5 Note: This is an attempt to specify Tor as it exists as implemented in
6 early June, 2003. It is not recommended that others implement this
7 design as it stands; future versions of Tor will implement improved
11 - Specify truncate/truncated payloads?
12 - Specify RELAY_END payloads. [It's 1 byte of reason, then X bytes of
14 - Sendme w/stream0 is circuit sendme
15 - Integrate -NM and -RD comments
16 - EXTEND cells should have hostnames or nicknames, so that OPs never
17 resolve OR hostnames. Else DNS servers can give different answers to
18 different OPs, and compromise their anonymity.
21 - Do TCP-style sequencing and ACKing of DATA cells so that we can afford
22 to lose some data cells.
28 K -- a key for a symmetric cypher
30 a|b -- concatenation of 'a' with 'b'.
32 All numeric values are encoded in network (big-endian) order.
34 Unless otherwise specified, all symmetric ciphers are AES in counter
35 mode, with an IV of all 0 bytes. Asymmetric ciphers are either RSA
36 with 1024-bit keys and exponents of 65537, or DH with the safe prime
37 from rfc2409, section 6.2, whose hex representation is:
39 "FFFFFFFFFFFFFFFFC90FDAA22168C234C4C6628B80DC1CD129024E08"
40 "8A67CC74020BBEA63B139B22514A08798E3404DDEF9519B3CD3A431B"
41 "302B0A6DF25F14374FE1356D6D51C245E485B576625E7EC6F44C42E9"
42 "A637ED6B0BFF5CB6F406B7EDEE386BFB5A899FA5AE9F24117C4B1FE6"
43 "49286651ECE65381FFFFFFFFFFFFFFFF"
48 Tor is a connection-oriented anonymizing communication service. Users
49 build a path known as a "virtual circuit" through the network, in which
50 each node knows its predecessor and successor, but no others. Traffic
51 flowing down the circuit is unwrapped by a symmetric key at each node,
52 which reveals the downstream node.
56 There are two ways to connect to an onion router (OR). The first is
57 as an onion proxy (OP), which allows the OP to authenticate the OR
58 without authenticating itself. The second is as another OR, which
59 allows mutual authentication.
61 Tor uses TLS for link encryption, using the cipher suite
62 "TLS_DHE_RSA_WITH_AES_128_CBC_SHA". An OR always sends a
63 self-signed X.509 certificate whose commonName is the server's
64 nickname, and whose public key is in the server directory.
66 All parties receiving certificates must confirm that the public
67 key is as it appears in the server directory, and close the
68 connection if it is not.
70 Once a TLS connection is established, the two sides send cells
71 (specified below) to one another. Cells are sent serially. All
72 cells are 256 bytes long. Cells may be sent embedded in TLS
73 records of any size or divided across TLS records, but the framing
74 of TLS records should not leak information about the type or
75 contents of the cells.
77 OR-to-OR connections are never deliberately closed. An OP should
78 close a connection to an OR if there are no circuits running over
79 the connection, and an amount of time (KeepalivePeriod, defaults to
80 5 minutes) has passed.
84 The basic unit of communication for onion routers and onion
85 proxies is a fixed-width "cell". Each cell contains the following
91 Sequence number (unused, set to 0) [4 bytes]
92 Payload (padded with 0 bytes) [248 bytes]
93 [Total size: 256 bytes]
95 The 'Command' field holds one of the following values:
96 0 -- PADDING (Padding) (See Sec 6.2)
97 1 -- CREATE (Create a circuit) (See Sec 4)
98 2 -- CREATED (Acknowledge create) (See Sec 4)
99 3 -- RELAY (End-to-end data) (See Sec 5)
100 4 -- DESTROY (Stop using a circuit) (See Sec 4)
102 The interpretation of 'Length' and 'Payload' depend on the type of
104 PADDING: Neither field is used.
105 CREATE: Length is 144; the payload contains the first phase of the
107 CREATED: Length is 128; the payload contains the second phase of
109 RELAY: Length is a value between 8 and 248; the first 'length'
110 bytes of payload contain useful data.
111 DESTROY: Neither field is used.
113 Unused fields are filled with 0 bytes. The payload is padded with
116 PADDING cells are currently used to implement connection
117 keepalive. ORs and OPs send one another a PADDING cell every few
120 CREATE and DESTROY cells are used to manage circuits; see section
123 RELAY cells are used to send commands and data along a circuit; see
127 4. Circuit management
129 4.1. CREATE and CREATED cells
131 Users set up circuits incrementally, one hop at a time. To create
132 a new circuit, users send a CREATE cell to the first node, with the
133 first half of the DH handshake; that node responds with a CREATED cell
134 with the second half of the DH handshake. To extend a circuit past
135 the first hop, the user sends an EXTEND relay cell (see section 5)
136 which instructs the last node in the circuit to send a CREATE cell
137 to extend the circuit.
139 The payload for a CREATE cell is an 'onion skin', consisting of:
140 RSA-encrypted data [128 bytes]
141 Symmetrically-encrypted data [16 bytes]
142 The RSA-encrypted portion contains:
143 Symmetric key [16 bytes]
144 First part of DH data (g^x) [112 bytes]
145 The symmetrically encrypted portion contains:
146 Second part of DH data (g^x) [16 bytes]
148 The two parts of the DH data, once decrypted and concatenated, form
149 g^x as calculated by the client.
151 The relay payload for an EXTEND relay cell consists of:
154 Onion skin [144 bytes]
156 The port and address field denote the IPV4 address and port of the
157 next onion router in the circuit.
159 4.2. Setting circuit keys
161 Once the handshake between the OP and an OR is completed, both
162 servers can now calculate g^xy with ordinary DH. From the base key
163 material g^xy, they compute two 16 byte keys, called Kf and Kb as
164 follows. First, the server represents g^xy as a big-endian
165 unsigned integer. Next, the server computes 40 bytes of key data
166 as K = SHA1(g^xy | [00]) | SHA1(g^xy | [01]) where "00" is a single
167 octet whose value is zero, and "01" is a single octet whose value
168 is one. The first 16 bytes of K form Kf, and the next 16 bytes of
171 Kf is used to encrypt the stream of data going from the OP to the
172 OR, whereas Kb is used to encrypt the stream of data going from the
175 4.3. Creating circuits
177 When creating a circuit through the network, the circuit creator
178 performs the following steps:
180 1. Choose a chain of N onion routers (R_1...R_N) to constitute
181 the path, such that no router appears in the path twice.
182 [this is wrong, see October 2003 discussion on or-dev]
184 2. If not already connected to the first router in the chain,
185 open a new connection to that router.
187 3. Choose a circID not already in use on the connection with the
188 first router in the chain. If we are an onion router and our
189 nickname is lexicographically greater than the nickname of the
190 other side, then let the high bit of the circID be 1, else 0.
192 4. Send a CREATE cell along the connection, to be received by
193 the first onion router.
195 5. Wait until a CREATED cell is received; finish the handshake
196 and extract the forward key Kf_1 and the back key Kb_1.
198 6. For each subsequent onion router R (R_2 through R_N), extend
201 To extend the circuit by a single onion router R_M, the circuit
202 creator performs these steps:
204 1. Create an onion skin, encrypting the RSA-encrypted part with
207 2. Encrypt and send the onion skin in a relay EXTEND cell along
208 the circuit (see section 5).
210 3. When a relay EXTENDED cell is received, calculate the shared
211 keys. The circuit is now extended.
213 When an onion router receives an EXTEND relay cell, it sends a
214 CREATE cell to the next onion router, with the enclosed onion skin
215 as its payload. The initiating onion router chooses some circID not
216 yet used on the connection between the two onion routers. (But see
217 section 4.3. above, concerning choosing circIDs.)
219 As an extension (called router twins), if the desired next onion
220 router R in the circuit is down, and some other onion router R'
221 has the same key as R, then it's ok to extend to R' rather than R.
223 When an onion router receives a CREATE cell, if it already has a
224 circuit on the given connection with the given circID, it drops the
225 cell. Otherwise, sometime after receiving the CREATE cell, it completes
226 the DH handshake, and replies with a CREATED cell, containing g^y
227 as its [128 byte] payload. Upon receiving a CREATED cell, an onion
228 router packs it payload into an EXTENDED relay cell (see section 5),
229 and sends that cell up the circuit. Upon receiving the EXTENDED
230 relay cell, the OP can retrieve g^y.
232 (As an optimization, OR implementations may delay processing onions
233 until a break in traffic allows time to do so without harming
234 network latency too greatly.)
236 4.4. Tearing down circuits
238 Circuits are torn down when an unrecoverable error occurs along
239 the circuit, or when all streams on a circuit are closed and the
240 circuit's intended lifetime is over. Circuits may be torn down
241 either completely or hop-by-hop.
243 To tear down a circuit completely, an OR or OP sends a DESTROY
244 cell to the adjacent nodes on that circuit, using the appropriate
247 Upon receiving an outgoing DESTROY cell, an OR frees resources
248 associated with the corresponding circuit. If it's not the end of
249 the circuit, it sends a DESTROY cell for that circuit to the next OR
250 in the circuit. If the node is the end of the circuit, then it tears
251 down any associated edge connections (see section 5.1).
253 After a DESTROY cell has been processed, an OR ignores all data or
254 destroy cells for the corresponding circuit.
256 To tear down part of a circuit, the OP sends a RELAY_TRUNCATE cell
257 signaling a given OR (Stream ID zero). That OR sends a DESTROY
258 cell to the next node in the circuit, and replies to the OP with a
259 RELAY_TRUNCATED cell.
261 When an unrecoverable error occurs along one connection in a
262 circuit, the nodes on either side of the connection should, if they
263 are able, act as follows: the node closer to the OP should send a
264 RELAY_TRUNCATED cell towards the OP; the node farther from the OP
265 should send a DESTROY cell down the circuit.
267 [We'll have to reevaluate this section once we figure out cleaner
268 circuit/connection killing conventions. -RD]
270 4.5. Routing data cells
272 When an OR receives a RELAY cell, it checks the cell's circID and
273 determines whether it has a corresponding circuit along that
274 connection. If not, the OR drops the RELAY cell.
276 Otherwise, if the OR is not at the OP edge of the circuit (that is,
277 either an 'exit node' or a non-edge node), it de/encrypts the length
278 field and the payload with AES/CTR, as follows:
279 'Forward' relay cell (same direction as CREATE):
280 Use Kf as key; encrypt.
281 'Back' relay cell (opposite direction from CREATE):
282 Use Kb as key; decrypt.
283 If the OR recognizes the stream ID on the cell (it is either the ID
284 of an open stream or the signaling (zero) ID), the OR processes the
285 contents of the relay cell. Otherwise, it passes the decrypted
286 relay cell along the circuit if the circuit continues, or drops the
287 cell if it's the end of the circuit. [Getting an unrecognized
288 relay cell at the end of the circuit must be allowed for now;
289 we can reexamine this once we've designed full tcp-style close
292 Otherwise, if the data cell is coming from the OP edge of the
293 circuit, the OP decrypts the length and payload fields with AES/CTR as
295 OP sends data cell to node R_M:
296 For I=1...M, decrypt with Kf_I.
298 Otherwise, if the data cell is arriving at the OP edge if the
299 circuit, the OP encrypts the length and payload fields with AES/CTR as
301 OP receives data cell:
303 Encrypt with Kb_I. If the stream ID is a recognized
304 stream for R_I, or if the stream ID is the signaling
305 ID (zero), then stop and process the payload.
307 For more information, see section 5 below.
309 5. Application connections and stream management
313 Within a circuit, the OP and the exit node use the contents of
314 RELAY packets to tunnel end-to-end commands and TCP connections
315 ("Streams") across circuits. End-to-end commands can be initiated
316 by either edge; streams are initiated by the OP.
318 The first 8 bytes of each relay cell are reserved as follows:
319 Relay command [1 byte]
322 The relay commands are:
334 All RELAY cells pertaining to the same tunneled stream have the
335 same stream ID. Stream ID's are chosen randomly by the OP. A
336 stream ID is considered "recognized" on a circuit C by an OP or an
337 OR if it already has an existing stream established on that
338 circuit, or if the stream ID is equal to the signaling stream ID,
339 which is all zero: [00 00 00 00 00 00 00]
341 To create a new anonymized TCP connection, the OP sends a
342 RELAY_BEGIN data cell with a payload encoding the address and port
343 of the destination host. The stream ID is zero. The payload format is:
344 NEWSTREAMID | ADDRESS | ':' | PORT | '\000'
345 where NEWSTREAMID is the newly generated Stream ID to use for
346 this stream, ADDRESS may be a DNS hostname, or an IPv4 address in
347 dotted-quad format; and where PORT is encoded in decimal.
349 Upon receiving this packet, the exit node resolves the address as
350 necessary, and opens a new TCP connection to the target port. If
351 the address cannot be resolved, or a connection can't be
352 established, the exit node replies with a RELAY_END cell.
353 Otherwise, the exit node replies with a RELAY_CONNECTED cell.
355 The OP waits for a RELAY_CONNECTED cell before sending any data.
356 Once a connection has been established, the OP and exit node
357 package stream data in RELAY_DATA cells, and upon receiving such
358 cells, echo their contents to the corresponding TCP stream.
360 Relay RELAY_DROP cells are long-range dummies; upon receiving such
361 a cell, the OR or OP must drop it.
365 [Note -- TCP streams can only be half-closed for reading. Our
366 Bickford's conversation was incorrect. -NM]
368 Because TCP connections can be half-open, we follow an equivalent
369 to TCP's FIN/FIN-ACK/ACK protocol to close streams.
371 An exit connection can have a TCP stream in one of three states:
372 'OPEN', 'DONE_PACKAGING', and 'DONE_DELIVERING'. For the purposes
373 of modeling transitions, we treat 'CLOSED' as a fourth state,
374 although connections in this state are not, in fact, tracked by the
377 A stream begins in the 'OPEN' state. Upon receiving a 'FIN' from
378 the corresponding TCP connection, the edge node sends a 'RELAY_END'
379 cell along the circuit and changes its state to 'DONE_PACKAGING'.
380 Upon receiving a 'RELAY_END' cell, an edge node sends a 'FIN' to
381 the corresponding TCP connection (e.g., by calling
382 shutdown(SHUT_WR)) and changing its state to 'DONE_DELIVERING'.
384 When a stream in already in 'DONE_DELIVERING' receives a 'FIN', it
385 also sends a 'RELAY_END' along the circuit, and changes its state
386 to 'CLOSED'. When a stream already in 'DONE_PACKAGING' receives a
387 'RELAY_END' cell, it sends a 'FIN' and changes its state to
390 [Note: Please rename 'RELAY_END2'. :) -NM ]
392 If an edge node encounters an error on any stram, it sends a
393 'RELAY_END2' cell along the circuit (if possible) and closes the
394 TCP connection immediately. If an edge node receives a
395 'RELAY_END2' cell for any stream, it closes the TCP connection
396 completely, and sends nothing along the circuit.
402 Each node should do appropriate bandwidth throttling to keep its
405 Communicants rely on TCP's default flow control to push back when they
410 Currently nodes are not required to do any sort of link padding or
411 dummy traffic. Because strong attacks exist even with link padding,
412 and because link padding greatly increases the bandwidth requirements
413 for running a node, we plan to leave out link padding until this
414 tradeoff is better understood.
416 6.3. Circuit-level flow control
418 To control a circuit's bandwidth usage, each OR keeps track of
419 two 'windows', consisting of how many RELAY_DATA cells it is
420 allowed to package for transmission, and how many RELAY_DATA cells
421 it is willing to deliver to streams outside the network.
422 Each 'window' value is initially set to 1000 data cells
423 in each direction (cells that are not data cells do not affect
424 the window). When an OR is willing to deliver more cells, it sends a
425 RELAY_SENDME cell towards the OP, with Stream ID zero. When an OR
426 receives a RELAY_SENDME cell with stream ID zero, it increments its
429 Each of these cells increments the corresponding window by 100.
431 The OP behaves identically, except that it must track a packaging
432 window and a delivery window for every OR in the circuit.
434 An OR or OP sends cells to increment its delivery window when the
435 corresponding window value falls under some threshold (900).
437 If a packaging window reaches 0, the OR or OP stops reading from
438 TCP connections for all streams on the corresponding circuit, and
439 sends no more RELAY_DATA cells until receiving a RELAY_SENDME cell.
440 [this stuff is badly worded; copy in the tor-design section -RD]
442 6.4. Stream-level flow control
444 Edge nodes use RELAY_SENDME cells to implement end-to-end flow
445 control for individual connections across circuits. Similarly to
446 circuit-level flow control, edge nodes begin with a window of cells
447 (500) per stream, and increment the window by a fixed value (50)
448 upon receiving a RELAY_SENDME cell. Edge nodes initiate RELAY_SENDME
449 cells when both a) the window is <= 450, and b) there are less than
450 ten cell payloads remaining to be flushed at that edge.
453 7. Directories and routers
455 7.1. Router descriptor format.
457 (Unless otherwise noted, tokens on the same line are space-separated.)
459 Router ::= Router-Line Date-Line Onion-Key Link-Key Signing-Key Exit-Policy Router-Signature NL
460 Router-Line ::= "router" nickname address ORPort SocksPort DirPort bandwidth NL
461 Date-Line ::= "published" YYYY-MM-DD HH:MM:SS NL
462 Onion-key ::= "onion-key" NL a public key in PEM format NL
463 Link-key ::= "link-key" NL a public key in PEM format NL
464 Signing-Key ::= "signing-key" NL a public key in PEM format NL
465 Exit-Policy ::= Exit-Line*
466 Exit-Line ::= ("accept"|"reject") string NL
467 Router-Signature ::= "router-signature" NL Signature
468 Signature ::= "-----BEGIN SIGNATURE-----" NL
469 Base-64-encoded-signature NL "-----END SIGNATURE-----" NL
471 ORport ::= port where the router listens for routers/proxies (speaking cells)
472 SocksPort ::= where the router listens for applications (speaking socks)
473 DirPort ::= where the router listens for directory download requests
474 bandwidth ::= maximum bandwidth, in bytes/s
476 nickname ::= between 1 and 32 alphanumeric characters. case-insensitive.
479 router moria1 moria.mit.edu 9001 9021 9031 100000
480 published 2003-09-24 19:36:05
481 -----BEGIN RSA PUBLIC KEY-----
482 MIGJAoGBAMBBuk1sYxEg5jLAJy86U3GGJ7EGMSV7yoA6mmcsEVU3pwTUrpbpCmwS
483 7BvovoY3z4zk63NZVBErgKQUDkn3pp8n83xZgEf4GI27gdWIIwaBjEimuJlEY+7K
484 nZ7kVMRoiXCbjL6VAtNa4Zy1Af/GOm0iCIDpholeujQ95xew7rQnAgMA//8=
485 -----END RSA PUBLIC KEY-----
487 -----BEGIN RSA PUBLIC KEY-----
488 7BvovoY3z4zk63NZVBErgKQUDkn3pp8n83xZgEf4GI27gdWIIwaBjEimuJlEY+7K
489 MIGJAoGBAMBBuk1sYxEg5jLAJy86U3GGJ7EGMSV7yoA6mmcsEVU3pwTUrpbpCmwS
490 f/GOm0iCIDpholeujQ95xew7rnZ7kVMRoiXCbjL6VAtNa4Zy1AQnAgMA//8=
491 -----END RSA PUBLIC KEY-----
494 Note: The extra newline at the end of the router block is intentional.
496 7.2. Directory format
498 Directory ::= Directory-Header Directory-Router Router* Signature
499 Directory-Header ::= "signed-directory" NL Software-Line NL
500 Software-Line: "recommended-software" comma-separated-version-list
501 Directory-Router ::= Router
502 Directory-Signature ::= "directory-signature" NL Signature
503 Signature ::= "-----BEGIN SIGNATURE-----" NL
504 Base-64-encoded-signature NL "-----END SIGNATURE-----" NL
506 Note: The router block for the directory server must appear first.
507 The signature is computed by computing the SHA-1 hash of the
508 directory, from the characters "signed-directory", through the newline
509 after "directory-signature". This digest is then padded with PKCS.1,
510 and signed with the directory server's signing key.
512 7.3. Behavior of a directory server
514 lists nodes that are connected currently
515 speaks http on a socket, spits out directory on request