return path selection

Question

i could not find a detailed explanation about how return path is defined. It is mentioned somewhere that exit node encrypts data multiple times. But how dose exit node gets the public key of first node? as exit node is note supposed to know who is first node.

Answer 1

Exist node is not supposed to know the identity of the first (guard node), and thus does not its public key. I have no specific knowledge about the encryption scheme in the return path, but I think it is likely that each relay node encrypts the packet using the next node's public key and forward it to the next node, which can decrypt it using its own private key. And so, the package is forwarded encrypted from a node to another using this method. The addresses of the next nodes in the return circuit can be obtained from the stored forward path. There is no need for layered encryption in the return path, since its objective was to hide the full circuit from any node in the path. But in the return path, the full path is not included, but each node uses as next hop the node that was the previous hop in the forward path.

UPDATE:

The same circuit is preserved in the return path as I described above, but layered encryption is employed, but in the reverse order. Quoting from wikipedia:

When the chain is complete, the originator can send data over the Internet anonymously. When the final recipient of the data sends data back, the intermediary nodes maintain the same link back to the originator, with data again layered, but in reverse such that the final node this time removes the first layer of encryption and the first node removes the last layer of encryption before sending the data, for example a web page, to the originator.

Source: Onion Routing