How is relay information obtained after running Tor?

Question

Let's assume that the NSA can't attack all Tor nodes at once, and someone using Tor is anonymous this way, but how does Tor actually download these secure Tor nodes when we open it? I mean does Tor client just download these relays over SSL from http://torproject.org? If so then NSA just needs to steal http://torproject.org SSL certificate and give bad relays to locate Tor users!

Answer 1

This is from the Tor FAQ at https://www.torproject.org/docs/faq#KeyManagement . There is much more, but I think this snippet, especially the last bit, is what you're looking for:

• How do clients know what the relays are, and how do they know that they have the right keys for them?

Each relay has a long-term public signing key called the "identity key". Each directory authority additionally has a "directory signing key". The directory authorities provide a signed list of all the known relays, and in that list are a set of certificates from each relay (self-signed by their identity key) specifying their keys, locations, exit policies, and so on. So unless the adversary can control a majority of the directory authorities (as of 2012 there are 8 directory authorities), he can't trick the Tor client into using other Tor relays.

• How do clients know what the directory authorities are?

The Tor software comes with a built-in list of location and public key for each directory authority. So the only way to trick users into using a fake Tor network is to give them a specially modified version of the software.

Edit to add: So it's a list of authorities. The bad guys would have to control all dir auths while maintaining their keys.