What is an "encrypted descriptor?"

What are the pros and cons of using one?

In what version of Tor did they first become available?

Are they automatically used (i.e. default)? If not, how do you enable the use of one?

Note: The current Hidden Service design allows a single node to upload a descriptor to the set of applicable Hidden Service Directories. This descriptor describes how a client can establish a connection with the hidden service. I think that an encrypted descriptor would mean that only those with the decryption key could learn the details required to contact that hidden service. Does this feature exist?

  • Please share where you saw Tor talk about "encrypted descriptor". It's not obvious what you mean by that at all. Nov 9, 2013 at 10:10

1 Answer 1


There are a couple things this could be. The current version of Tor hidden services has a couple optional security features for making private (that is invitation-only / password protected) services; these features involve encryption and sound like what you're describing.

These aren't used by default since most people want their services to be publicly accessible. I'm not particularly familiar with their use, sorry, but I imagine configuration involves adding your client's public keys to the file HiddenServiceDirectory/client_keys, mentioned in the Tor manual.
How they work is described in section 2.1 and 2.2 of Tor's rend-spec.

Another thing that "encrypted descriptors" could refer to is a currently unimplemented feature that involves encrypting hidden service descriptors to hide their contents from the hidden service directories that host them. This would likely not affect the end user. Here's a link to the trac ticket regarding it.

Not the answer you're looking for? Browse other questions tagged .