I try understanding the tor circuit, i understand that if I send "hello" to, for example, google.es the circuit is:

() -> encryption

Me -> (((input node))) -> ((normal node)) -> (output node) [text plain] -> google.es

But i dont understand the return package from google, google or a random web page does not encrypt the package, then, how is now the circuit? and, do it use the sames nodes again for back?


1 Answer 1


You build a TLS connection to your guard.

Over that TLS connection you perform a key exchange using the OR protocol. Now you and the first guard compute two keys from the shared secret the key exchange netted you, a forward and a reverse key.

Now you use the first OR to perform the key exchange with another OR, and again both can compute a shared forward and reverse key. And similarly you perform the same with the exit.

Now you have a set of keys shared with each relay: Guard[f1,r1], Middle[f2,r2] and Exit[f3,r3]

The data is sent forward down the circuit, you apply all 3 layers of encryption and each relay strips a layer.

You -> E(f1, E(f2, E(f3, data))) -> Guard -> E(f2, E(f3, data)) -> Middle -> E(f3, data) -> Exit -> data -> Google

Then to reply, it follows the reverse path using the reverse keys with each relay applying a layer, and at the end you use all 3 reverse keys to strip the layers.

Google -> data -> Exit -> E(r3, data) -> Middle -> E(r2, E(r3, data)) -> Guard -> E(r1, E(r2, E(r3, data))) -> You


  1. Each relay strips a layer of encryption using the shared forward key on the way forward.
  2. Each relay adds a layer of encryption using the shared reverse key on the way back.
  3. The same path (circuit) is used for both forward and reverse.
  • Thanks, but the reverse keys are asymetric like the forward keys? The reverse keys are similar to forward keys?. Jul 13, 2016 at 13:41
  • The reverse and forward keys are a pair of symmetric keys. The key exchange (TAP or nTor) is done using asymmetric/public key cryptography, the keys derived from the key exchange are symmetric, specifically they are used as AES keys.
    – cacahuatl
    Jul 13, 2016 at 15:48
  • Does this first TLS connection not use the TAP/Ntor protocol?
    – forest
    Feb 17, 2019 at 11:55

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .