Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Me -> Node A -> Node B -> Node C -> destination

The documentation on Tor always states that only the exit node C can see plain text data. How is this possible without me talking to Node C directly?

If I have some plain text data, and want to send it encrypted to Node A, I'd usually do a Diffie-Hellman key exchange, and send the data over. But with that scheme, Node A could decrypt the data.

If Node C was somehow sharing its public key with me, couldn't Node B or Node A MITM the key?

How exactly does Tor manage its PKI? What keys are used to encrypt data where?

share|improve this question
    
This Answer gives a slightly different analogy. In answer to your question: Node C is able to open the red box, in which is contained the plain text 'Nasty Letter'. –  lynks May 28 '13 at 16:20
add comment

2 Answers

up vote 44 down vote accepted

Tor uses a routing method called Onion routing. Much like an onion, each message (the core of the onion) is covered with layers of encryption. attrib:wikipediaimage attribution

Your message is encrypted several times before it leaves your device. Node A can only decrypt (peel) the layer A, under which it would see the address of the next node. After the packet reaches the next node, it can only decrypt (peel) layer B, and so on. For each layer, you use the respective node's public key, so only that exact node can decrypt the layer with its own private key.

When the message reaches the exit node, all of the layers have been decrypted and message is now in plaintext (it could also be encrypted if you're communicating with the server under SSL).

share|improve this answer
12  
Bloody marvelous image, looks like a nuclear reactor core with a fuel rod inserted into it! –  TildalWave May 28 '13 at 15:34
1  
+1 just for the image. I've been looking for a good visual representation of Tor onion routing for a long time. –  Polynomial May 28 '13 at 16:09
3  
@PeteyB There is no "return trip". The routing creates a TCP connection chain, which is full-duplex. –  Polynomial May 28 '13 at 16:16
1  
@PeteyB TOR does not use PKI in the sense of global CAs. TOR keys and Node IPs are distributed by the TOR project. This distribution is protected by hard-coded public keys in the TOR software. –  lynks May 28 '13 at 16:17
4  
I agree with Petey B, the return path of the TCP connection is kind of "hand waved" away. Could you update your answer to give a better explanation of how a reply packet (even something as simple as the SYN-ACK packet of the 3 way handshake) on the TCP connection is sent back through the tor network and get to the original sender? –  Scott Chamberlain May 29 '13 at 0:44
show 4 more comments

TOR uses the principle of onion routing. Let us say there are 3 TOR nodes A,B and C involved (selected randomly by client) and the message is m. We assume the corresponding public keys of these nodes to be Pa,Pb and Pc.

The message is repeatedly encrypted by the client starting with the public key of the exit node (Pc) followed by Pb and in the end Pa (Onion Routing).

Data received by node A: Pa(Pb(Pc(m))) 
Data received by node B: Pb(Pc(m)) 
Data received by node C: Pc(m)  

The data is decrypted at each node by using their corresponding private key. After decryption each node gets some plain-text information about where to forward the remaining data. This makes sure that no single node knows the entire path. Each node only knows about the previous and the next node.

p.s. There is a very good article on TOR in our community blog but somehow I am not able to find it. If anybody finds the link please add it to the answer.

share|improve this answer
    
+1 for the pseudocode. Makes it much clearer. –  Adnan May 28 '13 at 16:07
    
Commenting on both answers for visibility: Okay so TOR relies on a PKI directory to hold all public keys? The public keys for each router are pulled by the client and used to encrypt the data. How about on the return trip? Does the exit node pull all keys down from the directory and perform the same operation in reverse? How does router C get the client public key? Are client keys stored in the PKI directory as well? –  Petey B May 28 '13 at 16:11
    
@PeteyB router C does not need the client's public key.The onion routing involves the public keys of the nodes and not the client. as mentioned in another comment a TCP connection is created by routing. –  Shurmajee May 28 '13 at 16:20
1  
@MayankSharma Maybe I'm being silly: So how are packets encrypted on the return path? If they're simply encrypted with the nodes' private keys, then any packet caught between two nodes could be decrypted rather easily by anyone with a snapshot of the node pubkeys at that time?! –  us2012 May 28 '13 at 23:11
1  
@us2012 The crypto involved is TLS. Public-key crypto is only used to establish a symmetric session key between two endpoints. When the whole chain is complete, the client has separate TLS connections with each of the 3 hops, most of which are tunneled through the others. –  bonsaiviking Jun 23 '13 at 0:49
show 4 more comments

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.