0

From Wikipedia, I understand that

Using asymmetric key cryptography, the originator obtains a public key from the directory node to send an encrypted message to the first ("entry") node, establishing a connection and a shared secret ("session key").

This makes sense to me; the client and first relay node communicate an authenticated key exchange, as they know each other. However, Wikipedia then goes on to say

Using the established encrypted link to the entry node, the originator can then relay a message through the first node to a second node in the chain using encryption that only the second node, and not the first, can decrypt.

How can the client and relay node 2 negotiate a key exchange that tunnels through relay node 1 without relay node 1 having the ability to act as a man in the middle and modify public keys that go through the connection.. Wiki says that "only the second node, not the first, can decrypt it". How can the second node decrypt the data without a key exchange taking place, and in such a way that node 1 can't read this data?

Improve this question
1
  • Just read the documentation (which is very well written!) from the official page. If you're prepared to dive into the deep, then you can read this.
    – Soutzikevich
    Nov 10, 2019 at 2:24

2 Answers 2

Reset to default
0

tl;dr: because Diffie and Hellman are freaking geniuses.

Longer answer: in the same way that the client and first relay can communicate an authenticated and secure key exchange even though there's an entire Internet worth of potential people in the middle, the client and second relay can communicate an authenticated and secure key exchange also, even though there's a person in the middle at the first relay.

The client simply says to the first relay, "here's a cell I'd like you to forward to the relay at (address)", and the second relay says to the first relay, "here's a cell I'd like you to forward to the client on circuit (number)" (because the second relay doesn't have the client's IP), and the key establishment and relay authentication happens over that channel.

Improve this answer
0

Sorry, wrong ticket :) The MitM is impossible truly when you don't have just a single authority, that's why it is a potential danger, you're right. But to decipher the full 3-hop chain you also need to have your own honeypot nodes for 2 and 3 members - so, basically, the Tor protocol do protect you, but just BASICALLY. But in most of the times it's more than enough. If you need a deeper explanation - just drop me a line, and I'll reveal some concepts I'm making in my darknet fork. Tor protocol does some careabouts the public keys, so it's not that straightforwardingly simple as it seems to perform a MitM, but it's still possible in a various ways, but it's laborious and cost-high

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .