I'm reading here about Tor's 'DNS' resolving mechanisms (for both clearnet and hidden services) .

The mechanism for connecting to a hidden service itself (via a rendezvous point in a 7-hop circuit without the need for an exit node), I am clear on.

But, the step before that is finding out what its 'location' is (or rather, instructions for how to initiate a connection with the hidden service you're looking up), in the first place - Tor's equivalent of DNS.

In the afore-mentioned link, this line greatly bothered me:

Aaron’s client checks the Hidden Service Directory Server to see if the address exist.

After more searching, I found this excellent 2013 research, which states:

A client who would like to retrieve the full HS descriptor will calculate the time based descriptor id and will request it from the responsible HSDir’s directly.

As for the official Tor HS protocol outline page (https:// torproject.org/docs/hidden-services.html.en), the info is more vague, stating:

After [first learning about its onion address], the client can initiate connection establishment by downloading the descriptor from the distributed hash table.

This gives the impression of a decentralized distribution of descriptor information like Freenet, but maybe it is only distributed between HSDirs and that still says nothing of whether real IPs are linked to descriptor lookups or not.

So what are the facts here?

Is there any part of the process in which the original, non-Tor IP address of a Tor user, directly contacts a Tor HSDir (or another node for that matter), for the purpose of a direct request and retrieval of the descriptor of a given .onion address? If not, then which node in the chain does the HSDir see for that request, and is the original client's IP obfuscated to that node which has to know the onion address themselves?

If yes, this would be an extremely serious breach of anonymity for the entire Tor network. It is one thing to know virtually every .onion site in existence by operating a HSDir (under the current code anyway); it is another to know all the real IP addresses of those who visit them.

It would be ironic if Tor protected the IP addresses of users on clearnet by having DNS requests performed by the same IP as is doing the browsing (i.e. the Tor exit node), but not for hidden services themselves. If so, it would make sense to apply the same 'layered encryption' onion mechanism to descriptor requests also. (So have the exit node, or the same node as will be the rendezvous, make them.)

And on a related note, are the request (and response) packets between the client and the HSDir encrypted (similarly to HTTPS or DNSCrypt), or are the requests transported as plaintext directly to the HSDir server and thus readable by the user's ISP, global wiretapping adversaries and all other usual MITM suspects?

  • Oh and two things: 1. I guess wireshark could fairly easily be employed to find all this out (though I do not have the time or resources to perform it myself), and 2. if true, then maybe using systems like Whonix / Torified routers/access points/gateways can protect against this (for now) where the normal TBB on a host computer (and maybe even Tails, if not pre-PC torified?), would not.
    – Tor User
    Commented Feb 6, 2015 at 9:45
  • 1
    Nikita is right. Also, the hidden service circuit is 6 hops, not 7 hops -- each side picks 3. Commented Feb 8, 2015 at 10:10

1 Answer 1


No, the HS directory is accessed via Tor. See: https://gitweb.torproject.org/torspec.git/tree/rend-spec.txt#n549

The nodes running HS directories do form a distributed hash table, though it's not decentralized the same way that Freenet is, since all of the HS directory nodes are listed in the Tor consensus. So the client identifies which HSDir node is responsible for the service it cares about and opens a stream (through a regular Tor circuit it has built) to connect to that directory. Their IP address is kept hidden.

  • Phew. And also, in very clear words, the academic researcher from a significant 2014 study has said it is indeed done through a Tor circuit (whether exit node or not I'm not sure, looks like no, but would be good to confirm): youtube.com/watch?v=-oTEoLB-ses very clearly demonstrated at 42:25 and also states words to the same summary a bit earlier than that too.
    – Tor User
    Commented Feb 8, 2015 at 2:50

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .