Which Tor Node Decrypts the Innermost Layer?

In the Tor network, the exit node is the specific relay responsible for decrypting the innermost layer of encryption. Tor protects user privacy through a technique known as onion routing, where data is wrapped in multiple layers of cryptographic security before transmission. While each node along the circuit peels away a specific layer of encryption to determine the next hop, only the exit node removes the final, innermost layer to reveal the original payload and deliver it to the intended destination server.

How Tor’s Multi-Layered Encryption Works

When a user initiates a connection through Tor, the local Tor client builds a three-hop circuit comprising an entry (guard) node, a middle relay, and an exit node. The client negotiates a distinct cryptographic key with each of these three relays:

1. The Outer Layer: Encrypted using the entry node’s key.
2. The Middle Layer: Encrypted using the middle node’s key.
3. The Innermost Layer: Encrypted using the exit node’s key.

The data packet is packaged in reverse order, meaning the innermost layer is applied first using the exit node’s key, followed by the middle layer, and finally the outer layer.

The Step-by-Step Decryption Process

As the data packet moves through the Tor circuit, each node performs a specific decryption task:

• Entry Node (Guard): Receives the packet directly from the user. It uses its key to decrypt the outermost layer, revealing only the IP address of the middle relay. It forwards the remaining encrypted packet to the middle node.
• Middle Node (Relay): Receives the packet from the guard node. It uses its key to decrypt the middle layer of encryption, revealing only the IP address of the exit node. It cannot see the original user’s IP or the payload contents.
• Exit Node: Receives the packet from the middle relay. It uses its key to decrypt the innermost layer of Tor encryption. This step strips away the final layer of routing encryption, revealing the raw destination address and the original data packet.

Privacy and Security Implications of the Exit Node

Because the exit node decrypts the innermost layer of Tor routing encryption, it has a unique visibility profile compared to the other relays in the circuit:

• What the Exit Node Sees: The exit node can see the destination IP address and the payload of the traffic. If the traffic is unencrypted (e.g., standard HTTP), the exit node can view the plain text data.
• What the Exit Node Cannot See: The exit node has no visibility into the original sender’s IP address. It only knows that the traffic originated from the middle relay.
• End-to-End Encryption: If the user connects to a secure website using HTTPS, the exit node only decrypts the Tor layer. The underlying payload remains protected by Transport Layer Security (TLS), preventing the exit node operator from intercepting sensitive credentials or message contents.