0

I have been trying to understand the process behind Hidden Services and something that is confusing me is the circuit lengths between different components in the Hidden Service Scenario. So far, I have found the following.

  • Client - RP : 2 Nodes
  • Client - IP : 3 Nodes
  • Client - HSDir : 3 Nodes
  • HS - RP : 3 Nodes
  • HS - IP : 2 Nodes
  • HS - HSDir : 3 Nodes

I would like to know whether this is correct and if so what is the reason to have only 2 nodes between Client - RP and HS - IP?

Also, I saw that in the connection establishment scenario with a normal web server, the client - Directory Server connection has only 1 hop/node? If this is true why does the HSDir connections have 3 hops in between?

1 Answer 1

0

I didn't check that all your numbers are correct, but they seem reasonable. Tor clients try to use three relays of its own choosing for anonymous circuits. Since the onion service chooses the introduction point, it only needs two other relays before it. Similarly, since the client chooses the rendezvous point, it only needs two other relays before it. In all of these cases, the circuit contains three relays chosen by the client.

Also, I saw that in the connection establishment scenario with a normal web server, the client - Directory Server connection has only 1 hop/node? If this is true why does the HSDir connections have 3 hops in between?

Connections to directory servers don't have 1 hop in between. Rather that first hop is the final destination. These relays are generally directory caches, so the clients download the directory documents directly from these relays. This is because the clients don't need anonymity in this case. Everyone downloads the same directory documents, so the server should not learn anything about the client (other than the client's IP address) or the websites that it visits. Tor clients use directory guards so that only a limited number of relays ever learn the client's IP address.

Hidden service directories act differently. Unlike directory documents where all clients download the same documents, clients request individual hidden service descriptors depending on what onion address the user attempts to visit. In this case the user requires anonymity since every user will request different combinations of hidden service descriptors.

4
  • Thank you for this explanation. However, about the one hop circuit, could you please explain the following statement on the Tor Blog article "blog.torproject.org/top-changes-tor-2004-design-paper-part-1" ? "Because clients aren't using Tor for anonymity on directory connections, they build single-hop circuits. We use HTTP over a one hop Tor circuit, rather than plain old HTTPS, so that clients can use the same TLS connection both for a directory fetch and for other Tor traffic."Is this deprecated now?
    – Ish Kav
    Aug 10, 2020 at 12:29
  • @IshKav No that quote is still up to date. Clients create a single-hop circuit to their directory guard and download directory documents over HTTP through the circuit. But unlike regular Tor streams, the HTTP request doesn't go to a different server. Instead the HTTP download happens internally within the relay, which runs its own HTTP server. For example this relay runs its own HTTP server which you can download the consensus from.
    – Steve
    Aug 10, 2020 at 13:07
  • Your answers for this question have been really helpful. However, it makes me wonder how does the client know which HSDir to connect? I understand the client only need the onion address to connect to the HS. So how does it know which nodes contain the relevant descriptors for that HS?
    – Ish Kav
    Aug 13, 2020 at 1:34
  • @IshKav I believe Tor uses some form of a distributed hash table (DHT) that is designed for this purpose, but I haven't looked into the details of how it works. That would be a good thing to post as another question so that someone who knows the answer might see it.
    – Steve
    Aug 13, 2020 at 3:26

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .