The host part is the transport layer-dependent permanent hidden service ID. For Tor, which is the primary transport layer supported by cables communication, it is a 16-character Base32 representation of a half of Tor's hidden service RSA-1024 public key fingerprint (an 80-bit part of SHA-1 cryptographic hash), with an .onion domain suffix. For I2P, it is a 52-character Base32 encoding of eepSite's ElGamal-2048 public key SHA-256 fingerprint, with a .b32.i2p suffix.
In this way, message security (inability of the attacker to reveal the message contents) is independent of the transport layer security (inability of the attacker to reveal the contents of network traffc and the location of correspondents). This is important because, at present, Tor appears to disallow “too much” security by design:
- RSA-1024 is universally used as a public key cipher (identity, onion, connection, and private keys, and likely for SSLv3 connections as well; although long-term directory authority identity keys are RSA-3072). This RSA key size is likely inadequate against a resourceful adversary such as the NSA/CSS. RSA-1024 provides only ~80 bits of security (see NIST SP 800-57 Part 1, §5.6.1).
- AES-128 is used as a stream cipher, although this key size is not allowed for highly sensitive data protection in the government of USA (see CNSS Policy №15 FS №1).
- SHA-1 80-MSB are used as the hidden service ID, offering at most 80 bits of security against hidden service impersonation. The security might be weaker than even that, since an MSB section of a cryptographic hash does not automatically inherit the second-preimage attack resistance properties of the original hash.
For the claim that NSA/CSS can break RSA 1024, it should be mentioned that the highest public known break of an RSA key is to a RSA 768, and above that, cash prizes has been given up to $175 000, with $75 000 at the RSA 896 point.
So if someone think they can put together a FPG'a or graphic cards system for less than $175 000, and that the system then will break RSA 1024, you can earn some "easy" money.
Anyway, the real question about the actually security concerning key-size is, how secure is recorded traffic. If the only protection here is the AES-128, than that is the thing to be concerned about.
To the less-proficient ones: Please not that here he is comparing Tor hidden services and i2p eepSites, where both the client and the server use Tor/i2p. In this case all your communication is "magically" encrypted, in a more strong fashion by i2p (this is the tl;dr).
However, when communicating with the regular web none of this apply, and Tor will probably offer better protection as i2p is not by design built to communicate with the outside net.
If you're interested, Tor is looking at a Cipher suite upgrade. There are obviously compatibility issues when you are rolling out to a network that has 500,000+ daily users. If you look around the Tor proposals you should be able to find it https://gitweb.torproject.org/torspec.git?a=tree;hb=HEAD;f=p...
In this way, message security (inability of the attacker to reveal the message contents) is independent of the transport layer security (inability of the attacker to reveal the contents of network traffc and the location of correspondents). This is important because, at present, Tor appears to disallow “too much” security by design:
- RSA-1024 is universally used as a public key cipher (identity, onion, connection, and private keys, and likely for SSLv3 connections as well; although long-term directory authority identity keys are RSA-3072). This RSA key size is likely inadequate against a resourceful adversary such as the NSA/CSS. RSA-1024 provides only ~80 bits of security (see NIST SP 800-57 Part 1, §5.6.1).
- AES-128 is used as a stream cipher, although this key size is not allowed for highly sensitive data protection in the government of USA (see CNSS Policy №15 FS №1).
- SHA-1 80-MSB are used as the hidden service ID, offering at most 80 bits of security against hidden service impersonation. The security might be weaker than even that, since an MSB section of a cryptographic hash does not automatically inherit the second-preimage attack resistance properties of the original hash.
http://dee.su/cables-security