the Tor network. The process involves cryptographic verification methods, which primarily focus on validating .onion URLs and their associated signatures.

Version 3 onion addresses are built using a 32-byte Ed25519 public key, a 2-byte checksum, and a 1-byte version field, resulting in a 56-character Base32 encoded string (1). This structure enhances security compared to the deprecated version 2 addresses, which utilized weaker RSA-1024 cryptography (1).

To verify hidden service descriptors, follow these steps:

1. Check Signature: Each descriptor includes a cryptographic signature. You can verify this signature using the public key associated with the .onion address. If the signature does not match, the descriptor may have been tampered with.

2. Validate Checksum: The 2-byte checksum ensures that the address is intact. If the checksum fails, the address may not resolve correctly.

3. Inspect Descriptor Encryption: Version 3 services employ two layers of encryption for hidden service descriptors. This means that storage directories (HSDirs) can only access encrypted data if they possess the correct keys (3). Regularly verify that these layers are functioning properly.

Using a distributed hash table (DHT), Tor manages hidden service descriptors without traditional DNS. This decentralized approach protects against man-in-the-middle attacks, as no single point of failure exists (2).

To prevent spoofing attacks, maintain a secure local routing table. Regularly update your routing configurations and check for any unauthorized changes. Ensure that your Tor configuration file (torrc) is correctly set up to avoid any vulnerabilities.

In summary, always verify the cryptographic signatures and checksums of hidden service descriptors. This practice helps prevent potential security breaches and maintains the integrity of your hidden services. For further insights on managing hidden services, consider exploring the Onions Site guide.

Configuring Custom .onion Hostnames (Vanity Addresses)

Generating custom vanity .onion addresses involves using offline tools like scallion or mkp224o. These tools help create unique public key prefixes by brute-forcing key pairs until the desired alphanumeric prefix matches the public key output.

Steps to Generate Vanity Addresses

1. Set Up Environment: Install the required software. Ensure you have Python and the necessary libraries for scallion or mkp224o.

2. Select Prefix: Decide on the prefix you want for your .onion address. Common choices include short, memorable strings. For example, “abc” or “123”.

3. Run the Generator:

   • For scallion, run the command:

     scallion -p abc
     

   • For mkp224o, the command would be:

     mkp224o -p abc
     

   This process may take hours or even days, depending on the prefix length and computational power.

4. Retrieve the Public Key: Once the generation is complete, extract the public key from the output. This key will form the basis of your new .onion address.

Configuring the torrc File

After obtaining your custom public key, configure your Tor hidden service in the torrc file. Follow these steps:

1. Open torrc: Locate and open your torrc configuration file, usually found in /etc/tor/torrc or /usr/local/etc/tor/torrc.

2. Set Hidden Service Directory: Define where the hidden service will store its files:

   HiddenServiceDir /var/lib/tor/hidden_service/
   

3. Add Custom Address: Insert your generated vanity address:

   HiddenServiceAddress yourcustomprefix.onion
   

4. Specify Ports: Link the hidden service to your local service. For example:

   HiddenServicePort 80 127.0.0.1:8080
   

5. Restart Tor: Restart the Tor service to apply the changes. Use:

   sudo systemctl restart tor
   

Considerations

Generating vanity addresses requires significant computational resources. The longer the desired prefix, the more time it will take. Avoid using easily guessable prefixes, as they may compromise anonymity.

Regularly monitor your hidden service to ensure it remains accessible and functional. Understand that while vanity addresses can enhance branding, they do not inherently increase security on the Tor network. Always prioritize secure configurations and regular updates to your Tor setup.

For additional insights on managing hidden services, refer to the Onions Site.

Troubleshooting Onion Routing and Name Resolution Failures

When navigating the Tor network, you may encounter various error codes related to .onion resolution. Understanding these errors can help you diagnose and resolve issues effectively. Here are some common error codes and their meanings:

• Onion Address Invalid: This error indicates that the .onion address format is incorrect. Ensure that the address is a valid version 3 onion address, which should be a 56-character Base32 string ending with ".onion" (1).

• Host Unreachable: This error suggests that the Tor client cannot connect to the hidden service. Check your network configuration and ensure that the hidden service is online and reachable.

• Descriptor Corrupt: This error occurs when the hidden service descriptor is not accessible or has been tampered with. Verify that the hidden service is correctly publishing its descriptor to the distributed hash table (DHT) (2).

To diagnose these issues, system administrators and network engineers should consult system logs for detailed information. Here are the diagnostic steps to follow:

1. Check Tor Logs: Access the Tor logs, typically found in /var/log/tor/log. Look for error messages related to hidden services or .onion resolution.

2. Validate Configuration: Review your torrc configuration file for any misconfigurations. Common settings to check include the HiddenServiceDir and HiddenServicePort directives.

3. Monitor Network Traffic: Use network monitoring tools to analyze traffic. Ensure that your Tor client can communicate with the necessary relays and that there are no firewall rules blocking access.

4. Test Connectivity: Use tools like curl to test connectivity to the .onion address. Run the command:

   curl http://yourserviceaddress.onion
   

   If the command fails, further investigation is required.

5. Check Hidden Service Status: Use the Tor Browser to verify the status of the hidden service. If it resolves correctly in the browser but not through your application, the issue may lie in your application’s configuration.

By systematically following these diagnostic steps, you can identify and resolve common issues related to .onion routing and name resolution failures. Regular monitoring and maintenance of your hidden services will also help prevent these errors from occurring.

Conclusions and Next Steps

• Prioritize Security: Always deploy version 3 addresses and maintain regular key rotation schedules to protect your infrastructure (1).

• Verify Descriptors: Check cryptographic signatures and validate checksums to prevent man-in-the-middle attacks (1).

• Optimize Generation: Use offline tools like mkp224o or Scallion carefully when creating custom vanity addresses due to high resource costs (4).

• Monitor System Logs: Review your Tor daemon logs promptly when encountering unreachable hosts or corrupt descriptors (2).

To learn more about organizing your hidden services, read the Onions Site guide.