Hidden services : clear text, or not, at the rendez-vous point? [duplicate]

Question

Most common descriptions, including nice looking graphics, of the communication with Tor hidden services are framed in terms of high-level "Tor circuits" which obscure rather than help understand the underlying mechanisms, in this questioner's naive opinion. In this question instead let's please focus on the contents of TCP/IP packets exchanged :

Assume Tor-user retrieving some clear text file, hello.text, from server qw…rty.onion, using some unencrypted protocol over TCP, say, the HTTP. Let's peek - like, with that ethereal thing - at the data packets which are part of this transfer along the whole path (excluding the end-points). Are the contents retrievable in the clear anywhere, in particular, at the "rendez-vous" point ? Or does Tor "onion" layered encryption somehow apply over the whole (2 "circuits") path ? Please explain...

Edited after suggestion by C.I. that this may be a duplicate. I do not think so. The other question was about encryption of requested hidden service URIs, this is about the encryption of contents. Also, the other question said : "I understand that all of the communication between a client and a hidden service (.onion) takes place within the Tor network and is therefore end-to-end encrypted." - but this is exactly what is in doubt with this here question : are data really encrypted end-to-end by the onion protocol (that would be six-level deep onion encryption) ? Or rather are they decrypted (in the clear) in the middle, at the junction point (rendez-vous), before being reinjected, reencrypted for the other "circuit" (3 level deep encryption) ?

Answer 1

FWIW I still consider this a duplicate.

The other question was about encryption of requested hidden service URIs...this is about the encryption of contents

The various parts of the URI are only in the contents of the stream, if you can't see the URI then you're not seeing any of the contents.

When you create a circuit to an onion service you fetch the descriptor for an HSDir.

The descriptor contains a set of public keys associated with introduction points. The onion service alone has the corresponding private keys.

You connect to the rendezvous point and give it a cookie value and it stores it and waits.

You then encrypt the first half of a DH handshake along with the cookie value you gave to the rendezvous point and the location of the rendezvous point itself to the public key associated with the onion service at the introduction point. The introduction point knows what circuit is associated with the public key and passes the message on to it.

The onion service uses the private key to decrypt the first half of the DH handshake, the cookie and the location of the rendezvous point. It connect to the rendezvous point, presents the cookie and the rendezvous point connects it with the you along with it's half of the DH handshake.

Both parties now have a shared secret that no one else knows, through the DH handshake. Therefor no one in the circuit except the onion service and you know the content of the connection.

This is what end-to-end encryption means, if at any point it wasn't encrypted it wouldn't be end-to-end.