http://6sxoyfb3h2nvok2d.onion/tor/EximAndTorHowto describes how to use exim to send mail to .onion addresses. I've written a preliminary whitepaper that discusses issues surrounding this.
Please see the FAQ first, then download the code. Note that it requires exim4.
Notes
If you have to risk that your DNS lookups are seen by someone else, make sure you don't look up stuff when getting an incoming torified connection!
sender authentication (not implemented currently)
We'll require sender authentication using the Tor PKI, as follows. Implementation in exim requires exim 4.61.
The sender needs to authenticate to the server, the server is already implicitly authenticated. Therefore, we define an additional X-TORPKI SASL mechanism as follows:
- The initial client response is any data the client determines, excluding ASCII NUL characters.
- The first server response to that is any data the server determines, excluding ASCII NUL characters.
Both these should be chosen randomly or at least pseudo-randomly.
- The client signs the sha-1 sum of the concatenation of these two using her Tor service descriptor private key, using the [unspecified] signature algorithm, and sends the signature to the server.
- The server checks the signature by looking up the public key using the onionhash from the EHLO statement the client gave, and allows authentication if the signature checks out.
The server then does not allow the client to issue a MAIL FROM statement with a different domain from the one in the EHLO.
Attention!
NO MAIL MAY BE SENT UNAUTHENTICATED!