In this lecture we’ll dive deeper into how Onion Routing and Tor work.
In the last lecture, we've learned that in order to remain anonymous, the Tor client will bounce the data
through three different servers or Tor relays and the last relay will connect to the Internet
server, lets say to a Web site on your behalf.
It's like a proxy. When building a Tor circuit the first relay is called the “Entry Guard” and
the last relay in the circuit
is the “exit relay”
that sends the traffic out onto the public Internet.
Let's open the Tor browser and connect to Google.
Don't worry for the moment about how to get the Tor browser, because I'll show you how to install
and use it in the next lectures.
So I'm connecting to Google.com.
This is Google and I'm connecting to it through the Tor Network. To see the circuit that Tor Browser
is using for the current tab go to the site information menu, in the URL bar.
This is the Tor circuit!
Pay special attention to the Tor
relays.
Note that they are three.
My browser has connected to the Guard relay that is located in Ukraine.
The middle relay is in the United Kingdom.
And the exit relay in France; and the exit relay has connected on my behalf to Google.com.
Let's take a deeper dive into how Tor works.
The first step in building a Tor connection is the Tor browser or client to download a list of Tor
notes, servers or relays from unknown directory server.
Each tor client selects a few relays, at random, to use as entry points and uses only those relays for
the first hop, which is normal Tor behavior.
So the first relay in your circuit is called an "entry guard" and it’s a fast and stable relay that remains
the first one in your circuit for 2-3 months in order to protect against a known anonymity-breaking
attack.
The rest of your circuit changes with every new Web site you visit
and together, all of these relays will provide the full privacy protection of Tor.
Now, instead of taking a direct route from source to destination, like in the case of a normal Internet
routing, data packets on the Tor network take a random pathway through several relays and no observer,
at any single point, can tell where the data came from, or where it is going to.
To create a private network pathway within the Tor network, the Tor client builds a secret
of encrypted connections through three different relays.
The client will negotiate a symmetric encryption key with each
relay
so there are three encryption keys.
The client will encrypt the message three times, in layers, with these three encryption keys.
It will first encrypt the message with K3, the resulting encrypted message will be encrypted again with
K2
and finally again with K1. It's like the layers of an onion and the message resides at the heart
of the onion. Let's
see what that means!
When the message leaves the Tor client, it has been encrypted three times; the outer layer being
encrypted with K1, and that means that the first relay, the guard relay can unlock the first layer of
encryption because it has the key.
The guard relay has the key named K1.
Note that the guard relay cannot read the message because it’s still encrypted twice (with k2 and
k3). It’s complete gibberish for it.
What can it do is forward the message to the middle relay, which has K2, and can decrypt the second
layer.
The middle relay cannot look at the message because it’s still encrypted with k3 and it doesn’t have
the key.
The middle relay will forward
the message to the last relay, called the exit relay, which in turn will decrypt the last layer with
K3 and get the original message.
So the final relay knows the destination like say twitter.com and forwards the packet to a that server.
Note that the data in the packet could still be encrypted
if the protocol was https or unencrypted, if the protocol was http.
The server receives the message and responds back.
Now, on the way back, the exact reverse process happens.
The first relay, which was the exit relay, gets the normal message, encrypts it with K3 and then
forwards it to the middle relay, which encrypts it with K-2 and forwards it to the last relay, which
in turn encrypts the message with K1 and sands it to the client.
This one has all three keys and can unlook all three layers of encryption and get the original
message,
the response from the server.
And now comes something important!
The Tor circuit is extended one hop at a time, and each relay along the way
knows only which relay gave it data and which relay it is giving data to
So a relay knows only its direct neighbors.
No individual relay ever knows the complete path that a data packet has taken because each relay sees
no more than one hop in the circuit,
neither an eavesdropper nor a compromised relay can use traffic analysis to link the connection's source
and destination.
In this example, if for example the middle relay gets compromised, it doesn’t know the identity
of the source nor the destination server.
It only knows that it has received the message from the entry guard and that it has to forward
the message to the exit relay.
If we continue with the analogy, the Guardia Node only knows that the client is using Tor and the Exit
Node only knows that someone which is anonymous is visiting
twitter.com. The exit node doesn't knows the identity of the source.
It only knows the next hop to the Tor client.
This is the Tor browser; if you connect to different websites
then a new Tor Circuit for each website will be created.
But connections to a single website address will be made over the same Tor circuit, meaning you can
browse different pages of a single website, in separate tabs or windows, without any loss of functionality.
Let's take a look at that!
Using the Tor browser, I'm connecting to Twitter.com.
This is the circuit:
Ukraine, Netherlands, Germany, and twitter.com.
And I'll click on a link on this Web page.
So, in fact, I am opening a new Web page from the same domain.
It's the same circuit.
This browser: Ukraine, Netherlands, Germany, and twitter.com.
And here the same.
But if I'm connecting to another server, let's say Facebook.com,
a new circuit will be created.
you see, it's another circuit!
And for efficiency, the Tor client uses the same circuit for connections that happen within the same
10 minutes period of time.
Later, requests are given a new circuit to keep people from linking someone's earlier actions to the
new ones.
Also, note that Tor only works for TCP streams and can be used by any application with SOCKS support.
One drawback of using Tor is that because of these relays, it's much slower than a normal Internet
connection or even a VPN.
Just consider that the Tor
notes are run by volunteers and might be serving lots of clients at once.
And also consider that they may be not be geographically located nearby.
Maybe a Tor client from Germany is connected to a server located in Romania, going through a relay from South
Korea,
and another one located in Canada.
So the packets will make large global hops.
OK, that's all!
Now you have a deep understanding of how onion routing and the particular implementation called Tor
work.