Why Is Tor Called an Onion Router?

The name “onion router” originates from the core security mechanism powering the network: layered encryption. In the Tor network—short for “The Onion Router”—data is wrapped in multiple layers of cryptographic protection, closely resembling the physical layers of an onion. As data travels through a sequence of volunteer-operated servers, each intermediate server peels away a single layer of encryption to reveal only the necessary routing instructions for the next hop, ensuring the sender, receiver, and data payload remain anonymous.

The Origin of the Name

The concept of onion routing was initially developed in the mid-1990s by mathematician Paul Syverson and computer scientists Michael G. Reed and David Goldschlag at the U.S. Naval Research Laboratory. The goal was to create a system that would allow intelligence communications to traverse the internet without revealing the identity or location of the sender. The layered cryptographic structure they designed naturally led to the name “Onion Routing,” which later became the Tor Project.

How Layered Encryption Works

When a user transmits information through the Tor network, the client software automatically selects a path consisting of three distinct nodes (relays): the Entry (Guard) node, the Middle node, and the Exit node.

Before the data leaves the user’s device, the Tor client encrypts the message three times using the public keys of all three nodes:

1. Outer Layer: Encrypted with the Entry node’s key.
2. Middle Layer: Encrypted with the Middle node’s key.
3. Inner Layer: Encrypted with the Exit node’s key.

The “Peeling” Process

As the data packet moves through the Tor circuit, each node performs a specific, isolated task:

• The Entry Node: Receives the fully encrypted packet from the user. It uses its private key to peel off the outermost layer. This reveals the address of the Middle node. The Entry node knows the user’s original IP address, but it cannot read the actual message or see the final destination.
• The Middle Node: Receives the packet from the Entry node and removes the second layer of encryption using its own private key. This reveals the address of the Exit node. The Middle node knows neither the sender’s IP address nor the final destination.
• The Exit Node: Receives the packet, decrypts the final layer, and reads the destination address. It then forwards the original, unencrypted request (or HTTPS request) to the destination website. The Exit node knows the destination and the content (if not using HTTPS), but it has no knowledge of the original sender’s IP address.

The Privacy Advantage

The onion model ensures that no single server along the route ever possesses complete information about the communication. An attacker who compromises a single node cannot trace the connection from end to end because no individual relay knows both where the traffic came from and where it is ultimately going. This layered, peel-by-peel architecture is why the technology is known as onion routing.