Skip to main content Useraccount menuLog inSignUpFacebookTwitterRSS MainnavigationArticlesLinuxCommand lineKubernetesProgrammingGoJavaScriptPythonContainersSysadminDevOpsGamingHardware3DprintingArduinoRaspberry PiGovernmentLawOpenOrganizationWhat is anopen organization?What is anopen decision?ResourcesWhat is open source?The opensource wayProjects andapplicationsOrganizationsCloudtechnologyAnsibleBigdataDatascienceDockerGitInternet of thingsJavaKubernetesLinux containersMicroservicesOpenStackPythonPythonGUI frameworksPythonIDEsPython templatelibrariesPython webscrapersSoftware definednetworkingVirtualizationOpen sourcealternativesAlternativesto AcrobatAlternativesto AutoCADAlternativesto DreamweaverAlternativesto GmailAlternativesto MATLABAlternativesto MinecraftAlternativesto Google PhotosAlternativesto PhotoshopAlternativesto SkypeAlternativesto SlackAlternativesto TrelloMore...LinuxDownloadsCheat sheetsDevOps guidesProgramming guidesSysadmin guideseBooksOpen Source YearbookOpen OrganizationseriesCommunityAboutOpensource.comWelcome to theOpensource.com communityMeet the teamCreate anaccountRules forcomments and discussionsCorrespondent ProgramFrequently AskedQuestionsContributeto Opensource.comOpensource.com style guideWritingtopicsContact UsSearch xSubscribe to ournewsletter.Stay on top of the latest thoughts, strategies and insights fromenterprising peers.Howto create a vanity Tor .onion web addressGenerate a vanity .onion website toprotect your anonymity—and your visitors' privacy, too.ByKc NwaezuokeAugust 15, 2019 | 0 Comments | %t min read160 readers likethis160 readers like thisTor isa powerful, open source network that enables anonymous andnon-trackable (or difficult to track) browsing of the internet.It's able to achieve this because of users running Tor nodes, whichserve as intentional detours between two otherwise direct paths.For instance, if you are in New Zealand and visit python.nz,instead of being routed next door to the data center runningpython.nz, your traffic might be routed to Pittsburgh and thenBerlin and then Vanuatu and finally to python.nz. The Tor network,being built upon opt-in participant nodes, has an ever-changingstructure. Only within this dynamic network space can there existan exciting, transient top-level domain identifier: the .onionaddress.If you own or are looking to create a website, you can generatea vanity .onion site to protect your and your visitors'anonymity.What are onion addresses?Because Tor is dynamic and intentionally re-routes traffic inunpredictable ways, an onion address makes both the informationprovider (you) and the person accessing the information (yourtraffic) difficult to trace by one another, by intermediate networkhosts, or by an outsider. Generally, an onion address isunattractive, with 16-character names like 8zd335ae47dp89pd.onion.Not memorable, and difficult to identify when spoofed, but a fewprojects that culminated with Shallot (forked as eschalot) provides"vanity" onion addresses to solve those issues.Creating a vanity onion URL on your own is possible butcomputationally expensive. Getting the exact 16 characters you wantcould take a single computer billions of years to achieve.Here's a rough example (courtesy of Shallot)of how much time it takes to generate certain lengths of characterson a 1.5GHz processor:CharactersTime1Less than 1 second2Less than 1 second3Less than 1 second42 seconds51 minute630 minutes71 day825 days92.5 years1040 years11640 years1210 millennia13160 millennia142.6 million yearsI love how this table goes from 25 days to 2.5 years. If youwanted to generate 56 characters, it would take 1078years.An onion address with 16 characters is referred to as a version2 onion address, and one with 56 characters is a version 3 onionaddress. If you're using the Tor browser, you can check out thisv2address or this v3 address.A v3 address has several advantages over v2:Better crypto (v3 replaced SHA1/DH/RSA1024 withSHA3/ed25519/curve25519)Improved directory protocol that leaks much less information todirectory serversImproved directory protocol with a smaller surface for targetedattacksBetter onion address security against impersonationHowever, the downside (supposedly) of v3 is the marketing effortyou might need to get netizens to type that marathon-length URL intheir browser.You can learn more about v3 in the Tor docs.Why you might need anonion addressA .onion domain has a few key advantages. Its key feature isthat it can be accessed only with a Tor browser. Many people don'teven know Tor exists, so you shouldn't expect massive traffic onyour .onion site. However, the Tor browser provides numerous layersof anonymity not available on more popular browsers. If you want toensure near-total anonymity for both you and your visitors, onionaddresses are built for it.With Tor, you do not need to register with ICANN to create yourown domain. You don't need to hide your details fromWhois searches, and your ICANN account won't be vulnerable tomalicious takeovers. You are completely in control of your privacyand your domain.An onion address is also an effective way to bypass censorshiprestrictions imposed by a government or regime. Its privacy helpsprotect you if your site may be viewed as a threat to the interestsof the political class. Sites like Wikileaks are the bestexamples.What you need togenerate a vanity URLTo configure a vanity onion address, you need to generate a newprivate key to match a custom hostname.Two applications that you can use for generating .onionaddresses are eschalot for v2 addresses and mkp224ofor v3 addresses.Eschalot is a Tor hidden service name generator. It allows youto produce a (partially) customized vanity .onion address using abrute-force method. Eschalot is distributed in source form underthe BSD license and should compile on any Unix or Linux system.mkp224o is a vanity address generator for ed25519 .onionservices that's available on GitHub with the CC0 1.0 Universallicense. It generates vanity 56-character onion addresses.Here's a simple explanation of how these applications work.(This assumes you are comfortable with Git.)EschalotEschalot requires OpenSSL 0.9.7 or later libraries with source headers.Confirm your version with this command:$ openssl version
OpenSSL 1.1.1c FIPS 28 May2019You also need a Make utility (either BSD or GNU Make will do) and a Ccompiler (GCC, PCC, or LLVM/Clang).Clone the eschalot repo to your system, and then compile:$ gitclone https://github.com/ReclaimYourPrivacy/eschalot.git
$ cd eschalot-1.2.0
$ makeIf you're not using GCC, you must set the CCenvironment variable. For example, to use PCC instead:$ makeclean
$ env CC=pccmakeUsing eschalotTo see Echalot's Help pages, type ./eschalot inthe terminal:$ ./eschalot
Version: 1.2.0
usage:
eschalot [-c][-v] [-t count] ([-n] [-l min-max] -f filename) | (-r regex) | (-p prefix)
-v :verbose mode - print extra information to STDERR
-c :continue searching after the hash is found
-t count : number of threadsto spawn default is one)
-l min-max : look for prefixes that are from 'min' to 'max' characterslong
-n :Allow digits to be part of the prefix (affects wordlist mode only)
-f filename: name of the textfile with a list of prefixes
-p prefix : single prefix tolook for (1-16 characters long)
-r regex : searchfor a POSIX-style regular expression
Examples:
eschalot -cvt4 -l8-12 -f wordlist.txt>> results.txt
eschalot -v -r '^test|^exam'
eschalot -ct5 -p test
base32 alphabet allows letters [a-z] and digits [2-7]
Regex pattern examples:
xxx must contain'xxx'
^foo must beginwith 'foo'
bar$ must end with'bar'
b[aoeiu]r must have a vowel between'b' and 'r'
'^ab|^cd' must begin with 'ab' or 'cd'
[a-z]{16} mustcontain letters only, no digits
^dusk.*dawn$ mustbegin with 'dusk' and end with'dawn'
[a-z2-7]{16} any name - will succeed after one iterationYou can use eschalot to generate an address using the prefix-p for privacy. Assuming your system hasmultiple CPU cores, use multi-threading(-t) to speed up the URL generation. To getverbose output, use the -v option. Write theresults of your calculation to a file namednewonion.txt:./eschalot -v -t4 -p privacy >> newonion.txtThe script executes until it finds a suitable match:$ ./eschalot -v -t4 -p privacy >> newonion.txt
Verbose, single result, no digits, 4threads, prefixes 7-7 characters long.
Thread #1 started.
Thread #2 started.
Thread #3 started.
Thread #4 started.
Running, collecting performance data...
Found a key for privacy (7)- privacyzofgsihx2.onionTo access the public and private keys eschalot generates, locatenewonion.txt in the eschalot folder.mkp224omkp224o requires a C99 compatible compiler, Libsodium, GNU Make,GNU Autoconf, and a Unix-like platform. It has been tested on Linuxand OpenBSD.To get started, clone the mkp224o repo onto your system,generate the required Autotoolsinfrastructure, configure, and compile:$ gitclone https://github.com/cathugger/mkp224o.git
$ cd mkp224o
$ ./autogen.sh
$ ./configure
$ makeUsing mkp224oType ./mkp224o -h to view Help:$ ./mkp224o -h
Usage: ./mkp224o filter [filter...] [options]
./mkp224o-f filterfile [options]
Options:
-h -print help to stdout and quit
-f -specify filter file which contains filters separated by newlines
-D -deduplicate filters
-q -do not print diagnostic output tostderr
-x -do not print onion names
-v -print more diagnostic data
-o filename - output onion names to specified file (append)
-O filename - output onion names to specified file (overwrite)
-F -include directory names in onion namesoutput
-ddirname - output directory
-t numthreads - specify number of threads to utilise (default - CPU core count or 1)
-j numthreads - same as -t
-n numkeys - specify number of keys (default -0 - unlimited)
-N numwords - specify number of words per key (default - 1)
-z - usefaster key generation method; this is now default
-Z - useslower key generation method
-B - usebatching key generation method (>10x faster than -z,experimental)
-s -print statistics each 10 seconds
-S t -print statistics every specified ammount of seconds
-T -do not reset statistics counters whenprinting
-y -output generated keys in YAML formatinstead of dumping them to filesystem
-Y[filename [host.onion]] - parse YAML encoded input and extractkey(s) tofilesystemOne or more filters are required for mkp224o to work. Whenexecuted, mkp224o creates a directory with secret and public keys,plus a hostname for each discovered service. By default,root is the current directory, but that can beoverridden with the -d switch.Use the -t numthreads option to define how manythreads you want to use during processing, and -vto see verbose output. Use the fast filter, andgenerate four keys by setting the -n option:$ ./mkp224o filter fast -t4 -v -n 4 -d ~/Extracts
set workdir: /home/areahints/Extracts/
sorting filters... done.
filters:
fast
filter
in total, 2filters
using 4 threads
fastrcl5totos3vekjbqcmgpnias5qytxnaj7gpxtxhubdcnfrkapqad.onion
fastz7zvpzic6dp6pvwpmrlc43b45usm2itkn4bssrklcjj5ax74kaad.onion
fastqfj44b66mqffbdfsl46tg3c3xcccbg5lfuhr73k7odfmw44uhdqd.onion
fast4xwqdhuphvglwic5dfcxoysz2kvblluinr4ubak5pluunduy7qqd.onion
waiting for threads to finish...done.In the directory path set with -d, mkp224ocreates a folder with the v3 address name it has generated, andwithin it you see your hostname, secret, and public files.Use the -s switch to enable printingstatistics, which may be useful when benchmarking different ed25519implementations on your machine. Also, read theOPTIMISATION.txt file in mkp224o forperformance-related tips.Notes about securityIf you're wondering about the security of v2 generated keys,Shallot provides an interesting take:It is sometimes claimed that private keys generated by Shallotare less secure than those generated by Tor. This is false.Although Shallot generates a keypair with an unusually large publicexponent e, it performs all of the sanity checksspecified by PKCS #1 v2.1 (directly in sane_key),and then performs all of the sanity checks that Tor does when itgenerates an RSA keypair (by calling the OpenSSL functionRSA_check_key)."Zooko's Triangle" (which is discussed inStiegler's Petname Systems) argues that namescannot be global, secure, and memorable at the same time. Thismeans while .onion names are unique and secure, they have thedisadvantage that they cannot be meaningful to humans.Imagine that an attacker creates an .onion name that lookssimilar to the .onion of a different onion service and replaces itshyperlink on the onion wiki. How long would it take for someone torecognize it?The onion address system has trade-offs, but vanity addressesmay be a reasonable balance among them.What to read nextMakeLinux stronger with firewallsLearn how firewalls work and which settings to tweak for betterLinux security.SethKenlon(Team,Red Hat)July 2, 2019Checkyour password security with Have I Been Pwned? andpassPeriodically checking for password compromise is an excellentway to help ward off most attackers in most threat models.Brian "bex" Exelbierd (RedHat)June 24, 2019Howto build a URL shortener with ApacheCreate your own short links with Apache HTTP server'smod_rewrite feature.BenCotton(Alumni, Red Hat)July 20, 2018TagsSecurity and privacyKc NwaezuokeI am a self-taught developer focused on learningmore about computers, I love to design, build websites andimplement SEO, I also enjoy using python to automate boring,repetitive and tedious work. you will generally find me onopensource.com, Github, Dev.to, StackOverflow and any animestreaming site!More aboutmeComments are closed.These comments are closed, however you canRegister or Login to posta comment on another article.Related ContentKeep your Exif metadata private with this open sourcetoolAutomate checking for flaws in Python withThothHow Aqua Security is approaching DevSecOps in2022Thiswork is licensed under a Creative Commons Attribution-Share Alike4.0 International License.LinkedInTwitterFacebookWhatsAppEmailRedditMastodonLocation of your Mastodoninstance: Subscribe to our weekly newsletterPrivacy StatementAbout This SiteThe opinions expressed on this website are those of each author,not of the author's employer or of Red Hat.Opensource.com aspires topublish all content under a Creative Commons licensebut may not be able to do so in all cases. You are responsible forensuring that you have the necessary permission to reuse any workon this site. Red Hat and the Red Hat logo are trademarks of RedHat, Inc., registered in the United States and other countries.A note on advertising: Opensource.com does not sell advertisingon the site or in any of its newsletters.ContactFollow
[email protected] on TwitterLikeOpensource.com on FacebookWatch us atOpensource.comFollow us on MastodonRSSFeedCopyright ©2021 Red Hat,Inc.LegalPrivacy PolicyTerms of useContact
