I want to understand how the TOR network works, particularly how hidden services can hide its IP from clients. In this answer, I find the following a bit vague:
The introduction point relays this encrypted rendezvous point and one-time secret to the hidden service over the existing Tor circuit
So how exactly does a TOR introduction point locate a hidden service without knowing its IP?
When a hidden service is first started up, it chooses a few random introduction points (IPs), makes "forward circuit" to them (e.g. 3 node circuit), and requests that they host the hidden service descriptor. At that point, the IPs do not know the original location of the hidden service, just that one exists and they have a path to follow to return information to.
When a client does a lookup via the HSDIR, they are pointed to one of those IPs, which in turn make a connection back to the Hidden Service itself following the circuits that were previously established. Then they establish a rendezvous point (RP) which is beyond your question.
Throughout this flow, the IPs and the hidden services are both anonymous from one another.
