This question is born out of two questions that I saw coming up.
Is the connection between my computer and the Tor network encrypted?
How does Tor encrypt my traffic before it sends it to the server? Does it even do that?
Please explain, where encryption is used! E.g. the connection between the client and the guard, and what about the relays in-between?, and is the encryption maintained as it reaches the destination?
Tor is the 2nd generation of onion routing. In onion routing, the message is encrypted multiple times with a different key for each layer of encryption. In Tor as long as Alice (the client) has established a circuit with 3 nodes, the entry node, the middle node and the exit node, that means that the original message to Bob(the destination) will be encrypted within three layers, one layer for each node.
The original message, will be the message destined to Bob, for example an HTTP request. Alice encrypts the request with the key she has agreed with each node. First goes the exit node encryption layer, then middle, then the entry node. Notice that the order the original message is encrypted is the reverse of the order of the nodes in the circuit.
Alice sends this onion (message encrypted with 3 layers) to the entry node. The entry node decrypts the first layer of encryption and passes the remaining onion to the middle node. The middle node removes its layer of encryption and passes the onion to the exit node. Finally the exit node removes the last layer, reads the destination IP of the original message and forwards the request to Bob accordingly.
So you may have already understood that all traffic between Alice and the exit node is encrypted (using different keys along the path). Beware that Tor is not responsible to encrypt or in any way manipulate the original message. If original message was plain-text HTTP request that it will be plain-text when the exit nodes will read it and will be plain-text from the exit node till Bob.
That's the reason to always use SSL/TLS when using Tor. So as the original message is already encrypted before reaches Bob. That way only Bob, Alice's destination will be able to read the actual content of the message. So if Bob is a web service, Alice must use HTTPS, if it's an IMAP/POP use TLS encrypted connection etc.
You may find this interactive visualization by EFF pretty instructive.
