How does Tor protect against fake entry nodes / total redirection?

Question

There is much material on how to protect yourself from malicous exit nodes, especially by using SSL and minimizing the leakage of identifying information (user-agent, screen size, etc.).

However, I was wondering why an attacker could not just setup a bunch of fake Tor entry nodes, and redirect your outgoing connections to them (assuming you must route all data through their network). They could even virtualize or fake the whole Tor network with ease.

What measures does Tor have against such attacks, and what can a user do against it?

Are there e.g. a list of hardcoded entry servers with known public keys? If so, how do I know that those priviliged servers are not operated by the NSA or the Chinese or whoever? They could be a) compromized from day one, or b) someone could have manipulated www.tor.com when I downloaded the software, and replaced the server list and checksums.

---

(I hope this doesn't sound too paranoid. I got this idea when I was working a large (US-)government-run facility, and noticed how pervasive their computer security measures were (probably with good reason). If I were a dissident or had something to hide, they could have easily 'rabbit-holed' my entire network. I guess this is a much more pressing problem in other countries.)

Answer 1

[Is there] a list of hardcoded entry servers with known public keys

Every server is capable of acting as an entry as every packet is either a packet to be forwarded or an exiting packet. This is achieved by encrypting each packet to a specific node. Each node has a public key listed which is used to negotiate a session key with that node.

The principle behind this is called onion routing. The fine details are expansive, so reading the article is best. The summary is that the packet is encrypted for the last node, then that is encrypted for the 2nd to last node, and so on.

Without controlling every node in the chain, linking the original sender to the raw packet would require traffic analysis.

Since the public key of a TOR node is published, no node in the chain can redirect your traffic in a meaningful way. It must pass to a node that is capable of decrypting it. A symmetric key is derived using a signed Diffie-Hellman exchange, and thus will not be accepted from a node that doesn't possess the matching private key for the published public key. That key exchange and layered encryption is what protects you from malicious nodes removing downstream nodes from the chain.