Let's say LE knows who I am ... they already know I am using Tor. Is there a way for them to create a surveillance from my ISP ? You will say Tor is encrypted except exit relay ... but common to the first node... I have to send the encryption code also so the message is decrypted , right? Also when I get back the response, Tor already know my encryption code... so is Tor safe if Law Enforcement will do a "man in the middle" attack exactly between me and my ISP ?
Tor uses public key encryption.
Everybody creates a public / private key pair.
The public key is used to encrypt data.
The private key is used for decrypting data.
Public keys are publicly known so anybody can encrypt data.
Private keys are kept secret, so only the person who knows it can decrypt the data.
Tor uses this to avoid the attack that you're describing.
You may find this youtube video useful.
but common to the first node... i must to send the encryption code also so the message is decrypted , right?
The first node is the Tor client on your local machine.
The connection from your browser to your Tor client is socks. From there, the connection to the guard node is encrypted. The guard can not decrypt your traffic.