How is data sent back from exit node to me?

Question

I understand how the client sends the data through Tor to the sever. Onion routing

Basically, it selects a set of nodes to form a circuit, say nodeA nodeB nodeC.

It then encrypts the data this way:

1. Encrypt it using nodeC's key, append server's address.
2. Encrypt it using nodeB's key, append nodeC's address.
3. Encrypt it using nodeA's key, append nodeB's address.

The data then travels the circuit this way.

Me -> nodeA (decrypt it) -> nodeB (decrypt) -> nodeC (decrypt) -> Server

1. I send the data to nodeA. nodeA decrypts it and will now know where to send the data next.
2. nodeA sends the data to nodeB. nodeB decrypts it and will now know where to send the data next.
3. nodeB sends the data to nodeC. nodesC decrypts it and will now know where to send the data next.
4. nodeC sends the data to the server.

What I don't get is, when the server replies, how is the data encrypted and/or sent back to me.

1. Does the exit node know who I am and sends the reply back the way I send the data to the server (construct a circuit)?
2. Is the session maintained, if so, how is the data encrypted between the nodes?

Answer 1

This is a common question that everyone stumbles upon while understanding TOR Design. When the data is sent back to the user, each relay encrypts the data using the session key which was exchanged with the user and then only when it reaches the user, it decrypts it using the session keys and retrieves the original data. Using your example,

1. Server replies to NodeC. Node C encrypts it using session key and sends encrypted data to Node B.
2. Node B encrypts the data again using session key it had exchanged with user and sends it to Node A.
3. Node A again encrypts it using session key it had exchanged with user and then sends it to user.
4. The user now gets the encrypted data and decrypts it again like peeling an onion.