Cryptographic Upgrades in Tor V3 Onion Addresses

Tor Version 3 (v3) onion services represent a complete cryptographic overhaul designed to replace the obsolete security foundations of the legacy v2 protocol. By transitioning away from vulnerable 1024-bit RSA keys and SHA-1 hashing, the v3 specification implements modern primitives such as Ed25519 public-key cryptography, SHA-3, and key blinding. These advancements resolve structural vulnerabilities, prevent address enumeration by malicious relays, and provide stronger forward secrecy across the Tor network.

Transition to Ed25519 Public Keys

The legacy v2 protocol relied on 1024-bit RSA keys, which had become cryptographically weak and susceptible to brute-force factoring attacks. Tor v3 replaces RSA with Ed25519, an elliptic-curve signing algorithm based on Curve25519.

Ed25519 offers a significantly higher security level—roughly equivalent to 3072-bit RSA—while utilizing smaller, 256-bit keys. This shift improves signing performance, reduces memory overhead, and allows public keys to be directly encoded into onion addresses.

Upgraded Hashing with SHA-3 and SHAKE-256

Tor v3 eliminates dependencies on legacy hashing algorithms like MD5 and SHA-1, both of which suffer from known collision vulnerabilities.

The new architecture integrates the Keccak-based SHA-3 family, specifically utilizing SHAKE-256 as an extendable-output function (XOF), alongside SHA-256. These hashing primitives are used throughout the protocol for address generation, checksum verification, and internal key derivation, ensuring robust resistance to collision and preimage attacks.

Key Blinding and Directory Privacy

A critical flaw in the v2 protocol was that hidden service directory (HSDir) relays could harvest .onion addresses by inspecting stored service descriptors.

Tor v3 introduces a cryptographic key-blinding scheme. Onion services use their master Ed25519 identity key and the current time period to compute a daily “blinded” public key. Descriptors are published and indexed under this blinded key. As a result:

• HSDir nodes cannot deduce the actual onion address from the descriptors they host.
• Only clients that already know the original onion address can perform the mathematical derivation required to find and decrypt the descriptor.
• Address enumeration and unauthorized indexing across the network are completely mitigated.

Self-Authenticating 56-Character Addresses

The visible change from 16-character (v2) to 56-character (v3) addresses is a direct result of cryptographic improvements. A v3 address is a Base32 encoding that contains:

1. The entire 32-byte Ed25519 public key.
2. A 2-byte checksum to prevent typos.
3. A 1-byte version identifier.

Embedding the full public key directly into the address removes the need for clients to verify initial keys against a third party, ensuring full end-to-end authentication without trusted intermediaries.

Enhanced Circuit Handshakes and Forward Secrecy

Tor v3 standardizes the use of the ntor handshake protocol across all hidden service connections, replacing older, RSA-based handshake mechanisms. Combined with ephemeral Curve25519 Diffie-Hellman key exchanges during the rendezvous process, v3 ensures that intercepted session traffic cannot be decrypted retroactively, even if a service’s long-term identity keys are compromised in the future.