How are tor hidden nodes/services found?

Question

Tor has "hidden services", which have an address like duskgytldkxiuqc6.onion.

Now I was wondering: how is this duskgytldkxiuqc6.onion name mapped to the real server?

I don't think there's a central server translating those addresses to a location/route as that would defeat the purpose. But what is it then? Broadcasts?

Answer 1

The best simple description of the process can be found in the Tor Project's documentation. Here are the 5 parts of the connection:

1. The hidden service, running on a server somewhere with a Tor client.
2. Introduction points, which are Tor relays chosen by the hidden service.
3. The database of hidden service descriptors (each descriptor consists of the public key and introduction points).
4. A Tor client trying to communicate with the hidden service.
5. A rendezvous point, a Tor relay chosen by the client.

The hidden service publishes its descriptor to the database (part of Tor's directory service) via its anonymized circuits which end at the introduction points. When a client wants to communicate, it gets the descriptor from the database, encrypts information about the rendezvous point with the service's public key, and passes it to the service via one of the introduction points. Then both the service and the client make a 3-hop Tor circuit to the rendezvous point and begin a fully encrypted, mutually anonymous conversation.

Any Tor relay can act as an introduction point or a rendezvous point without extra configuration; that's part of the function of a Tor relay.

References:

1. Hidden service protocol
2. Tor design paper, section 5
3. Tor rendezvous specification
4. Hidden service names demystified