Which type of Diffie-Hellman does Tor use?

Question

Does Tor use Ephemeral DH, Static DH or Anonymous DH? I have heard that the latter two are not secure so I am worried if Tor uses them.

Answer 1

Tor has had perfect forward secrecy since The Second-Generation Onion Router published in May 2004.

4.1 Cells

Onion routers communicate with one another, and with users' OPs, via TLS connections with ephemeral keys. Using TLS conceals the data on the connection with perfect forward secrecy, and prevents an attacker from modifying data on the wire or impersonating an OR.

Furthermore, from the chapter 7 Attacks and Defenses; Active attacks:

-- An attacker who learns an OR's TLS private key can impersonate that OR for the TLS key's lifetime, but he must also learn the onion key to decrypt create cells (and because of perfect forward secrecy, he cannot hijack already established circuits without also compromising their session keys). Periodic key rotation limits the window of opportunity for these attacks. --

Answer 2

Ephemeral DH, fixed DH, and anonymous DH are variations of DH. Anonymous DH is not recommended, because it does not provide the client with a way of authenticating the server's public key. Fixed DH is not recommended, because it does not provide perfect forward secrecy (PFS). See https://wiki.openssl.org/index.php/Diffie_Hellman for more info.

As pointed out by @EsaJokinen above, TOR protocol supports PFS. And, authentication of a TOR hidden service's public key is made possible by the fact that the public key is encoded in the service's address. This is why onion services have addresses like nytimesn7cgmftshazwhfgzm37qxb44r64ytbb2dj3x62d2lljsciiyd.onion instead of nytimes.com. See https://community.torproject.org/onion-services/overview/ for more info.