Need some details about relays between user and onion sites

Question

Can someone explain some things:

1. Is all trafic between client and .onion server encrypted 6 times in either direction because of chain:
   Client -- [1 node ip -- 2 node ip -- 3 node ip] -- [3 node unknown-2 node unknown-1 node unknown] -- onion Server destination.
2. Supposing someone has control of all my 3 nodes (the worse scenario). But he still can't see what .onion server I'm using, isn't he? Because of end-to-end encryption of .onions and guard nodes between my exit node and site's ip.

If I'm wrong in something and you can explain it clearly please do it.

Answer 1

1. I believe the traffic is encrypted 8 times (not including the TLS link crypto): 3 times along the client's circuit, 4 times along the onion service's circuit, and once more for the end-to-end encryption from the rendezvous handshake.

   Client ─── A ─── B ─── C ─── Z ─── Y ─── X ─── Onion
      │       ^     ^    ^ ^    ^     ^     ^       │
      └───────┴─────┴────┘ └────┴─────┴─────┴───────┘
      |                                             ^
      └─────────── rendezvous handshake ────────────┘
   

2. The introduction point (the relay where you first contact the onion service) can generally not tell which onion service you're connecting to, but I'm not sure if malicious relays can learn some information if it already has the current descriptor for the service you're connecting to. In this case maybe it could perform a reverse lookup in its known descriptors for the service key / introduction point authentication key? In any case this doesn't harm the users anonymity, but could possibly allow the relay to measure a service's popularity.