In the Tor hidden service design Alice and Bob communicate via a rendezvous point that they agree to at one of the hidden service's introduction point.

Can either of these nodes observe traffic between Alice and Bob in the clear? If not, how can this be achived.

1 Answer 1


TL;DR — Yes, traffic is end-to-end encrypted between the client and the server node.

To understand why, it's important first to clear up a misconception in the original question:

when Alice don't know destination node's key how is that possible encrypt traffic on this point?

Alice does know the destination's public key (identity) and visa versa. Keys do not correspond to locations in the Tor network though, so Alice and her destination are still anonymous. On a more fundamental level: Identities do not correspond to locations in the Tor network (in fact, making that so is the whole point of the Tor network!).

This article provides a good overview of how the Tor Hidden Service protocol works, and how alice and the hidden service perform key exchange and the like. It is sumarized below:

  • The service randomly picks some relays, builds circuits to them, and asks them to act as introduction points by telling them its public key.

Hidden Service selecting introduction points

  • The hidden service bundles its public key and a summary of each introduction point into a hidden service descriptor and signs this descriptor with its private key
  • It uploads that descriptor to a distributed hash table.

Advertising a hidden service descriptor

  • A client requests the hidden service descriptor from the DHT using a hash that corresponds to the descriptor (a .onion address)
  • The client creates a circuit to another randomly picked relay and asks it to act as rendezvous point by telling it a one-time secret

Client connection

  • The client assembles an introduce message (encrypted to the hidden service's public key) including the address of the rendezvous point and the one-time secret

  • The client sends this message to one of the introduction points, requesting it be delivered to the hidden service

  • The hidden service decrypts the client's introduce message and finds the address of the rendezvous point and the one-time secret in it
  • The service creates a circuit to the rendezvous point and sends the one-time secret to it in a rendezvous message
  • The rendezvous point notifies the client about successful connection establishment
  • Both client and hidden service can use their circuits to the rendezvous point for communicating with each other. The rendezvous point simply relays (end-to-end encrypted) messages from client to service and vice versa

The final state of the network

For more information see the rendevouze spec or the Tor design whitepaper [PDF].

  • Can you tell me how many hops between the Client and the HS server are there in the circuit that passes through the Rendezvous Point? Commented Sep 25, 2016 at 1:35
  • As I understand it, six. Unless other considerations apply (like a new not-that-anonymous hidden service with only 3 hops).
    – Chiffa
    Commented May 20, 2017 at 13:28

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .