Why Tor Middle Relays Prevent Linkability

The Tor network relies on a three-hop circuit architecture consisting of a guard node, a middle relay, and an exit node to guarantee user anonymity. While the guard node knows the origin of the traffic and the exit node knows its destination, neither possesses the complete picture. The middle relay serves as the indispensable structural barrier between these two endpoints, preventing direct communication, collusion, and traffic linkability between the user’s identity and their online activity.

The Problem with a Two-Hop Circuit

To understand the importance of the middle relay, consider a simplified two-hop design consisting only of a guard and an exit node. In this scenario, the guard node directly connects to the exit node.

If an adversary operates or monitors both the guard and the exit node, confirming the connection between a specific user and their destination becomes trivial. Because the guard sends packets directly to the exit, both nodes share a direct socket connection and identical circuit identifiers. The exit node immediately knows which guard node sent the traffic, making correlation nearly instantaneous.

The Separation of Knowledge

The introduction of the middle relay establishes a strict separation of knowledge across the circuit. Each node in a standard three-hop circuit only knows the identities of its immediate predecessor and successor:

• Guard Node: Knows the client’s real IP address and the middle relay’s IP address. It does not know the exit node or the final destination.
• Middle Relay: Knows the guard node’s IP address and the exit node’s IP address. It has no knowledge of the client’s real IP address or the final destination.
• Exit Node: Knows the middle relay’s IP address and the final destination. It has no knowledge of the client’s real IP address or the guard node.

By positioning the middle relay between the guard and exit, the network ensures that the node that knows who you are (the guard) never communicates directly with the node that knows what you are doing (the exit).

Mitigating Collusion and Correlation

Breaking linkability requires defense against adversarial collusion. In the Tor network, thousands of relays operate simultaneously. If a malicious entity controls both the guard node and the exit node used in a single circuit, they still cannot immediately link the traffic.

The exit node cannot determine which guard node forwarded the data because all traffic arrives from an intermediate middle relay. Without direct communication between the guard and exit, adversaries must resort to complex, statistical traffic-analysis attacks (such as packet timing and volume correlation) across thousands of active relays, rather than relying on a direct metadata trace.

Preserving Layered Encryption

The middle relay enforces the integrity of onion routing. Tor encrypts data in three distinct cryptographic layers. The middle relay decrypts the intermediate layer to read routing instructions that tell it which exit node to forward the payload to. It cannot read the underlying plaintext payload or access the outer layer containing the client’s information.

By functioning as a blind forwarding agent, the middle relay breaks the end-to-end chain of custody, ensuring that no single entity—nor a simple pairing of guard and exit nodes—can inherently link a user to their internet traffic.