I'm curious how, in onion routing, the relay nodes identify which node to forward the message to? From my understanding the message must travel a specific path based on the keys the user has. I don't understand how the nodes understand how to relay the message both in the request path and in the response path. Explanations I've seen at my level seem to abstract this part away.
My guess is that information pertaining to the nodes adjacent to a relay node is understandable despite the encryption? For example, assuming 3 relay nodes, in the request relay node 2 receives M' = E2(E3(M)), can find M'' = E3(M), and there is some information readable to the node in M'' to tell it that it must go to node 3?
In other words, the initial encryption when the message is sent off looks more like H1||E1(H2||E2(H3||E3(M))), where each H_N is readable by node N and contains information about the next node.
But I assume this isn't correct because it only makes sense when the sender (client) can add all the headers, I don't know how it would work in the response.