💡[new Pluggable Transports] proposal DHT

aisss · October 30, 2024, 11:45am

DHT has fewer traffic characteristics than Snowflake, and ISP operators don’t even know you are using TOR.
A large number of users use DHT

DHT

dht.libtorrent.org:25401
dht.transmissionbt.com:6881
router.bittorrent.com:6881
router.utorrent.com:6881
dht.aelitis.com:6881

other

github.com

enfein/mieru/blob/main/docs/protocol.md

# mieru Proxy Protocol

To meet the needs of different scenarios, mieru provides two different protocols: TCP and UDP. Because UDP protocol requires more decryption attempts, TCP protocol is faster. In most cases, we recommend using TCP protocol.

The following is a detailed explanation of the mieru proxy protocol. Unless otherwise specified, all data is stored in big endian format.

## Key Generation Method

TCP and UDP protocols share the same key generation method.

Each mieru user needs to provide a username `username` and a password `password`. To generate the key for encryption and decryption from the username and password, the following steps are executed.

The first step is to generate a hashed password `hashedPassword`, whose value is equal to `password` appended with a `0x00` byte and appended with `username`, then takes the SHA-256 checksum.

The second step is to get the current time of the system `unixTime`, whose value is equal to the number of seconds elapsed between January 1, 1970 and now. Round the time of `unixTime` to the nearest 2 minutes, and store it as an 8-byte string from uint64. Get the SHA-256 checksum of the string as `timeSalt`.

In the third step, the key is generated using the [pbkdf2](https://en.wikipedia.org/wiki/PBKDF2) algorithm. In this case, `hashedPassword` is used as the password, `timeSalt` is used as the salt, the number of iterations is 64, the length of the key is 32 bytes, and the hash algorithm is SHA-256.

Since the key depends on the system time, the time difference between the client and the server must not be larger than 4 minutes. The server needs to try maximum 3 different `timeSalt` to decrypt it successfully.

This file has been truncated. show original

WofWca · October 30, 2024, 12:01pm

Can you clarify how exactly DHT can be utilized to gain access to Tor? What components need to be implemented?

excurso · October 30, 2024, 3:49pm

I think it would be similar to having a broker included in each proxy

aisss · November 1, 2024, 1:14pm

client → ← DHT → ← relay

client → ← DHT → ← quic:// → ← relay

client → ← DHT → ← snowflake → ← quic:// → ←
relay

akarincode2770 · November 4, 2024, 9:28am

This reminds me of ZeroNet.

Which brings up some questions:

Bittorrent transmission doesn’t use the QUIC protocol, making this transmission method extremely easy to detect (a client suddenly switches to using the QUIC protocol to communicate with previously connected nodes after initiating a DHT network connection). ZeroNet also does poorly in this regard (China hasn’t blocked 0Net only because there are few users, making it not worth the attention).

I think solving the problem of malicious nodes in the DHT network will be another challenge (ZeroNet once tried to implement a DHT network for 0Net, but ultimately failed to do so due to the inability to solve the problem of establishing trust between clients).

Tracker servers are not that reliable, and it’s easy for tracker servers to detect that it’s not a Bittorrent client. Maintaining trusted tracker servers would also make it easier for censors to block the entire network.

anon314893516 · January 9, 2025, 12:37pm

It’s not feasible as DHT can be easily blocked and it already had practical example of it happening in the past, blocking DHT also causes less colleteral damage than blocking WebRTC.

Besides in my very personal opinion DHT should be preserved as last ditch attempt in keeping communications and not be sullied with things trying to mimic it.

Let’s imagine there is another country’s internet blackout. DHT in theory allows for local peers to keep communication at least on intranet level, this gets content and files passed within that small region even if outside internet is blocked. Think like RetroShare which was working during blackouts.