What is the authorization cookie of a .onion address?

Question

I was reading the svn-archive (Section 5.2) to understand how a .onion address is generated.

From my understanding, the "x.y.onion" address, comprises 'x' as 'the authorization cookie', and 'y' as the 'hash of the [onion service] public key'.

I understand that the 'y' part as the onion service is the key for the indexed information on the Tor lookup service, but I don't understand what the 'x' part does.

What is the purpose of the 'x' part--or 'authorization cookie'--in the client's URL bar? Where does it go? What does it do? Why do we need it?

Thank you for taking your time to read this. This is really confusing me.

Answer 1

The document that you're reading is the original Tor paper from around 2004. It's still useful for getting a basic understanding of the network, but a lot of the specifics have changed.

The "authorization cookie" that it refers to acts as a client password. The hidden service can require that the client provide this cookie in order to allow them to access the service (if the client doesn't know this cookie, then they can't access the service). This authorization cookie is optional, and you can read more about it for old v2 services under the HidServAuth option in the tor manual.

In the current Tor network which uses v3 onion services, this cookie works a bit differently, and it's not used as part of the FQDN. You can read more about how it's used under the CLIENT AUTHORIZATION section in the tor manual, and on the Tor Project website. The technical details are scattered throughout the "rend-spec-v3" document (just search for "client auth").

If you're interested in how modern v3 onion service names are generated, you will want to read Section 6 "[ONIONADDRESS]" of the "rend-spec-v3" document.