I'm reading here about Tor's 'DNS' resolving mechanisms (for both clearnet and hidden services) .
The mechanism for connecting to a hidden service itself (via a rendezvous point in a 7-hop circuit without the need for an exit node), I am clear on.
But, the step before that is finding out what its 'location' is (or rather, instructions for how to initiate a connection with the hidden service you're looking up), in the first place - Tor's equivalent of DNS.
In the afore-mentioned link, this line greatly bothered me:
Aaron’s client checks the Hidden Service Directory Server to see if the address exist.
After more searching, I found this excellent 2013 research, which states:
A client who would like to retrieve the full HS descriptor will calculate the time based descriptor id and will request it from the responsible HSDir’s directly.
As for the official Tor HS protocol outline page (https:// torproject.org/docs/hidden-services.html.en), the info is more vague, stating:
After [first learning about its onion address], the client can initiate connection establishment by downloading the descriptor from the distributed hash table.
This gives the impression of a decentralized distribution of descriptor information like Freenet, but maybe it is only distributed between HSDirs and that still says nothing of whether real IPs are linked to descriptor lookups or not.
So what are the facts here?
Is there any part of the process in which the original, non-Tor IP address of a Tor user, directly contacts a Tor HSDir (or another node for that matter), for the purpose of a direct request and retrieval of the descriptor of a given .onion address? If not, then which node in the chain does the HSDir see for that request, and is the original client's IP obfuscated to that node which has to know the onion address themselves?
If yes, this would be an extremely serious breach of anonymity for the entire Tor network. It is one thing to know virtually every .onion site in existence by operating a HSDir (under the current code anyway); it is another to know all the real IP addresses of those who visit them.
It would be ironic if Tor protected the IP addresses of users on clearnet by having DNS requests performed by the same IP as is doing the browsing (i.e. the Tor exit node), but not for hidden services themselves. If so, it would make sense to apply the same 'layered encryption' onion mechanism to descriptor requests also. (So have the exit node, or the same node as will be the rendezvous, make them.)
And on a related note, are the request (and response) packets between the client and the HSDir encrypted (similarly to HTTPS or DNSCrypt), or are the requests transported as plaintext directly to the HSDir server and thus readable by the user's ISP, global wiretapping adversaries and all other usual MITM suspects?
