When the clients sends a packet through relay nodes, is each packet signed then encrypted? If so, how do the relay nodes know the client's static public key to check the signature, as knowing this would give the other relay nodes knowledge of the who the client is. If the packets aren't signed, then can any packets have their authenticity proved?


At each hop, no, payloads are not authenticated. However, the inner most layer is. This enables the exit node (or onion service) to detect tampering. This lack of authentication opens tor up to tagging attacks because AES-CTR, as used to encrypt the payloads, is malleable and any tagging can be detected by observing the tag between the CELLs at a later hop in the circuit. This attack can only usefully be applied by malicious guards and exits who collude.

This tagging attack can and will be mitigated by replacing AES-CTR with an SPRP, which does not prevent the malleability, but does prevent the trivial linking of corrupted CELLs.

FYI we don't need asymmetric signatures with public keys to authenticate a message. A MAC, Message Authentication Code, is the symmetric variation using a single secret key. Just like a symmetric cipher uses a single secret key. These secret keys are known only to the sender and receiver and must not be known by your adversaries. Otherwise messages may be decrypted or forged.


This is a rather complex question. The super-simplistic answer is that you and the guard node each make 1/2 of a key that is then used to encrypt/decrypt traffic.

OK for the real answer, read section 4.2 Circuits and streams of the Tor design paper. It's pretty dense and takes time to wrap your head around, just FYI, but it should give you all of the info that you need.

  • This is a very old reference. Please refer to the active tor-spec.txt. – cypherfox Mar 8 '20 at 14:58

You're asking how Tor works in a few simple lines. It takes a long answer and knowledge of the Tor network itself to understand how this works.

TL;DR The client knows the public key for the nodes he communicates with. The node can decrypt with his own private key and doesn't know anything about the client.

Longer answer: When a Tor client wants to send a data package it needs a route. This route contains a guard node, middle node and an exit node. The client generates this route by himself with the data he received from the directory service. This directory service also sends along the public keys for all the nodes he communicates with the client.

When the client wants to send a data package it encrypts the package 3 times. Once with the exit node's public key, once with the middle node's public key and once with the guard node's public key. When the guard node receives the package it decrypts it with his private key, then sends it to the middle relay. The middle relay decrypts the next layer of encryption with his private key and sends the package to the exit node. The exit node decrypts the last encryption layer with his private key and sends the unencrypted package to its final destination. It all works like the layers of an onion. That's why Tor's name is actually The Onion Router.

  • I understand the layered encryption concept, but how are packets authenticated if they are? – SamG101 Oct 2 '19 at 11:41
  • Sorry, I misunderstood the question. Why should packets need to be signed? The whole concept is to stay anonymous. Signing a package would break that concept wouldn't it? – Martin Oct 3 '19 at 12:01

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.