I am really new to Onion Routing and Tor and I have just started reading about the topic on Wikipedia and the Tor Protocol Specification. Most of the concepts are explained very well but I have problems understanding some of the more complex points.
To begin with, how exactly does the connection establishment work?
In the torspec it says that there are at least three possible handshakes (v1, v2 and v3) that differ in the way they exchange the certificates. But do the relays (or the client and a relay) really exchange the certificates upfront or do they perform a TLS handshake first?
In a Tor-design paper (see link below) in section 4.2 (page 5) there is a figure that shows a (simplified) two-hop-circuit. The figure focuses on the encryption of the circuit, which is very interesting to see. What I would like to do is (mentally) draw a figure that includes all communication paths during the connection establishment, e.g.: the TLS handshake, the certificate exchange, the ClientHello, the Tor protocol version that is used, and so on.
Are there any other figurs, specifications or papers that clarify that process? Or can anyone explain this in a short, but detailed way?
Link to the Tor Protocol Specification: https://gitweb.torproject.org/torspec.git/tree/tor-spec.txt
Link to the Tor-design paper: https://svn.torproject.org/svn/projects/design-paper/tor-design.pdf