You build a TLS connection to your guard.
Over that TLS connection you perform a key exchange using the OR protocol. Now you and the first guard compute two keys from the shared secret the key exchange netted you, a forward and a reverse key.
Now you use the first OR to perform the key exchange with another OR, and again both can compute a shared forward and reverse key. And similarly you perform the same with the exit.
Now you have a set of keys shared with each relay:
The data is sent forward down the circuit, you apply all 3 layers of encryption and each relay strips a layer.
You -> E(f1, E(f2, E(f3, data))) -> Guard -> E(f2, E(f3, data)) -> Middle -> E(f3, data) -> Exit -> data -> Google
Then to reply, it follows the reverse path using the reverse keys with each relay applying a layer, and at the end you use all 3 reverse keys to strip the layers.
Google -> data -> Exit -> E(r3, data) -> Middle -> E(r2, E(r3, data)) -> Guard -> E(r1, E(r2, E(r3, data))) -> You
- Each relay strips a layer of encryption using the shared forward key on the way forward.
- Each relay adds a layer of encryption using the shared reverse key on the way back.
- The same path (circuit) is used for both forward and reverse.