Cryptographic Curves Used by the Tor Network

The Tor network relies heavily on modern elliptic-curve cryptography to ensure privacy, forward secrecy, and high performance across its distributed routing protocol. Primarily, Tor utilizes Daniel J. Bernstein’s Curve25519 family of curves—specifically Curve25519 for Diffie-Hellman key exchanges and its Twisted Edwards equivalent, Ed25519, for digital signatures and identity verification. This article breaks down how and where these cryptographic curves are implemented within the Tor ecosystem.

Curve25519 and the ntor Circuit Handshake

The primary cryptographic curve used for building Tor circuits is Curve25519. When a Tor client creates a circuit through guard, middle, and exit relays, it performs a key exchange with each node using the ntor handshake protocol.

The ntor protocol uses Curve25519-based Elliptic-Curve Diffie-Hellman (ECDH). This mechanism replaced the legacy TAP (Tor Authentication Protocol) handshake, which relied on 1024-bit RSA and Diffie-Hellman parameters. Curve25519 provides approximately 128 bits of security, defends against side-channel timing attacks, and significantly reduces circuit creation latency and CPU overhead on relays.

Ed25519 for Relay Identities and Onion Services v3

While Curve25519 handles key agreement, Ed25519 (an Edwards-curve digital signature algorithm based on Curve25519) handles authentication and identity management:

• Next-Generation Onion Services (v3): Version 3 Onion Services derive their 56-character addresses directly from 32-byte Ed25519 public keys. Ed25519 is used to sign service descriptors, compute blinded subkeys to prevent directory enumeration, and verify ownership. Key agreement with the hidden service is then derived using Curve25519.
• Relay Identity Keys: Modern relays use long-term Ed25519 identity keys alongside legacy RSA-1024 keys. These Ed25519 keys sign medium-term circuit-signing keys to authenticate the relay during the ntor handshake.

Link-Layer Cryptography (TLS)

For point-to-point connections between relays, Tor encapsulates traffic inside standard TLS connections. At this transport layer:

• Modern Tor implementations default to negotiating X25519 for TLS key exchanges where supported.
• Depending on the underlying cryptography library (such as OpenSSL) and peer capabilities, standard NIST curves like P-256 (secp256r1) and P-384 (secp384r1) may be negotiated strictly as part of standard TLS ciphersuites.

Why Tor Standardized on Curve25519

Tor explicitly chose Curve25519 and Ed25519 over standard NIST curves (such as P-256) for its internal protocol design. The decision was driven by Curve25519’s immune design against timing and side-channel attacks, its exceptional verification and key generation speed, and complete transparency in its curve parameter selection, avoiding doubts regarding arbitrary constants.