I'm not clear on what is actually stored in the DHT, or the contents and purpose of the introduction message.

If all of the hidden services are listed in a Distributed Hash Table, what prevents a modified client from directly connecting to a HSP, or enumerating the *.onion addresses?

2 Answers 2


A hash table contains public keys of the hidden services, not actual IP addresses. The public key is used to create a request for the hidden service and the hidden service is the only one with the private key to decrypt the request. From the tor website:

Step four: When the descriptor is present and the rendezvous point is ready, the client assembles an introduce message (encrypted to the onion service's public key) including the address of the rendezvous point and the one-time secret. The client sends this message to one of the introduction points, requesting it be delivered to the onion service. Again, communication takes place via a Tor circuit: nobody can relate sending the introduce message to the client's IP address, so the client remains anonymous.

Hidden services are never connected to directly by clients. The service will check for requests from its introduction nodes and respond to those nodes, which will respond to the rendezvous node where the client is connected to. All the communication between client and hidden service is happening on this rendezvous node so that both sides see this node as the endpoint. Only exit nodes can see clearnet requests (requests to regular websites outside of the onion network) and even they don't know who is making the requests since there are multiple nodes and a rendezvous between them and the client.


Hidden service directory can enumerate its own share of DHT containing v2 hidden service descriptors. It is not possible for v3 onion services.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .