What encryption is actually used by tor circuits?

Question

I'm trying to determine what encryption (asymmetric and symmetric) Tor actually uses these days for client circuits. I've read the changelogs and only seem to see nebulous statements about having a ciphersuite that more closely matches what Firefox uses, but no actual details as to what that might be. Enabling the highest level of logging in my Tor client doesn't reveal anything either. I also see mentions of elliptic curve and chacha20 support, but can't tell if that is being used in practice. Other changelog entries suggest that AES256 is favored over AES128.

So, my question is assuming I'm using the most recent version of the Tor client, what asymmetric encryption algorithm is used, and what symmetric encryption algorithm is used? Is it x25519 for key exchange and AES256 for the symmetric cipher, for example?

Thank you!

Answer 1

CELLs are encrypted using a stream cipher, presently AES-128-CTR with a zeroed IV. This will be upgraded to an SPRP in the future to defend against tagging attacks.

0.3. Ciphers

These are the ciphers we use unless otherwise specified. Several of them are deprecated for new use.

For a stream cipher, unless otherwise specified, we use 128-bit AES in counter mode, with an IV of all 0 bytes. (We also require AES256.)

X25519 is used in the ntor handshake.

5.1.4. The "ntor" handshake

This handshake uses a set of DH handshakes to compute a set of shared keys which the client knows are shared only with a particular server, and the server knows are shared with whomever sent the original handshake (or with nobody at all). Here we use the "curve25519" group and representation as specified in "Curve25519: new Diffie-Hellman speed records" by D. J. Bernstein.

Answer 2

From tor-spec.txt:

Connections between two Tor relays, or between a client and a relay, use TLS/SSLv3 for link authentication and encryption. All implementations MUST support the SSLv3 ciphersuite "TLS_DHE_RSA_WITH_AES_128_CBC_SHA" if it is available. They SHOULD support better ciphersuites if available.

This means that the symmetric cipher in use on any given connection could vary, and you need to watch the connection establishment to see what is actually used. I just did a test between an up-to-date TBB and whatever guard I got given, and the key exchange used ECDHE, and AES-256-GCM was negotiated as the symmetric cipher. Assuming the guard I used is running up-to-date Tor, it's likely that what would be used by everyone who's up-to-date.