The Tor protocol version 1 uses 512-byte cells to obfuscate traffic patterns:
Traffic flowing down the circuit is sent in fixed-size ``cells'', which are unwrapped by a symmetric key at each node (like the layers of an onion) and relayed downstream.
yet it seems as though protocol versions 2-4 allow variable-length cells (see the spec linked above, search for variable-length).
Are those ever used in practice? What is the purpose of variable-length cells?
Have a look at the 2014 DRAFT v1, Tor Design Document (which seems to be more up-to-date than the version in the Tor SVN repository).
Cells are discussed in section 4.1 (page 5).
The short answer is: varying the length of cells makes detecting Tor traffic more difficult. You can't just keep an eye out for cells of 512 bytes.
Fixed-size cells provide some resistance to traffic analysis but are inefficient, so some control cells are variable length, where the ability of an attacker to detect their presence doesn’t affect security. Fixed-size cells also make the packet-size distribution of Tor distinctive, contrary to the goal of protocol-fingerprinting resistance. Therefore a variable length padding cell was introduced (but is currently unused) to allow the implementation of schemes to disguise packet length.
Note: I'm unsure if the variable-length padding cell, mentioned in the final sentence, has actually been implemented since this document was created.
