0

"Tor works like a chain of proxies, where each proxy only knows about the next hop and the previous hop."

I presume that a TOR node may be part of more than one circuit though, how does it know which packets belong to which chain, does each chain have an "ID" of sorts? Surely that would compromise security.

If we have chain X: A->B->C and Y: D->B->C

and B receives a packet from C, how does it know which entry node to send to?

migrated from security.stackexchange.com Dec 13 '18 at 21:25

This question came from our site for information security professionals.

  • This is explained in the wiki about it: en.wikipedia.org/wiki/Onion_routing – schroeder Dec 13 '18 at 21:12
  • each node knows what the next hop is – schroeder Dec 13 '18 at 21:12
0

If we have chain X: A->B->C and Y: D->B->C

When B receives a packet from A, it decrypts the contents, sees that the next hop is C, opens a connection to C (internally linking to the open connection with A that it has), and sends to C the rest of the packet (which is encrypted with the key of C, so it couldn't read it, anyway).

When it is a response from C to A, the connection was already opened by C, so B knows that certain connection (you can probably group several internal connections on a single TCP connection, but it's irrelevant here) corresponds to this one from A, since it is how B created them.

  • "the connection was already opened by C" but connects are a two party exclusive in sockets, so when (eg) 56.0.0.0:80 (B) recieves two packets (one from each circuit it's a part of) how does it know which endpoint to send it to? since each endpoint only knows where its going (in this case both go to same point), if it embedded an "ID" so B can differentiate, isn't that (in a sense) as insecure as if each node knew more than just where it was going and where its from? – BinkyNichols Dec 13 '18 at 21:41
  • No, because those IDs are specific to B. Suppose they had the "id 5". ID 5 on A would be completely different. As noted in the question you quote, each node knows where it is going, but also from which other node it came (the prior hop). And not, 56.0.0.0:80 is not exclusive, lots of users can connect to that webserver. What uniquely identifies a connection are the (src-ip, src-port, dst-ip, dst-port) tuple. – Ángel Dec 13 '18 at 21:47

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.