Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I recently started thinking about using TOR, but had a few questions first.

  1. What type of encryption is used by TOR?
  2. Is this encryption dynamic or static?
  3. Does ISP know the URL being visited?
share|improve this question

closed as not a real question by Nifle, Dave M, 8088, Baarn, Breakthrough Mar 8 '13 at 13:13

It's difficult to tell what is being asked here. This question is ambiguous, vague, incomplete, overly broad, or rhetorical and cannot be reasonably answered in its current form. For help clarifying this question so that it can be reopened, visit the help center.If this question can be reworded to fit the rules in the help center, please edit the question.

You should take a look at this post: superuser.com/questions/165454/… –  Jasjeev Singh Feb 13 '13 at 8:46
I have already seen that,that link answers only partly –  Ashni Goyal Feb 13 '13 at 9:03
Question 3 is answered by the TOR documentation. You could at least read it. –  Hennes Feb 14 '13 at 7:42

1 Answer 1

up vote 2 down vote accepted

You can read all about the various types of encryption used on the TOR website:

Tor uses a variety of different keys, with three goals in mind: 1) encryption to ensure privacy of data within the Tor network, 2) authentication so clients know they're talking to the relays they meant to talk to, and 3) signatures to make sure all clients know the same set of relays.

Encryption: first, all connections in Tor use TLS link encryption, so observers can't look inside to see which circuit a given cell is intended for. Further, the Tor client establishes an ephemeral encryption key with each relay in the circuit; these extra layers of encryption mean that only the exit relay can read the cells. Both sides discard the circuit key when the circuit ends, so logging traffic and then breaking into the relay to discover the key won't work.

Authentication: Every Tor relay has a public decryption key called the "onion key". Each relay rotates its onion key once a week. When the Tor client establishes circuits, at each step it demands that the Tor relay prove knowledge of its onion key. That way the first node in the path can't just spoof the rest of the path. Because the Tor client chooses the path, it can make sure to get Tor's "distributed trust" property: no single relay in the path can know about both the client and what the client is doing.

Coordination: How do clients know what the relays are, and how do they know that they have the right keys for them? Each relay has a long-term public signing key called the "identity key". Each directory authority additionally has a "directory signing key". The directory authorities provide a signed list of all the known relays, and in that list are a set of certificates from each relay (self-signed by their identity key) specifying their keys, locations, exit policies, and so on. So unless the adversary can control a majority of the directory authorities (as of 2012 there are 8 directory authorities), he can't trick the Tor client into using other Tor relays.

And from here:

Each circuit (the multiple encrypted connections your communication makes to various servers along its route) will be used by Tor for ten minutes. After ten minutes, new requests are given a new circuit.

share|improve this answer
Very useful reply. Could yo plz explain "Both sides discard the circuit key when the circuit ends, so logging traffic and then breaking into the relay to discover the key won't work." –  Ashni Goyal Feb 13 '13 at 12:27
It means that even if someone has captured the traffic and identified it as yours, they won't be able to decrypt it after it has happened, because once the connection between the TOR client and the destination server is closed, the encryption key is destroyed and thus no-one in the world can decrypt that traffic anymore. –  Stefan Seidel Feb 13 '13 at 12:45
So the connection between TOR client and destination remains open till I close the website or shut down the TOR ? Or, the connection opens and closes as per some predefined time duration ? –  Ashni Goyal Feb 13 '13 at 13:18
in other words, what defined the end of the circuit ? –  Ashni Goyal Feb 13 '13 at 13:19
*defines (balance of 15 ch) –  Ashni Goyal Feb 13 '13 at 15:40

Not the answer you're looking for? Browse other questions tagged or ask your own question.