How can a .onion url be routed on the internet on the right server?

Question

Ok, so thank you for taking some time to read this.

My teammates and I are on a university project to understand how Tor functions.

In the context that a client made a request to a normal website (i.e. through public DNS), the request will have a path consisting of exactly three nodes and the last node will make the request to the requested IPv4 address.

Otherwise, if it is an onion address (and this is the question), there will be three nodes for the client, and three nodes for the server who is hosting the onion website requested. Between the client nodes and the server nodes, is the request filtered through Tor's DNS so they can change the onion address to an IPv4 address? And relay the request to the first server node which will transmit it to the others two nodes where the exit node is going to make the request with the IPv4 address that Tor's server changed?

For sure, Tor's server would have encrypted the message three times.

By the way, is the message encrypted with RSA with the three public keys of the assigned node's path? Once a node has the message, does it decrypt it with it's private key?

To summarize a little bit:

1. Is Tor changing an onion url to an IPv4 address in the middle between the three client nodes and the three server nodes?
2. Is the exit node on the server side making the request with an IPv4 address?

Thank you so much for helping us in our understanding of Tor!

Answer 1

From https://gitweb.torproject.org/torspec.git/tree/rend-spec.txt, section 0.2:

1. Bob->Bob's OP: "Offer IP:Port as public-key-name:Port". [configuration] (We do not specify this step; it is left to the implementor of Bob's OP.)

2. Bob's OP generates a long-term keypair.

3. Bob's OP->Introduction point via Tor: [introduction setup] "This public key is (currently) associated to me."

4. Bob's OP->directory service via Tor: publishes Bob's service descriptor [advertisement] "Meet public-key X at introduction point A, B, or C." (signed)

5. Out of band, Alice receives a z.onion:port address. She opens a SOCKS connection to her OP, and requests z.onion:port.

6. Alice's OP retrieves Bob's descriptor via Tor. [descriptor lookup.]

7. Alice's OP chooses a rendezvous point, opens a circuit to that rendezvous point, and establishes a rendezvous circuit. [rendezvous setup.]

8. Alice connects to the Introduction point via Tor, and tells it about her rendezvous point. (Encrypted to Bob.) [Introduction 1]

9. The Introduction point passes this on to Bob's OP via Tor, along the introduction circuit. [Introduction 2]

   10. Bob's OP decides whether to connect to Alice, and if so, creates a circuit to Alice's RP via Tor. Establishes a shared circuit. [Rendezvous 1]

   11. The Rendezvous point forwards Bob's confirmation to Alice's OP. [Rendezvous 2]

   12. Alice's OP sends begin cells to Bob's OP. [Connection]

A .onion service can be accessed not only using IPV4, but also IPV6, or IPV4 in some parts of the tor circuit, and IPV6 in the others.

When accessing a tor hidden service, tor is responsible for the domain name and port number, the rest of the URL is handled by the application.

If Alice wants to access Bob's tor hidden service, the OP Alice uses is responsible for mapping a .onion address to an introductory point. The introductory point is responsible for relaying the message that Alice wants to access Bob's hidden service to Bob.

Bob's public key is RSA. There are also symmetric encryption that uses AES in counter mode.

Answer 2

For resume :

1 - is Tor changing an .onion url for an Ipv4 address in the middle between the 3 client's node and the 3 server's node?

No, the whole idea of the HS(Hidden Service) - that it's hidden =) No translation to IPv4 or IPv6 address is ever performed. The path of HS request is never walking a clearnet, it's Client->RendezVouz point->HSServer, all inside Tor multi-layered network. Even a HS descriptors that are identifying a HS'es in HSDir-relays(Hidden Service Directories) the descriptor does not contain an IP address, but the onion hash id of the server.

2 - Is the exit nodes on server side making the request with an IPv4 address?

Yes, via IPv4 or IPv6 address correspondingly : that's why they are called an Exit Nodes/Exits/Exit relays - they can allow a packet to exit from onion-based routing to the IP-based routing.

That's it!