It's my understanding that between the user and an OR there are two symmetric keys, one for sending data forward and another for receiving data. These keys are forged according to either TAP, which uses DHE or nTor, which uses ECDHE. My question is whether two key exchanges are performed between the user and the OR in order to create the two keys?

I realize this question is more generally about the nature of Diffe Hellman cryptography however I felt as though it was still relevant.


One key exchange is performed, the shared secret is streched using a Key Derivation Function (KDF).

From tor-spec:

5.1.3. The "TAP" handshake
Once both parties have g^xy, they derive their shared circuit keys
and 'derivative key data' value via the KDF-TOR function in 5.2.1.
5.1.4. The "ntor" handshake
Both parties now have a shared value for KEY_SEED.  They expand this
into the keys needed for the Tor relay protocol, using the KDF
described in 5.2.2 and the tag m_expand.
5.2.1. KDF-TOR
From the base key material K0, they compute KEY_LEN*2+HASH_LEN*3 bytes of
derivative key data as
   K = H(K0 | [00]) | H(K0 | [01]) | H(K0 | [02]) | ...
5.2.2. KDF-RFC5869

For newer KDF needs, Tor uses the key derivation function HKDF from
RFC5869, instantiated with SHA256.  (This is due to a construction
from Krawczyk.)

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.