Does Tor use Ephemeral DH, Static DH or Anonymous DH? I have heard that the latter two are not secure so I am worried if Tor uses them.

2 Answers 2


Tor has had perfect forward secrecy since The Second-Generation Onion Router published in May 2004.

4.1 Cells

Onion routers communicate with one another, and with users' OPs, via TLS connections with ephemeral keys. Using TLS conceals the data on the connection with perfect forward secrecy, and prevents an attacker from modifying data on the wire or impersonating an OR.

Furthermore, from the chapter 7 Attacks and Defenses; Active attacks:

-- An attacker who learns an OR's TLS private key can impersonate that OR for the TLS key's lifetime, but he must also learn the onion key to decrypt create cells (and because of perfect forward secrecy, he cannot hijack already established circuits without also compromising their session keys). Periodic key rotation limits the window of opportunity for these attacks. --


Ephemeral DH, fixed DH, and anonymous DH are variations of DH. Anonymous DH is not recommended, because it does not provide the client with a way of authenticating the server's public key. Fixed DH is not recommended, because it does not provide perfect forward secrecy (PFS). See https://wiki.openssl.org/index.php/Diffie_Hellman for more info.

As pointed out by @EsaJokinen above, TOR protocol supports PFS. And, authentication of a TOR hidden service's public key is made possible by the fact that the public key is encoded in the service's address. This is why onion services have addresses like nytimesn7cgmftshazwhfgzm37qxb44r64ytbb2dj3x62d2lljsciiyd.onion instead of nytimes.com. See https://community.torproject.org/onion-services/overview/ for more info.

  • Am I correct that exchanging public key of a server is easier in hidden service than on clear-net sites? since the public key of hidden sites are encoded in its address while the public key of clear-net sites are stored in directories.
    – Gaai Chia
    Commented Mar 12, 2022 at 13:55
  • Yes. In previous versions, the address was a hash of the public key. But, in v3, the hidden service address contains the service's full ed25519 public key. See blog.torproject.org/v3-onion-services-usage for more info.
    – mti2935
    Commented Mar 12, 2022 at 15:24

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .