Differences between Onion Routing (Public Key) and Tor-Circuit (Session Key)

Question

I have a hard time understanding how a message is transmitted, when the Public Keys are used and when the Session Keys.

1. Tor Client connects to a directory server to get a list of active relays & exit relays with their policies (address, public key). I verify these list.
2. Tor Client automatically chooses three relays with a compatible exit policy
3. I start building my Tor-Circuit One-Hop at a time.
4. I send a Create Cell to the Relay 1 (Is this encrypted with 1 Layer through the Public Key of Relay 1?)
5. The First Hop and the Tor Client establish a temporarily Session Key through the Diffi-Hellmann-Key-Exchange
6. The Tor Client requests Relay 1 to extend his Tor-Circuit with another Hop to Relay 2 (Is this encrypted with 2 Layers through the Public Key of Relay 1, Relay 2?)
7. A second Session Key is established between the Tor Client and Relay 2, trough the Tor-Circuit. (Also encrypted in 2 Layers?)
8. The Tor Client requests Relay 2 to extend the Tor-Circuit with another Hop to Relay 3

If this step isn't encrypted with 2 Layers (with the PK of Relay 1 & Relay 2), Relay 1 would know the address of Relay 3, or does it encrypt the Create Cell(R3) with the temporarily Session Keys.

If it uses the Session Keys to encrypt why would we need the Public Keys, to identify the Relays?

I thought the Session Key is only used for the response and the Public Keys for the Request, or do I understand something completly wrong?

In my current view the Request has three layers of Encryption with the Public Keys, on each layer it reveals the next target to forward the message. (but the relay already knows the next target, since it had to establish a tor-circuit)

The request is encrypted at each relay with the temporarily Session Key, the Client then can decrypt all three layers since it established these Key with the respective relay.

I'm no nativ english speaker, so I hope its understandable.

Answer 1

Your understanding is basically correct. The first create cell is indeed encrypted with 1 layer, the second 2 layers, the third 3 layers, etc.

However, Tor takes a different approach when encrypting the second create cell. The second create cell is first encrypted with the public key of Relay 2, and next encrypted with the session key of Relay 1.

It looks like this: SymmetricEncrypt(PublicKeyEncrypt(handshake, PublicKey_of_Relay_2), SessionKey_of_Relay_1). Then Relay 1 decrypts it with its session key and forwards the decrypted create cell to Relay 2.

And when extending to Relay 3: SymmetricEncrypt(SymmetricEncrypt(PublicKeyEncrypt(handshake, PublicKey_of_Relay_3), SessionKey_of_Relay_2), SessionKey_of_Relay_1). By only using session keys, we can still reveal the next target on a per-hop basis.

We call the Public Key "onion key", and the Session Key "circuit key". And when we extend to the second hop or farther we do not use CREATE cells, but use RELAY_EXTEND cells instead. Relay 2 reconstructs the RELAY_EXTEND cell into a CREATE cell to send to Relay 3.

As for your original questions:

does it encrypt the Create Cell(R3) with the temporarily Session Keys.

Yes, with temporary session keys instead of public keys.

If it uses the Session Keys to encrypt why would we need the Public Keys, to identify the Relays?

Mostly yes. The public key encryption in TAP (the original Tor handshake protocol) serves multiple purposes. And in the new "ntor" handshake there is no public key encryption, but a different use of ECDH.

I thought the Session Key is only used for the response and the Public Keys for the Request, or do I understand something completly wrong?

The request is exactly one layer of public key encryption and a few layers of session-key symmetric encryption. The response does not make use of public encryption but only session-key encryption.

In my current view the Request has three layers of Encryption with the Public Keys, on each layer it reveals the next target to forward the message.

There is exactly one layer of public key encryption.

The request is encrypted at each relay with the temporarily Session Key, the Client then can decrypt all three layers since it established these Key with the respective relay.

Correct. The same applies to the response.

Hope another answer of mine could be of help to you.