Tor's encryption confusion and client to first node encryption

Question

From what I've read the onion routing process goes like this:

• The client encrypts its traffic to the destination server and sends it to the first node (encrypted);
• The fird node encrypts it again and then sends it to the seconds node;
• And so on until the decryption process starts (the amount of nodes the traffic goes through and the layers of encryption can vary. i think.)

• The last node completely decrypts the traffic and sends it to the destination server unencrypted

• The server encrypts its response to the client and sends it to a node and the cycle of encryption and decryption starts again, just like the client did in the beginning

• The client receives the traffic.

My questions are:

1. Does the server's response reach the client encrypted or unencrypted? Is the cycle exactly the same for the client's request as it is for the server's response?

   1.1 If unencrypted, wouldn't my ISP or anyone else be able to spy on me?

2. Why does the traffic on the last node go to the destination server fully unencrypted? What prevents it from being encrypted?

Thanks

Answer 1

1. Does the server's response reach the client encrypted or unencrypted? Is the cycle exactly the same for the client's request as it is for the server's response?

   • It reaches the client encrypted (in multiple layers, although to stop ISP snooping one layer is sufficient, the multiple layers is to stop relays from snooping too). For more information on this see this question and answer.

2. Why does the traffic on the last node go to the destination server fully unencrypted? What prevents it from being encrypted?

   • Any encryption must be done on the application layer, you could send encrypted data to the destination but the destination must know how to decrypt it. For more inforamtion on this see this question and answer.

P.S. how do you handle a question this is two questions, both of which are duplicates but when combined aren't a single duplicate? This seems like a failing of the StackExchange system...