3 Tor Protocol Specification
8 Note: This is an attempt to specify Tor as currently implemented. Future
9 versions of Tor will implement improved protocols, and compatibility is not
12 This is not a design document; most design criteria are not examined. For
13 more information on why Tor acts as it does, see tor-design.pdf.
16 - REASON_CONNECTFAILED should include an IP.
17 - Copy prose from tor-design to make everything more readable.
23 K -- a key for a symmetric cypher
25 a|b -- concatenation of 'a' and 'b'.
27 [A0 B1 C2] -- a three-byte sequence, containing the bytes with
28 hexadecimal values A0, B1, and C2, in that order.
30 All numeric values are encoded in network (big-endian) order.
32 Unless otherwise specified, all symmetric ciphers are AES in counter
33 mode, with an IV of all 0 bytes. Asymmetric ciphers are either RSA
34 with 1024-bit keys and exponents of 65537, or DH where the generator
35 is 2 and the modulus is the safe prime from rfc2409, section 6.2,
36 whose hex representation is:
38 "FFFFFFFFFFFFFFFFC90FDAA22168C234C4C6628B80DC1CD129024E08"
39 "8A67CC74020BBEA63B139B22514A08798E3404DDEF9519B3CD3A431B"
40 "302B0A6DF25F14374FE1356D6D51C245E485B576625E7EC6F44C42E9"
41 "A637ED6B0BFF5CB6F406B7EDEE386BFB5A899FA5AE9F24117C4B1FE6"
42 "49286651ECE65381FFFFFFFFFFFFFFFF"
44 All "hashes" are 20-byte SHA1 cryptographic digests.
46 When we refer to "the hash of a public key", we mean the SHA1 hash of the
47 DER encoding of an ASN.1 RSA public key (as specified in PKCS.1).
51 Onion Routing is a distributed overlay network designed to anonymize
52 low-latency TCP-based applications such as web browsing, secure shell,
53 and instant messaging. Clients choose a path through the network and
54 build a ``circuit'', in which each node (or ``onion router'' or ``OR'')
55 in the path knows its predecessor and successor, but no other nodes in
56 the circuit. Traffic flowing down the circuit is sent in fixed-size
57 ``cells'', which are unwrapped by a symmetric key at each node (like
58 the layers of an onion) and relayed downstream.
62 There are two ways to connect to an onion router (OR). The first is
63 as an onion proxy (OP), which allows the OP to authenticate the OR
64 without authenticating itself. The second is as another OR, which
65 allows mutual authentication.
67 Tor uses TLS for link encryption. All implementations MUST support
68 the TLS ciphersuite "TLS_EDH_RSA_WITH_DES_192_CBC3_SHA", and SHOULD
69 support "TLS_DHE_RSA_WITH_AES_128_CBC_SHA" if it is available.
70 Implementations MAY support other ciphersuites, but MUST NOT
71 support any suite without ephemeral keys, symmetric keys of at
72 least 128 bits, and digests of at least 160 bits.
74 An OP or OR always sends a two-certificate chain, consisting of a
75 certificate using a short-term connection key and a second, self-
76 signed certificate containing the OR's identity key. The commonName of the
77 first certificate is the OR's nickname, and the commonName of the second
78 certificate is the OR's nickname, followed by a space and the string
81 All parties receiving certificates must confirm that the identity key is
82 as expected. (When initiating a connection, the expected identity key is
83 the one given in the directory; when creating a connection because of an
84 EXTEND cell, the expected identity key is the one given in the cell.) If
85 the key is not as expected, the party must close the connection.
87 All parties SHOULD reject connections to or from ORs that have malformed
88 or missing certificates. ORs MAY accept or reject connections from OPs
89 with malformed or missing certificates.
91 Once a TLS connection is established, the two sides send cells
92 (specified below) to one another. Cells are sent serially. All
93 cells are 512 bytes long. Cells may be sent embedded in TLS
94 records of any size or divided across TLS records, but the framing
95 of TLS records MUST NOT leak information about the type or contents
98 OR-to-OR connections are never deliberately closed. When an OR
99 starts or receives a new directory, it tries to open new
100 connections to any OR it is not already connected to.
101 [not true, unused OR conns close after 5 mins too -RD]
103 OR-to-OP connections are not permanent. An OP should close a
104 connection to an OR if there are no circuits running over the
105 connection, and an amount of time (KeepalivePeriod, defaults to 5
108 3. Cell Packet format
110 The basic unit of communication for onion routers and onion
111 proxies is a fixed-width "cell". Each cell contains the following
116 Payload (padded with 0 bytes) [509 bytes]
117 [Total size: 512 bytes]
119 The CircID field determines which circuit, if any, the cell is
122 The 'Command' field holds one of the following values:
123 0 -- PADDING (Padding) (See Sec 6.2)
124 1 -- CREATE (Create a circuit) (See Sec 4)
125 2 -- CREATED (Acknowledge create) (See Sec 4)
126 3 -- RELAY (End-to-end data) (See Sec 5)
127 4 -- DESTROY (Stop using a circuit) (See Sec 4)
128 5 -- CREATE_FAST (Create a circuit, no PK) (See sec 4)
129 6 -- CREATED_FAST (Circtuit created, no PK) (See Sec 4)
131 The interpretation of 'Payload' depends on the type of the cell.
132 PADDING: Payload is unused.
133 CREATE: Payload contains the handshake challenge.
134 CREATED: Payload contains the handshake response.
135 RELAY: Payload contains the relay header and relay body.
136 DESTROY: Payload is unused.
137 Upon receiving any other value for the command field, an OR must
140 The payload is padded with 0 bytes.
142 PADDING cells are currently used to implement connection keepalive.
143 If there is no other traffic, ORs and OPs send one another a PADDING
144 cell every few minutes.
146 CREATE, CREATED, and DESTROY cells are used to manage circuits;
149 RELAY cells are used to send commands and data along a circuit; see
152 4. Circuit management
154 4.1. CREATE and CREATED cells
156 Users set up circuits incrementally, one hop at a time. To create a
157 new circuit, OPs send a CREATE cell to the first node, with the
158 first half of the DH handshake; that node responds with a CREATED
159 cell with the second half of the DH handshake plus the first 20 bytes
160 of derivative key data (see section 4.2). To extend a circuit past
161 the first hop, the OP sends an EXTEND relay cell (see section 5)
162 which instructs the last node in the circuit to send a CREATE cell
163 to extend the circuit.
165 The payload for a CREATE cell is an 'onion skin', which consists
166 of the first step of the DH handshake data (also known as g^x).
168 The data is encrypted to Bob's PK as follows: Suppose Bob's PK
169 modulus is L octets long. If the data to be encrypted is shorter
170 than L-42, then it is encrypted directly (with OAEP padding: see
171 ftp://ftp.rsasecurity.com/pub/pkcs/pkcs-1/pkcs-1v2-1.pdf). If the
172 data is at least as long as L-42, then a randomly generated 16-byte
173 symmetric key is prepended to the data, after which the first L-16-42
174 bytes of the data are encrypted with Bob's PK; and the rest of the
175 data is encrypted with the symmetric key.
177 So in this case, the onion skin on the wire looks like:
179 OAEP padding [42 bytes]
180 Symmetric key [16 bytes]
181 First part of g^x [70 bytes]
182 Symmetrically encrypted:
183 Second part of g^x [58 bytes]
185 The relay payload for an EXTEND relay cell consists of:
188 Onion skin [186 bytes]
189 Public key hash [20 bytes]
191 The port and address field denote the IPV4 address and port of the next
192 onion router in the circuit; the public key hash is the SHA1 hash of the
193 PKCS#1 ASN1 encoding of the next onion router's identity (signing) key.
195 The payload for a CREATED cell, or the relay payload for an
196 EXTENDED cell, contains:
197 DH data (g^y) [128 bytes]
198 Derivative key data (KH) [20 bytes] <see 4.2 below>
200 The CircID for a CREATE cell is an arbitrarily chosen 2-byte integer,
201 selected by the node (OP or OR) that sends the CREATE cell. To prevent
202 CircID collisions, when one OR sends a CREATE cell to another, it chooses
203 from only one half of the possible values based on the ORs' public
204 identity keys: if the sending OR has a lower key, it chooses a CircID with
205 an MSB of 0; otherwise, it chooses a CircID with an MSB of 1.
207 Public keys are compared numerically by modulus.
209 (Older versions of Tor compared OR nicknames, and did it in a broken and
210 unreliable way. To support versions of Tor earlier than 0.0.9pre6,
211 implementations should notice when the other side of a connection is
212 sending CREATE cells with the "wrong" MSG, and switch accordingly.)
214 4.1.1. CREATE_FAST/CREATED_FAST cells
216 When initializing the first hop of a circuit, the OP has already
217 established the OR's identity and negotiated a secret key using TLS.
218 Because of this, it is not always necessary for the OP to perform the
219 public key operations to create a circuit. In this case, the
220 OP SHOULD send a CREATE_FAST cell instead of a CREATE cell for the first
221 hop only. The OR responds with a CREATED_FAST cell, and the circuit is
224 A CREATE_FAST cell contains:
226 Key material (X) [20 bytes]
228 A CREATED_FAST cell contains:
230 Key material (Y) [20 bytes]
231 Derivative key data [20 bytes]
233 [Versions of Tor before 0.1.0.6-rc did not support these cell types;
234 clients should not send CREATE_FAST cells to older Tor servers.]
236 4.2. Setting circuit keys
238 Once the handshake between the OP and an OR is completed, both
239 servers can now calculate g^xy with ordinary DH. From the base key
240 material g^xy, they compute derivative key material as follows.
241 First, the server represents g^xy as a big-endian unsigned integer.
242 Next, the server computes 100 bytes of key data as K = SHA1(g^xy |
243 [00]) | SHA1(g^xy | [01]) | ... SHA1(g^xy | [04]) where "00" is
244 a single octet whose value is zero, [01] is a single octet whose
245 value is one, etc. The first 20 bytes of K form KH, bytes 21-40 form
246 the forward digest Df, 41-60 form the backward digest Db, 61-76 form
247 Kf, and 77-92 form Kb.
249 KH is used in the handshake response to demonstrate knowledge of the
250 computed shared key. Df is used to seed the integrity-checking hash
251 for the stream of data going from the OP to the OR, and Db seeds the
252 integrity-checking hash for the data stream from the OR to the OP. Kf
253 is used to encrypt the stream of data going from the OP to the OR, and
254 Kb is used to encrypt the stream of data going from the OR to the OP.
256 The fast-setup case uses the same formula, except that X|Y is used
257 in place of g^xy in determining K. That is,
258 K = SHA1(X|Y | [00]) | SHA1(X|Y | [01]) | ... SHA1(X|Y| | [04])
259 The values KH, Kf, Kb, Df, and Db are established and used as before.
261 4.3. Creating circuits
263 When creating a circuit through the network, the circuit creator
264 (OP) performs the following steps:
266 1. Choose an onion router as an exit node (R_N), such that the onion
267 router's exit policy does not exclude all pending streams
270 2. Choose a chain of (N-1) onion routers
271 (R_1...R_N-1) to constitute the path, such that no router
272 appears in the path twice.
274 3. If not already connected to the first router in the chain,
275 open a new connection to that router.
277 4. Choose a circID not already in use on the connection with the
278 first router in the chain; send a CREATE cell along the
279 connection, to be received by the first onion router.
281 5. Wait until a CREATED cell is received; finish the handshake
282 and extract the forward key Kf_1 and the backward key Kb_1.
284 6. For each subsequent onion router R (R_2 through R_N), extend
287 To extend the circuit by a single onion router R_M, the OP performs
290 1. Create an onion skin, encrypted to R_M's public key.
292 2. Send the onion skin in a relay EXTEND cell along
293 the circuit (see section 5).
295 3. When a relay EXTENDED cell is received, verify KH, and
296 calculate the shared keys. The circuit is now extended.
298 When an onion router receives an EXTEND relay cell, it sends a CREATE
299 cell to the next onion router, with the enclosed onion skin as its
300 payload. The initiating onion router chooses some circID not yet
301 used on the connection between the two onion routers. (But see
302 section 4.1. above, concerning choosing circIDs based on
303 lexicographic order of nicknames.)
305 As an extension (called router twins), if the desired next onion
306 router R in the circuit is down, and some other onion router R'
307 has the same public keys as R, then it's ok to extend to R' rather than R.
309 When an onion router receives a CREATE cell, if it already has a
310 circuit on the given connection with the given circID, it drops the
311 cell. Otherwise, after receiving the CREATE cell, it completes the
312 DH handshake, and replies with a CREATED cell. Upon receiving a
313 CREATED cell, an onion router packs it payload into an EXTENDED relay
314 cell (see section 5), and sends that cell up the circuit. Upon
315 receiving the EXTENDED relay cell, the OP can retrieve g^y.
317 (As an optimization, OR implementations may delay processing onions
318 until a break in traffic allows time to do so without harming
319 network latency too greatly.)
321 4.4. Tearing down circuits
323 Circuits are torn down when an unrecoverable error occurs along
324 the circuit, or when all streams on a circuit are closed and the
325 circuit's intended lifetime is over. Circuits may be torn down
326 either completely or hop-by-hop.
328 To tear down a circuit completely, an OR or OP sends a DESTROY
329 cell to the adjacent nodes on that circuit, using the appropriate
332 Upon receiving an outgoing DESTROY cell, an OR frees resources
333 associated with the corresponding circuit. If it's not the end of
334 the circuit, it sends a DESTROY cell for that circuit to the next OR
335 in the circuit. If the node is the end of the circuit, then it tears
336 down any associated edge connections (see section 5.1).
338 After a DESTROY cell has been processed, an OR ignores all data or
339 destroy cells for the corresponding circuit.
341 (The rest of this section is not currently used; on errors, circuits
342 are destroyed, not truncated.)
344 To tear down part of a circuit, the OP may send a RELAY_TRUNCATE cell
345 signaling a given OR (Stream ID zero). That OR sends a DESTROY
346 cell to the next node in the circuit, and replies to the OP with a
347 RELAY_TRUNCATED cell.
349 When an unrecoverable error occurs along one connection in a
350 circuit, the nodes on either side of the connection should, if they
351 are able, act as follows: the node closer to the OP should send a
352 RELAY_TRUNCATED cell towards the OP; the node farther from the OP
353 should send a DESTROY cell down the circuit.
355 4.5. Routing relay cells
357 When an OR receives a RELAY cell, it checks the cell's circID and
358 determines whether it has a corresponding circuit along that
359 connection. If not, the OR drops the RELAY cell.
361 Otherwise, if the OR is not at the OP edge of the circuit (that is,
362 either an 'exit node' or a non-edge node), it de/encrypts the payload
363 with AES/CTR, as follows:
364 'Forward' relay cell (same direction as CREATE):
365 Use Kf as key; decrypt.
366 'Back' relay cell (opposite direction from CREATE):
367 Use Kb as key; encrypt.
369 The OR then decides whether it recognizes the relay cell, by
370 inspecting the payload as described in section 5.1 below. If the OR
371 recognizes the cell, it processes the contents of the relay cell.
372 Otherwise, it passes the decrypted relay cell along the circuit if
373 the circuit continues. If the OR at the end of the circuit
374 encounters an unrecognized relay cell, an error has occurred: the OR
375 sends a DESTROY cell to tear down the circuit.
377 When a relay cell arrives at an OP, the OP decrypts the payload
378 with AES/CTR as follows:
379 OP receives data cell:
381 Decrypt with Kb_I. If the payload is recognized (see
382 section 5.1), then stop and process the payload.
384 For more information, see section 5 below.
386 5. Application connections and stream management
390 Within a circuit, the OP and the exit node use the contents of
391 RELAY packets to tunnel end-to-end commands and TCP connections
392 ("Streams") across circuits. End-to-end commands can be initiated
393 by either edge; streams are initiated by the OP.
395 The payload of each unencrypted RELAY cell consists of:
396 Relay command [1 byte]
397 'Recognized' [2 bytes]
403 The relay commands are:
417 The 'Recognized' field in any unencrypted relay payload is always
418 set to zero; the 'digest' field is computed as the first four bytes
419 of the running SHA-1 digest of all the bytes that have travelled
420 over this circuit, seeded from Df or Db respectively (obtained in
421 section 4.2 above), and including this RELAY cell's entire payload
422 (taken with the digest field set to zero).
424 When the 'recognized' field of a RELAY cell is zero, and the digest
425 is correct, the cell is considered "recognized" for the purposes of
426 decryption (see section 4.5 above).
428 All RELAY cells pertaining to the same tunneled stream have the
429 same stream ID. StreamIDs are chosen randomly by the OP. RELAY
430 cells that affect the entire circuit rather than a particular
431 stream use a StreamID of zero.
433 The 'Length' field of a relay cell contains the number of bytes in
434 the relay payload which contain real payload data. The remainder of
435 the payload is padded with NUL bytes.
437 5.2. Opening streams and transferring data
439 To open a new anonymized TCP connection, the OP chooses an open
440 circuit to an exit that may be able to connect to the destination
441 address, selects an arbitrary StreamID not yet used on that circuit,
442 and constructs a RELAY_BEGIN cell with a payload encoding the address
443 and port of the destination host. The payload format is:
445 ADDRESS | ':' | PORT | [00]
447 where ADDRESS can be a DNS hostname, or an IPv4 address in
448 dotted-quad format, or an IPv6 address surrounded by square brackets;
449 and where PORT is encoded in decimal.
451 [What is the [00] for? -NM]
452 [It's so the payload is easy to parse out with string funcs -RD]
454 Upon receiving this cell, the exit node resolves the address as
455 necessary, and opens a new TCP connection to the target port. If the
456 address cannot be resolved, or a connection can't be established, the
457 exit node replies with a RELAY_END cell. (See 5.4 below.)
458 Otherwise, the exit node replies with a RELAY_CONNECTED cell, whose
459 payload is the 4-byte IPv4 address or the 16-byte IPv6 address to which
460 the connection was made.
462 The OP waits for a RELAY_CONNECTED cell before sending any data.
463 Once a connection has been established, the OP and exit node
464 package stream data in RELAY_DATA cells, and upon receiving such
465 cells, echo their contents to the corresponding TCP stream.
466 RELAY_DATA cells sent to unrecognized streams are dropped.
468 Relay RELAY_DROP cells are long-range dummies; upon receiving such
469 a cell, the OR or OP must drop it.
473 When an anonymized TCP connection is closed, or an edge node
474 encounters error on any stream, it sends a 'RELAY_END' cell along the
475 circuit (if possible) and closes the TCP connection immediately. If
476 an edge node receives a 'RELAY_END' cell for any stream, it closes
477 the TCP connection completely, and sends nothing more along the
478 circuit for that stream.
480 The payload of a RELAY_END cell begins with a single 'reason' byte to
481 describe why the stream is closing, plus optional data (depending on
482 the reason.) The values are:
484 1 -- REASON_MISC (catch-all for unlisted reasons)
485 2 -- REASON_RESOLVEFAILED (couldn't look up hostname)
486 3 -- REASON_CONNECTREFUSED (remote host refused connection) [*]
487 4 -- REASON_EXITPOLICY (OR refuses to connect to host or port)
488 5 -- REASON_DESTROY (Circuit is being destroyed)
489 6 -- REASON_DONE (Anonymized TCP connection was closed)
490 7 -- REASON_TIMEOUT (Connection timed out, or OR timed out
492 8 -- (unallocated) [**]
493 9 -- REASON_HIBERNATING (OR is temporarily hibernating)
494 10 -- REASON_INTERNAL (Internal error at the OR)
495 11 -- REASON_RESOURCELIMIT (OR has no resources to fulfill request)
496 12 -- REASON_CONNRESET (Connection was unexpectedly reset)
497 13 -- REASON_TORPROTOCOL (Sent when closing connection because of
498 Tor protocol violations.)
500 (With REASON_EXITPOLICY, the 4-byte IPv4 address or 16-byte IPv6 address
501 forms the optional data; no other reason currently has extra data.)
503 OPs and ORs MUST accept reasons not on the above list, since future
504 versions of Tor may provide more fine-grained reasons.
506 [*] Older versions of Tor also send this reason when connections are
508 [**] Due to a bug in versions of Tor through 0095, error reason 8 must
509 remain allocated until that version is obsolete.
511 --- [The rest of this section describes unimplemented functionality.]
513 Because TCP connections can be half-open, we follow an equivalent
514 to TCP's FIN/FIN-ACK/ACK protocol to close streams.
516 An exit connection can have a TCP stream in one of three states:
517 'OPEN', 'DONE_PACKAGING', and 'DONE_DELIVERING'. For the purposes
518 of modeling transitions, we treat 'CLOSED' as a fourth state,
519 although connections in this state are not, in fact, tracked by the
522 A stream begins in the 'OPEN' state. Upon receiving a 'FIN' from
523 the corresponding TCP connection, the edge node sends a 'RELAY_FIN'
524 cell along the circuit and changes its state to 'DONE_PACKAGING'.
525 Upon receiving a 'RELAY_FIN' cell, an edge node sends a 'FIN' to
526 the corresponding TCP connection (e.g., by calling
527 shutdown(SHUT_WR)) and changing its state to 'DONE_DELIVERING'.
529 When a stream in already in 'DONE_DELIVERING' receives a 'FIN', it
530 also sends a 'RELAY_FIN' along the circuit, and changes its state
531 to 'CLOSED'. When a stream already in 'DONE_PACKAGING' receives a
532 'RELAY_FIN' cell, it sends a 'FIN' and changes its state to
535 If an edge node encounters an error on any stream, it sends a
536 'RELAY_END' cell (if possible) and closes the stream immediately.
538 5.4. Remote hostname lookup
540 To find the address associated with a hostname, the OP sends a
541 RELAY_RESOLVE cell containing the hostname to be resolved. (For a reverse
542 lookup, the OP sends a RELAY_RESOLVE cell containing an in-addr.arpa
543 address.) The OR replies with a RELAY_RESOLVED cell containing a status
544 byte, and any number of answers. Each answer is of the form:
547 Value (variable-width)
548 "Length" is the length of the Value field.
553 0xF0 -- Error, transient
554 0xF1 -- Error, nontransient
556 If any answer has a type of 'Error', then no other answer may be given.
558 The RELAY_RESOLVE cell must use a nonzero, distinct streamID; the
559 corresponding RELAY_RESOLVED cell must use the same streamID. No stream
560 is actually created by the OR when resolving the name.
566 Each node should do appropriate bandwidth throttling to keep its
569 Communicants rely on TCP's default flow control to push back when they
574 Currently nodes are not required to do any sort of link padding or
575 dummy traffic. Because strong attacks exist even with link padding,
576 and because link padding greatly increases the bandwidth requirements
577 for running a node, we plan to leave out link padding until this
578 tradeoff is better understood.
580 6.3. Circuit-level flow control
582 To control a circuit's bandwidth usage, each OR keeps track of
583 two 'windows', consisting of how many RELAY_DATA cells it is
584 allowed to package for transmission, and how many RELAY_DATA cells
585 it is willing to deliver to streams outside the network.
586 Each 'window' value is initially set to 1000 data cells
587 in each direction (cells that are not data cells do not affect
588 the window). When an OR is willing to deliver more cells, it sends a
589 RELAY_SENDME cell towards the OP, with Stream ID zero. When an OR
590 receives a RELAY_SENDME cell with stream ID zero, it increments its
593 Each of these cells increments the corresponding window by 100.
595 The OP behaves identically, except that it must track a packaging
596 window and a delivery window for every OR in the circuit.
598 An OR or OP sends cells to increment its delivery window when the
599 corresponding window value falls under some threshold (900).
601 If a packaging window reaches 0, the OR or OP stops reading from
602 TCP connections for all streams on the corresponding circuit, and
603 sends no more RELAY_DATA cells until receiving a RELAY_SENDME cell.
604 [this stuff is badly worded; copy in the tor-design section -RD]
606 6.4. Stream-level flow control
608 Edge nodes use RELAY_SENDME cells to implement end-to-end flow
609 control for individual connections across circuits. Similarly to
610 circuit-level flow control, edge nodes begin with a window of cells
611 (500) per stream, and increment the window by a fixed value (50)
612 upon receiving a RELAY_SENDME cell. Edge nodes initiate RELAY_SENDME
613 cells when both a) the window is <= 450, and b) there are less than
614 ten cell payloads remaining to be flushed at that edge.
616 7. Directories and routers
618 7.1. Extensible information format
620 Router descriptors and directories both obey the following lightweight
621 extensible information format.
623 The highest level object is a Document, which consists of one or more Items.
624 Every Item begins with a KeywordLine, followed by one or more Objects. A
625 KeywordLine begins with a Keyword, optionally followed by a space and more
626 non-newline characters, and ends with a newline. A Keyword is a sequence of
627 one or more characters in the set [A-Za-z0-9-]. An Object is a block of
628 encoded data in pseudo-Open-PGP-style armor. (cf. RFC 2440)
632 Document ::= (Item | NL)+
633 Item ::= KeywordLine Object*
634 KeywordLine ::= Keyword NL | Keyword SP ArgumentsChar+ NL
635 Keyword = KeywordChar+
636 KeywordChar ::= 'A' ... 'Z' | 'a' ... 'z' | '0' ... '9' | '-'
637 ArgumentChar ::= any printing ASCII character except NL.
638 Object ::= BeginLine Base-64-encoded-data EndLine
639 BeginLine ::= "-----BEGIN " Keyword "-----" NL
640 EndLine ::= "-----END " Keyword "-----" NL
642 The BeginLine and EndLine of an Object must use the same keyword.
644 When interpreting a Document, software MUST reject any document containing a
645 KeywordLine that starts with a keyword it doesn't recognize.
647 The "opt" keyword is reserved for non-critical future extensions. All
648 implementations MUST ignore any item of the form "opt keyword ....." when
649 they would not recognize "keyword ....."; and MUST treat "opt keyword ....."
650 as synonymous with "keyword ......" when keyword is recognized.
652 7.2. Router descriptor format.
654 Every router descriptor MUST start with a "router" Item; MUST end with a
655 "router-signature" Item and an extra NL; and MUST contain exactly one
656 instance of each of the following Items: "published" "onion-key" "link-key"
657 "signing-key" "bandwidth". Additionally, a router descriptor MAY contain any
658 number of "accept", "reject", "fingerprint", "uptime", and "opt" Items.
659 Other than "router" and "router-signature", the items may appear in any
662 The items' formats are as follows:
663 "router" nickname address (ORPort SocksPort DirPort)?
665 Indicates the beginning of a router descriptor. "address" must be an
666 IPv4 address in dotted-quad format. The Port values will soon be
667 deprecated; using them here is equivalent to using them in a "ports"
670 "ports" ORPort SocksPort DirPort
672 Indicates the TCP ports at which this OR exposes functionality.
673 ORPort is a port at which this OR accepts TLS connections for the main
674 OR protocol; SocksPort is the port at which this OR accepts SOCKS
675 connections; and DirPort is the port at which this OR accepts
676 directory-related HTTP connections. If any port is not supported, the
677 value 0 is given instead of a port number.
679 "bandwidth" bandwidth-avg bandwidth-burst bandwidth-observed
681 Estimated bandwidth for this router, in bytes per second. The
682 "average" bandwidth is the volume per second that the OR is willing
683 to sustain over long periods; the "burst" bandwidth is the volume
684 that the OR is willing to sustain in very short intervals. The
685 "observed" value is an estimate of the capacity this server can
686 handle. The server remembers the max bandwidth sustained output
687 over any ten second period in the past day, and another sustained
688 input. The "observed" value is the lesser of these two numbers.
692 A human-readable string describing the system on which this OR is
693 running. This MAY include the operating system, and SHOULD include
694 the name and version of the software implementing the Tor protocol.
696 "published" YYYY-MM-DD HH:MM:SS
698 The time, in GMT, when this descriptor was generated.
702 A fingerprint (20 byte SHA1 hash of asn1 encoded public key, encoded
703 in hex, with spaces after every 4 characters) for this router's
706 [We didn't start parsing this line until Tor 0.1.0.6-rc; it should
707 be marked with "opt" until earlier versions of Tor are obsolete.]
711 If the value is 1, then the Tor server was hibernating when the
712 descriptor was published, and shouldn't be used to build circuits.
714 [We didn't start parsing this line until Tor 0.1.0.6-rc; it should
715 be marked with "opt" until earlier versions of Tor are obsolete.]
719 The number of seconds that this OR process has been running.
721 "onion-key" NL a public key in PEM format
723 This key is used to encrypt EXTEND cells for this OR. The key MUST
724 be accepted for at least XXXX hours after any new key is published in
725 a subsequent descriptor.
727 "signing-key" NL a public key in PEM format
729 The OR's long-term identity key.
734 These lines, in order, describe the rules that an OR follows when
735 deciding whether to allow a new stream to a given address. The
736 'exitpattern' syntax is described below.
738 "router-signature" NL Signature NL
740 The "SIGNATURE" object contains a signature of the PKCS1-padded SHA1
741 hash of the entire router descriptor, taken from the beginning of the
742 "router" line, through the newline after the "router-signature" line.
743 The router descriptor is invalid unless the signature is performed
744 with the router's identity key.
748 Describes a way to contact the server's administrator, preferably
749 including an email address and a PGP key fingerprint.
753 'Names' is a space-separated list of server nicknames. If two ORs
754 list one another in their "family" entries, then OPs should treat
755 them as a single OR for the purpose of path selection.
757 For example, if node A's descriptor contains "family B", and node B's
758 descriptor contains "family A", then node A and node B should never
759 be used on the same circuit.
761 "read-history" YYYY-MM-DD HH:MM:SS (NSEC s) NUM,NUM,NUM,NUM,NUM... NL
762 "write-history" YYYY-MM-DD HH:MM:SS (NSEC s) NUM,NUM,NUM,NUM,NUM... NL
764 Declare how much bandwidth the OR has used recently. Usage is divided
765 into intervals of NSEC seconds. The YYYY-MM-DD HH:MM:SS field defines
766 the end of the most recent interval. The numbers are the number of
767 bytes used in the most recent intervals, ordered from oldest to newest.
769 [We didn't start parsing these lines until Tor 0.1.0.6-rc; they should
770 be marked with "opt" until earlier versions of Tor are obsolete.]
772 nickname ::= between 1 and 19 alphanumeric characters, case-insensitive.
774 exitpattern ::= addrspec ":" portspec
775 portspec ::= "*" | port | port "-" port
776 port ::= an integer between 1 and 65535, inclusive.
777 addrspec ::= "*" | ip4spec | ip6spec
778 ipv4spec ::= ip4 | ip4 "/" num_ip4_bits | ip4 "/" ip4mask
779 ip4 ::= an IPv4 address in dotted-quad format
780 ip4mask ::= an IPv4 mask in dotted-quad format
781 num_ip4_bits ::= an integer between 0 and 32
782 ip6spec ::= ip6 | ip6 "/" num_ip6_bits
783 ip6 ::= an IPv6 address, surrounded by square brackets.
784 num_ip6_bits ::= an integer between 0 and 128
786 Ports are required; if they are not included in the router
787 line, they must appear in the "ports" lines.
789 7.3. Directory format
791 A Directory begins with a "signed-directory" item, followed by one each of
792 the following, in any order: "recommended-software", "published",
793 "router-status", "dir-signing-key". It may include any number of "opt"
794 items. After these items, a directory includes any number of router
795 descriptors, and a single "directory-signature" item.
799 Indicates the start of a directory.
801 "published" YYYY-MM-DD HH:MM:SS
803 The time at which this directory was generated and signed, in GMT.
807 The key used to sign this directory; see "signing-key" for format.
809 "recommended-software" comma-separated-version-list
811 A list of which versions of which implementations are currently
812 believed to be secure and compatible with the network.
814 "running-routers" space-separated-list
816 A description of which routers are currently believed to be up or
817 down. Every entry consists of an optional "!", followed by either an
818 OR's nickname, or "$" followed by a hexadecimal encoding of the hash
819 of an OR's identity key. If the "!" is included, the router is
820 believed not to be running; otherwise, it is believed to be running.
821 If a router's nickname is given, exactly one router of that nickname
822 will appear in the directory, and that router is "approved" by the
823 directory server. If a hashed identity key is given, that OR is not
824 "approved". [XXXX The 'running-routers' line is only provided for
825 backward compatibility. New code should parse 'router-status'
828 "router-status" space-separated-list
830 A description of which routers are currently believed to be up or
831 down, and which are verified or unverified. Contains one entry for
832 every router that the directory server knows. Each entry is of the
835 !name=$digest [Verified router, currently not live.]
836 name=$digest [Verified router, currently live.]
837 !$digest [Unverified router, currently not live.]
838 or $digest [Unverified router, currently live.]
840 (where 'name' is the router's nickname and 'digest' is a hexadecimal
841 encoding of the hash of the routers' identity key).
843 When parsing this line, clients should only mark a router as
844 'verified' if its nickname AND digest match the one provided.
846 "directory-signature" nickname-of-dirserver NL Signature
848 Note: The router descriptor for the directory server MUST appear first.
849 The signature is computed by computing the SHA-1 hash of the
850 directory, from the characters "signed-directory", through the newline
851 after "directory-signature". This digest is then padded with PKCS.1,
852 and signed with the directory server's signing key.
854 If software encounters an unrecognized keyword in a single router descriptor,
855 it should reject only that router descriptor, and continue using the
856 others. If it encounters an unrecognized keyword in the directory header,
857 it should reject the entire directory.
859 7.4. Network-status descriptor
861 A "network-status" (a.k.a "running-routers") document is a truncated
862 directory that contains only the current status of a list of nodes, not
863 their actual descriptors. It contains exactly one of each of the following
870 "published" YYYY-MM-DD HH:MM:SS
878 "directory-signature" NL signature
882 7.5. Behavior of a directory server
884 lists nodes that are connected currently
885 speaks HTTP on a socket, spits out directory on request
887 Directory servers listen on a certain port (the DirPort), and speak a
888 limited version of HTTP 1.0. Clients send either GET or POST commands.
889 The basic interactions are:
890 "%s %s HTTP/1.0\r\nContent-Length: %lu\r\nHost: %s\r\n\r\n",
891 command, url, content-length, host.
892 Get "/tor/" to fetch a full directory.
893 Get "/tor/dir.z" to fetch a compressed full directory.
894 Get "/tor/running-routers" to fetch a network-status descriptor.
895 Post "/tor/" to post a server descriptor, with the body of the
896 request containing the descriptor.
898 "host" is used to specify the address:port of the dirserver, so
899 the request can survive going through HTTP proxies.
901 A.1. Differences between spec and implementation
903 - The current specification requires all ORs to have IPv4 addresses, but
904 allows servers to exit and resolve to IPv6 addresses, and to declare IPv6
905 addresses in their exit policies. The current codebase has no IPv6