What Are Rendezvous Points in Tor Hidden Services?

In the Tor network, a rendezvous point is an intermediate relay chosen by a client to facilitate anonymous, end-to-end communication with an onion service (hidden service). Rendezvous points allow a user and a hidden service to connect and transfer data securely without revealing their physical locations, IP addresses, or network identities to each other or to the relay itself.

The Role of a Rendezvous Point

Traditional internet connections require the client to know the server’s IP address to send requests. Tor hidden services eliminate this requirement by using internal circuit routing. Because both the user and the service operator wish to remain anonymous, they cannot connect directly. Instead, they meet at a neutral, mutually agreed-upon relay: the rendezvous point.

The rendezvous point bridges two separate multi-hop Tor circuits—one originating from the client and the other from the hidden service—joining them into a single, functional data stream.

How the Rendezvous Process Works

Establishing a connection through a rendezvous point follows a structured multi-step process:

1. Client Rendezvous Selection: When a user requests access to an .onion address, the client first builds a three-hop Tor circuit to a randomly selected relay and asks it to act as the rendezvous point. The client gives this relay a one-time secret phrase (rendezvous cookie).
2. Introduction: The client creates a second Tor circuit to one of the service’s pre-published introduction points. It sends an encrypted introduction message containing the address of the chosen rendezvous point and the one-time secret.
3. Service Connection: The hidden service decrypts the message, recognizes the request, and builds its own three-hop circuit to the specified rendezvous point.
4. Verification and Bridging: The hidden service presents the one-time secret to the rendezvous point to verify its identity. The rendezvous point then connects the client’s circuit to the service’s circuit.
5. Direct End-to-End Communication: Once connected, the rendezvous point forwards encrypted traffic back and forth between the two circuits.

Key Security Characteristics

• Mutual Anonymity: The client builds a three-hop circuit to the rendezvous point, and the service builds a three-hop circuit to the same point. As a result, the total path consists of six intermediary relays, preventing either party from uncovering the other’s IP address.
• Zero-Knowledge Relay: The rendezvous point only sees encrypted packets passing between two Tor circuits. It does not know the identity of the client, the identity of the hidden service, or the contents of the payload.
• Ephemeral Operations: Rendezvous points are chosen dynamically per session. If a connection closes or fails, new rendezvous points are selected, preventing long-term traffic analysis on a single static node.