5

I was just wondering if anyone has a diagram showing what is encrypted inside an onion packet when it leaves the sender?

When a Tor client sends the packet out, wouldn't the entry onion node know send real IP address? When reply traffic comes, what is the destination address for the traffic when it leaves the server?

Improve this question

1 Answer 1

Reset to default
3

The image below shows how a packet is encrypted, and sent through the network.

enter image description here

Tor uses its own protocol to negotiate encryption keys. Through this protocol the client receives encryption keys for Routers A, B and C.

From the Tor Project

The client negotiates a separate set of encryption keys for each hop along the circuit to ensure that each hop can't trace these connections as they pass through.

Before a packet is sent, it is encrypted with C's then B's then A's encryption key. When the message reaches router A it decrypts its layer, and forwards the rest to router B. Router A only know that the message needs to go to router B, and that it came from the client. It cannot see any other IP information.

For Tor (and onion routing) to work a minimum of 3 routers are required. So that no two routers will know both the source and destination IPs. When a Tor client sends a packet out the Entry Node will know the source IP address, but not the destination. The Exit Node will know the end destination, but not the real source address (just the previous relay). The IP address the server uses for the first layer will be the Exit Node's.

To address questions in your comments
If an Entry Node is compromised then it can reveal the source's IP address. But it will only know the next node in the circuit. Without some type of relationship to the destination the anonymity stays intact.

The Exit Node never seeds the original source address, and uses its own IP for communication with the end destination.

For more info look at the original Tor design paper.

Improve this answer
7
  • Thanks. So onion entry router will see the real source IP address and can reveal the sender if compromised, right? Also, does the exit node decrypts and changes the source address in real message to its own IP address and then send to server?
    – m1xed0s
    Commented Dec 19, 2014 at 14:48
  • Yes, the entry router will see the real source ip. But it do not know what the final destination is. So it only know that you send something, but do not know what, or what the final destination is (it might not be true for hidden services!?). Your right about the exit node, it will use its own IP address to communicate to the final destination.
    – Dog eat cat world
    Commented Dec 19, 2014 at 14:55
  • @m1xed0s I updated my answer.
    – RoraΖ
    Commented Dec 19, 2014 at 14:59
  • @raz, thanks. More questions :), when tor client encrypts data to be sent out, what is the source IP address it uses in the real data, the exit node's IP? If so, how can the reply traffic got routed back to the real sender while the real data from server has exit node's IP as destination IP? There has to be some mapping table on onion router, right?
    – m1xed0s
    Commented Dec 19, 2014 at 15:05
  • @m1xed0s You have to remember there are 3 onion routers. The original message uses the real destination's IP address. However, that message is encrypted 3 times (at a minimum). The onion routers take care of the routing within the Tor network. Only when the exit node decrypts the final layer does it know where to send it.
    – RoraΖ
    Commented Dec 19, 2014 at 15:10

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .