What Encryption Does Tor Use?

The Tor network protects internet traffic by utilizing a layered cryptographic design known as onion routing. This article explores the specific encryption methods Tor uses for data transmission, detailing the asymmetric key exchanges, symmetric data encryption, and transport-level security protocols that together prevent eavesdropping, traffic analysis, and unauthorized tracking.

Multi-Layered Onion Encryption

Tor secures data by wrapping it in three distinct layers of encryption, one for each node in a standard Tor circuit: the Guard (Entry) relay, the Middle relay, and the Exit relay.

As data leaves the user’s device: 1. The client encrypts the payload using the Exit node’s session key. 2. The client encrypts that package using the Middle node’s session key. 3. The client encrypts the entire bundle again using the Guard node’s session key.

Each node removes only its designated outer layer of encryption to discover where to forward the packet next, ensuring no single relay knows both the origin and the final destination of the traffic.

Symmetric Payload Encryption (AES)

For the actual transmission of data payloads, Tor primarily relies on the Advanced Encryption Standard (AES) in Counter (CTR) mode with 128-bit or 256-bit keys. Modern versions of the Tor protocol also support authenticated symmetric ciphers, such as ChaCha20-Poly1305.

Symmetric encryption is used here because it is computationally efficient and fast enough to handle continuous streams of network data without introducing severe latency.

Key Exchange and Asymmetric Cryptography

Before transmitting data, Tor establishes unique, temporary session keys with each relay via an asymmetric cryptographic handshake known as the “ntor” handshake.

Key elements of this process include: * Curve25519 / Diffie-Hellman: Used for ephemeral key exchange, allowing the client and relays to compute shared symmetric keys securely over an untrusted network. * Perfect Forward Secrecy (PFS): Session keys are temporary. Even if a node’s long-term identity keys are compromised in the future, past encrypted sessions cannot be retroactively decrypted. * Ed25519 and RSA: Relays maintain long-term identity keys (Ed25519 in modern relays, RSA-1024/2048 historically) to authenticate themselves to the client, preventing Man-in-the-Middle (MITM) attacks.

Transport Layer Security (TLS)

All communication links between adjacent Tor relays—and between the client and the Guard relay—are encapsulated within standard Transport Layer Security (TLS) tunnels.

TLS provides an additional layer of link-level encryption that hides the Tor packet structure from internet service providers (ISPs) and network snoopers. It also normalizes traffic patterns to look like regular secure web traffic.

End-to-End Encryption Considerations

Tor only encrypts traffic within the boundaries of the Tor network. When the data leaves the Exit relay to reach a standard web server, the final layer of onion encryption is stripped away. To ensure end-to-end confidentiality between the user and the destination server, users must rely on higher-level protocols like HTTPS (TLS), which keeps the underlying data encrypted even after it departs the Tor Exit node.