If the client device performs 3 DH key exchanges with the 3 Tor relay devices, how does Tor provide anonymity to the client; wouldn't the IP address of the client be seen during the key exchange?? How does Tor prevent this??


2 Answers 2


The client only directly talks to the entry node. It talks to the second node through the entry node, and to the third node through the second node. Only the entry node knows the client's IP. The entry node does not know the third node or the final destination that the client is communicating through Tor with.

  • So if the client is communicating to the 3rd node through the 2nd node, how does the second node not know the client IP? And if the client communicates to the 3rd node through the 2nd node through the 1st node then wouldn't the 1st node know the 3rd node's IP?
    – SamG101
    Sep 6, 2019 at 6:49
  • The client communicates to the 3rd node through the 2nd node through the 1st node. The 1st node only has connections open to the client and the 2nd node. The client builds an encrypted connection with the 1st node, and then builds an encrypted connection with the 2nd node that goes through the 1st node but the 1st node can't read it. The client puts the 3rd node's IP in this encrypted connection to the 2nd node, the 2nd node connections to the 3rd node, and the client builds an encrypted connection to it. The 1st node doesn't see the 3rd node's IP because it's encrypted.
    – Macil
    Sep 6, 2019 at 20:48
  • Ah ok.. how does a connection go through node 1 without node 1 being able to read it.. for this to happen wouldn't the connection have to be encrypted with a shared secret from a key exchange between the client and node 2?
    – SamG101
    Sep 6, 2019 at 20:56
  • Or does the client send their part of the key exchange through node 1 to node 2, so node 2 and the client can create an encrypted connection that travels through node 1. If so, how is it authenticated to prevent MITM attacks from node 1??
    – SamG101
    Sep 7, 2019 at 7:09

DH key exchange is totally unrelated to the IP hiding mechanism - it's for point to point privacy. The IP is hidden because when the 3-layer tunnel is built - the "onion" - it is built one layer through another, so the third chain member will not be able to see your IP because you will talk to it through a second chain member you're talking to through the first one. That's how the IP address is hidden - and DH is totally out of relation with the hiding technics applied.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.