3

Let me explain with a nifty diagram:
IP/RP <-> bunch of Tor clients/node (Tor circuit) <-> Tor hidden service

Wouldn't the last Tor client in the circuit knows that the message is for the Tor hidden service? I know that the communication is encrypted, but there is an IP address associated with each packed (i.e. send this encrypted packet to A). If the last node to the hidden service knows the IP address to send the packet to, wouldn't it know the hidden service's clearnet address?

I have read the specifications for Tor hidden services, IPs and RPs, but it just seems to not explain its immunity to exit node sniffing.

Improve this question

1 Answer 1

Reset to default
3

The node right next to the hidden service in that circuit does know its IP, but it knows nothing about it other than that; not even that it's a hidden service, nor the message that is being sent to it -- it looks just like another node in the circuit.

Improve this answer
2
  • I see. So in a hypothetical sense, a guy with unlimited computing power running the so called 'exit node', would be able to decrypt the packet to get the message that is intended for the 'hidden service' (since its the last layer of the onion)? Also, a side question, does the keypair for the hidden service vary per circuit or is it constant? (That will raise some issues of accidentally releasing the private key)
    – Skaty
    Commented Oct 20, 2013 at 16:36
  • Yes -- but if there is an adversary with unlimited computing power, they have a lot of potential ways to break the secrecy, they certainly don't need access to that node. Regarding your side question, you should really ask that in a separate question, but the answer is that any Tor circuit generates session keys for each layer of the onion in order to establish some sort of forward secrecy.
    – Darius Jahandarie
    Commented Oct 20, 2013 at 16:45

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .