Tor issue reports v3 onion client-auth private key exposure in logs
A security report filed against Tor core identifies a vulnerability where a malformed `.auth_private` file causes Tor to log a near-complete v3 onion-service client-auth private key at WARN level, even when `SafeLogging` is enabled. The report states the issue affects Tor 0.3.5.1-alpha through 0.4.9.11 and the current main branch, with no fixed release identified. Public comments from Tor developers suggest a fix using safe logging.
Why it matters
The report indicates that a lower-trust principal with access to Tor logs could obtain a near-complete private key from a malformed credential file, potentially compromising client authorization for v3 onion services.
Event status Developing
Read the sources
- [security] SafeLogging=1 exposes a near-complete v3 onion client-auth private key from a malformed `.auth_private` file gitlab.torproject.org
- Public comment by @dgoulet gitlab.torproject.org
This is an AI-assisted summary of the linked public sources. Consult the original reports for details and operator guidance.