My question pertains to the scenario after the client and the HS have exchanged a symmetric key. So, we have the following circuit:
Client -- c_relay_1(guard) -- c_relay_2 -- RP -- s_relay_3 -- s_relay_2 -- s_relay_1(guard) -- HS
Client encrypts payload with HS symmetric key, then the cell is encrypted in the following way:
At the RP the payload is encrypted only with the HS symmetric key. Later, the server's 3 relays encrypt the cell again in a similar fashion towards the HS. Is this correct?