I try understanding the tor circuit, i understand that if I send "hello" to, for example, google.es the circuit is:

() -> encryption

Me -> (((input node))) -> ((normal node)) -> (output node) [text plain] -> google.es

But i dont understand the return package from google, google or a random web page does not encrypt the package, then, how is now the circuit? and, do it use the sames nodes again for back?


1 Answer 1


You build a TLS connection to your guard.

Over that TLS connection you perform a key exchange using the OR protocol. Now you and the first guard compute two keys from the shared secret the key exchange netted you, a forward and a reverse key.

Now you use the first OR to perform the key exchange with another OR, and again both can compute a shared forward and reverse key. And similarly you perform the same with the exit.

Now you have a set of keys shared with each relay: Guard[f1,r1], Middle[f2,r2] and Exit[f3,r3]

The data is sent forward down the circuit, you apply all 3 layers of encryption and each relay strips a layer.

You -> E(f1, E(f2, E(f3, data))) -> Guard -> E(f2, E(f3, data)) -> Middle -> E(f3, data) -> Exit -> data -> Google

Then to reply, it follows the reverse path using the reverse keys with each relay applying a layer, and at the end you use all 3 reverse keys to strip the layers.

Google -> data -> Exit -> E(r3, data) -> Middle -> E(r2, E(r3, data)) -> Guard -> E(r1, E(r2, E(r3, data))) -> You


  1. Each relay strips a layer of encryption using the shared forward key on the way forward.
  2. Each relay adds a layer of encryption using the shared reverse key on the way back.
  3. The same path (circuit) is used for both forward and reverse.
  • Thanks, but the reverse keys are asymetric like the forward keys? The reverse keys are similar to forward keys?. Jul 13, 2016 at 13:41
  • The reverse and forward keys are a pair of symmetric keys. The key exchange (TAP or nTor) is done using asymmetric/public key cryptography, the keys derived from the key exchange are symmetric, specifically they are used as AES keys.
    – cacahuatl
    Jul 13, 2016 at 15:48
  • Does this first TLS connection not use the TAP/Ntor protocol?
    – forest
    Feb 17, 2019 at 11:55

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.