[Full-disclosure] tor vulnerabilities?

[Neel Rowhoiser <neel.rowhoiser@xxxxxxxxxxx>]

I just stumbled across this and despite its sort of half-assed write up, I 
think its possibly an advisory? If I am understanding it correctly, they're 
saying that you can use a directory authority that hands out invalid/wrong RSA 
keys for other relays, you can cause decryption to fail and thus introduce path 
bias to nodes of the directory authorities choosing by selectively handing out 
valid RSA keys?
If the bit towards the end about guard nodes is correct, it would seem to 
indicate that they can use the semantics for detecting when a guard is causing 
too many extend relay cells to fail to cause valid guards to be marked invalid, 
and their rogue guards to succeed essentially using tor's semantics against 
them and causing the odds that you-re ingress point to the tor network is rogue 
to approach 1.
Why aren't the tor relay keys signed? And what other myriad of documents do 
directory authorities serve that also don't have integrity controls? This sort 
of makes me question the tor projects ability to deliver on any of the promises 
they make, as it would seem that a person needs like 3 or 4 rogue nodes before 
they could start de-anonymizing users, and the more of them they introduced the 
more of the network they could capture?
What I ran across (pastebin-- source unknown) http://pastebin.com/pRiMx0CW
Cheers,
Neel Rowhoiser

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/