8

The Tor manual says:

TunnelDirConns 0|1

If non-zero, when a directory server we contact supports it, we will build a one-hop circuit and make an encrypted connection via its ORPort. (Default: 1)

Tor connects to a directory server to get a list of Tor relays in the first place. When Tor is started for the first time, how does Tor know which relay could be used to connect to a directory server?

Improve this question

2 Answers 2

Reset to default
6

Tor ships with a list of directory authorities and some information about them.

In particular, this information includes for each authority its IP address, onion port and onion key fingerprint.

This makes it possible for clients to make an onion connection to one or more authorities for bootstrapping purposes. It then connects to the authority's DirPort via the onion connection to that authority.

This so-called tunneled connection doesn't provide anonymity. It only provides confidentiality, i.e. nobody listening on your network can know exactly what you fetched[1]. It also would provide integrity, but the information downloaded is signed anyway.

[1] Though it's probably not too hard to guess that you're bootstrapping once you know it goes to a Tor node and there's a lot of downloading happening. Still, you can't just filter for "GET /tor/" to block the connection.

Improve this answer
0
1

If I remember correctly, the Tor software ships with a list of directory authorities. The client has just enough information to bootstrap and then continue to download information about all the other relays in the network.

Improve this answer
3
  • Tor software ships with a list of directory authorities, yes... But also a list of initial relays?
    – adrelanos
    Oct 3, 2013 at 3:43
  • @adrelanos No, just with a list of directory authorities. There was a design to also ship a "fallback relay list" with Tor, but such a list could make you more distinguishable in the network, because you'd only use relays in your circuits that are still running since the relay list was made. Maybe you meant that? There are ideas to revive this idea by shipping a list of "fallback directory mirrors" which is less problematic: trac.torproject.org/projects/tor/ticket/8374
    – karsten
    Oct 3, 2013 at 9:05
  • "Maybe you meant that?" - Yes.
    – adrelanos
    Oct 3, 2013 at 15:45

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .