How Tor Routes Traffic to Hidden Services Without an IP

Tor routes traffic to hidden services (officially called Onion Services) without exposing IP addresses through a multi-step cryptographic handshake involving Introduction Points and Rendezvous Points. Instead of resolving a domain name to a physical IP address via standard DNS, Tor uses public-key cryptography to verify identity and relies on temporary, multi-hop relay circuits to bridge the client and the service anonymously.

1. Cryptographic Identity and the Onion Address

An Onion Service does not rely on a traditional domain registrar or IP address. Instead, its .onion address is a cryptographic hash derived directly from the service’s public key. This public key acts as the service’s permanent, verifiable identity.

2. Setting Up Introduction Points

When an Onion Service starts, it selects several random Tor relays to act as its Introduction Points. * The service builds standard, encrypted three-hop Tor circuits to each of these relays. * It tells these relays to listen for incoming connection requests intended for its public key. * The Introduction Points only know their end of the circuit; they do not know the real IP address of the service.

3. Publishing the Service Descriptor

The service creates a signed data packet called an Onion Descriptor. This descriptor contains: * The service’s public key. * The list of its chosen Introduction Points.

The service then publishes this descriptor to Tor’s distributed hash table (DHT), known as the Hidden Service Directory (HSDir).

4. Client Fetches the Descriptor and Sets Up a Rendezvous Point

When a user attempts to access a .onion address: 1. The client looks up the address in the DHT and downloads the service’s Onion Descriptor. 2. The client selects a random Tor relay to act as a Rendezvous Point (RP) and builds a three-hop circuit to it. 3. The client gives the Rendezvous Point a randomly generated, single-use authorization token (a “cookie”).

5. Establishing the Introduction

To notify the hidden service: 1. The client builds an encrypted circuit to one of the Introduction Points listed in the descriptor. 2. The client sends a message containing the address of its chosen Rendezvous Point and the authorization cookie. This entire message is encrypted with the hidden service’s public key. 3. The Introduction Point forwards this encrypted payload to the hidden service without being able to read its contents.

6. Bridging the Connection

  1. The hidden service decrypts the message using its private key, learning the location of the Rendezvous Point and the cookie.
  2. The service builds its own three-hop Tor circuit to that Rendezvous Point and presents the cookie.
  3. The Rendezvous Point matches the cookie from the service with the cookie from the client and bridges the two separate three-hop circuits together.

Traffic flows through a complete six-hop circuit: three hops from the client to the Rendezvous Point, and three hops from the Rendezvous Point to the hidden service. As a result, the client and the service communicate securely, neither knowing the other’s IP address.