compress 'compromise keys'

\subsubsection*{Active attacks}

\emph{Compromise keys.}

If a TLS session key is compromised, an attacker

can view all the cells on TLS connection until the key is

renegotiated.  (These cells are themselves encrypted.)  If a TLS

private key is compromised, the attacker can fool others into

thinking that he is the affected OR, but still cannot accept any

connections. \\

If a circuit session key is compromised, the

attacker can unwrap a single layer of encryption from the relay

cells traveling along that circuit.  (Only nodes on the circuit can

see these cells.) If an onion private key is compromised, the attacker

can impersonate the OR in circuits, but only if the attacker has

also compromised the OR's TLS private key, or is running the

previous OR in the circuit.  (This compromise affects newly created

circuits, but because of perfect forward secrecy, the attacker

cannot hijack old circuits without compromising their session keys.)

In any case, periodic key rotation limits the window of opportunity

for compromising these keys. \\

Only by

compromising a node's identity key can an attacker replace that

node indefinitely, by sending new forged descriptors to the

directory servers.  Finally, an attacker who can compromise a

directory server's identity key can influence every client's view

of the network---but only to the degree made possible by gaining a

vote with the rest of the the directory servers.

\emph{Compromise keys.} An attacker who learns the TLS session key can see

the (still encrypted) relay cells on that circuit; learning the circuit

session key lets him unwrap one layer of the encryption. An attacker

who learns an OR's TLS private key can impersonate that OR, but he must

also learn the onion key to decrypt \emph{create} cells (and because of

perfect forward secrecy, he cannot hijack already established circuits

without also compromising their session keys). Periodic key rotation

limits the window of opportunity for these attacks. On the other hand,

an attacker who learns a node's identity key can replace that node

indefinitely by sending new forged descriptors to the directory servers.

\emph{Iterated compromise.} A roving adversary who can

compromise ORs (by system intrusion, legal coersion, or extralegal