4

I've been studying how Tor works - including the great QA "Why can a Tor exit node decrypt data, but not the entry node?".

I understand the concept of onion routing and multiple layers of encryption. My question is specifically how are the keys exchanged securely so the circuits can be built? This is touched on in that question but not actually answered.

It seems that you wouldn't want a bridge node to pass back the public key for an exit node since it would be easy to fake and break the anonymity.

Can you just assume that the public keys and IPs are listed in a directory and that they are picked from there? When I get privacy related questions like this I really don't want to hand wave away the details.

Community
  • 1
Tim Brigham
  • 3,782
  • 3
  • 30
  • 36
  • Union routing. That's why US Postal Service goes postal. – Deer Hunter Aug 20 '13 at 16:10
  • OP, are you looking for detailed explaining how the whole process happens (building the circuit and exchanging the keys) and what makes it secure? If yes, I might put some time to write a big one. – Adi Aug 23 '13 at 08:12
  • @Adnan not the circuit building so much - the post I linked to does a good job with that - but some additional details on how the key exchange process works would be much appreciated. – Tim Brigham Aug 23 '13 at 13:02

2 Answers2

3

Per the Wiki (emphasis mine):

To create and transmit an onion, the following steps are taken:

  1. The originator picks nodes from a list provided by a special node called the directory node (traffic between the originator and the directory node may also be encrypted or otherwise anonymised or decentralised); the chosen nodes are ordered to provide a path through which the message may be transmitted; this ordering of the nodes is called a chain or a circuit. No node within the circuit, except for the exit node, can infer where in the chain it is located, and no node can tell whether the node before it is the originator or how many nodes are in the circuit.

  2. Using asymmetric key cryptography, the originator uses the public key (obtained from the directory) of the first node in the circuit, known as the entry node, to send it an encrypted message, called a create cell,

The rest of the article appears to omit how the public keys for relay nodes are obtained. However, since the selection of all nodes for a given chain is done from the directory node, I'm pretty sure all public keys are taken from the directory node. Therefore the directory node (and your connection to it) must be trusted if you are to trust the public keys of any of the nodes in your Tor chain.

Iszi
  • 27,127
  • 18
  • 101
  • 163
1

It is explained formally in this paper.

  1. First the Tor Client (Alice) negotiates a symmetric key with the first relay (Bob).

  2. Then, it uses its encrypted connection and asks the first relay to extend its circuit to another relay (Carol) and create another symmetric key for Alice and Carol.

  3. Similarly, it can be extended to any number of relays.

A user's OP constructs circuits incrementally, negotiating a symmetric key with each OR on the circuit, one hop at a time. To begin creating a new circuit, the OP (call her Alice) sends a create cell to the first node in her chosen path (call him Bob). (She chooses a new circID C_AB not currently used on the connection from her to Bob.) The create cell's payload contains the first half of the Diffie-Hellman handshake (g^x), encrypted to the onion key of Bob. Bob responds with a created cell containing g^y along with a hash of the negotiated key K=g^(xy).

Once the circuit has been established, Alice and Bob can send one another relay cells encrypted with the negotiated key.

To extend the circuit further, Alice sends a relay extend cell to Bob, specifying the address of the next OR (call her Carol), and an encrypted g^x_2 for her. Bob copies the half-handshake into a create cell, and passes it to Carol to extend the circuit. (Bob chooses a new circID CBC not currently used on the connection between him and Carol. Alice never needs to know this circID; only Bob associates C_AB on his connection with Alice to C_BC on his connection with Carol.) When Carol responds with a created cell, Bob wraps the payload into a relay extended cell and passes it back to Alice. Now the circuit is extended to Carol, and Alice and Carol share a common key K_2 = g^(x_2*y_2).

Mohsenasm
  • 111
  • 3