How Tor Works: The Basics of Onion Routing

The Tor network, short for The Onion Router, is an open-source privacy network designed to anonymize internet traffic and protect users from network surveillance and traffic analysis. This article explains how Tor functions on a fundamental level, detailing its multi-layered encryption model, the dynamic establishment of three-node circuits, and the distinct roles played by entry, middle, and exit relays to decouple a user’s identity from their online activity.

The Principle of Onion Routing

At the core of Tor is the concept of onion routing. Instead of transmitting data directly between a client (your computer) and a destination server (a website), Tor routes traffic through a series of volunteer-operated servers known as nodes or relays.

Before transmission, the Tor client wraps the data packet in multiple layers of encryption—resembling the layers of an onion. Each layer corresponds to a specific node along the path and can only be decrypted by that designated node using cryptographic keys negotiated specifically for that session.

The Three-Node Circuit

To achieve anonymity, Tor routes every connection through a path composed of three distinct nodes:

1. The Entry (Guard) Node: The first stop in the circuit. The entry node receives the packet directly from the user and knows the user’s real IP address. It removes the outer layer of encryption, which reveals the address of the next node, and forwards the packet. The guard node cannot read the original data payload or identify the final destination.
2. The Middle Relay: The second stop. This node receives the data, strips away the second layer of encryption, and learns the address of the exit node. It neither knows the origin IP address nor the final destination, acting as a buffer to prevent the entry and exit nodes from colluding.
3. The Exit Node: The final relay in the Tor circuit. The exit node removes the last layer of encryption to reveal the destination IP address and sends the request to the target server. The target server sees the request as coming from the exit node’s IP address rather than the user’s actual IP address.

Circuit Creation and Key Exchange

Tor relies on directory authorities—trusted servers that maintain an up-to-date consensus of all active relays and their public keys.

When a user initiates a connection, the Tor client queries this directory and selects an entry, middle, and exit node. Using the Diffie-Hellman key exchange protocol, the client establishes separate, unique encryption keys with each node in the path iteratively:

• The client first negotiates a session key with the Entry node.
• It extends the circuit through the Entry node to negotiate a session key with the Middle node.
• It extends the circuit through the Middle node to negotiate a session key with the Exit node.

Because these keys are negotiated incrementally, no individual node ever possesses the complete set of keys or the full map of the circuit.

Anonymity Versus End-to-End Encryption

Tor provides anonymity (hiding who is communicating), but it does not inherently provide end-to-end data security. Because the exit node strips the final Tor encryption layer, it can view the raw transmitted data if the underlying connection is not encrypted.

If a user connects to a standard http:// website, the exit node can inspect the payload. However, if the user connects to a secure https:// website, Transport Layer Security (TLS) protects the payload from the client directly to the destination server, ensuring both privacy from the Tor exit node and anonymity from the destination server.