Traffic secrecy in rendezvous points

Question

In the Tor hidden service design Alice and Bob communicate via a rendezvous point that they agree to at one of the hidden service's introduction point.

Can either of these nodes observe traffic between Alice and Bob in the clear? If not, how can this be achived.

Answer 1

TL;DR — Yes, traffic is end-to-end encrypted between the client and the server node.

To understand why, it's important first to clear up a misconception in the original question:

when Alice don't know destination node's key how is that possible encrypt traffic on this point?

Alice does know the destination's public key (identity) and visa versa. Keys do not correspond to locations in the Tor network though, so Alice and her destination are still anonymous. On a more fundamental level: Identities do not correspond to locations in the Tor network (in fact, making that so is the whole point of the Tor network!).

This article provides a good overview of how the Tor Hidden Service protocol works, and how alice and the hidden service perform key exchange and the like. It is sumarized below:

• The service randomly picks some relays, builds circuits to them, and asks them to act as introduction points by telling them its public key.

• The hidden service bundles its public key and a summary of each introduction point into a hidden service descriptor and signs this descriptor with its private key
• It uploads that descriptor to a distributed hash table.

• A client requests the hidden service descriptor from the DHT using a hash that corresponds to the descriptor (a .onion address)
• The client creates a circuit to another randomly picked relay and asks it to act as rendezvous point by telling it a one-time secret

• The client assembles an introduce message (encrypted to the hidden service's public key) including the address of the rendezvous point and the one-time secret

• The client sends this message to one of the introduction points, requesting it be delivered to the hidden service

• The hidden service decrypts the client's introduce message and finds the address of the rendezvous point and the one-time secret in it
• The service creates a circuit to the rendezvous point and sends the one-time secret to it in a rendezvous message
• The rendezvous point notifies the client about successful connection establishment
• Both client and hidden service can use their circuits to the rendezvous point for communicating with each other. The rendezvous point simply relays (end-to-end encrypted) messages from client to service and vice versa

For more information see the rendevouze spec or the Tor design whitepaper [PDF].