3 Tor Protocol Specification
8 Note: This is an attempt to specify Tor as currently implemented. Future
9 versions of Tor will implement improved protocols, and compatibility is not
12 This is not a design document; most design criteria are not examined. For
13 more information on why Tor acts as it does, see tor-design.pdf.
16 - REASON_CONNECTFAILED should include an IP.
17 - Copy prose from tor-design to make everything more readable.
18 when do we rotate which keys (tls, link, etc)?
24 K -- a key for a symmetric cypher
26 a|b -- concatenation of 'a' and 'b'.
28 [A0 B1 C2] -- a three-byte sequence, containing the bytes with
29 hexadecimal values A0, B1, and C2, in that order.
31 All numeric values are encoded in network (big-endian) order.
33 Unless otherwise specified, all symmetric ciphers are AES in counter
34 mode, with an IV of all 0 bytes. Asymmetric ciphers are either RSA
35 with 1024-bit keys and exponents of 65537, or DH where the generator (g)
36 is 2 and the modulus (p) is the 1024-bit safe prime from rfc2409,
37 section 6.2, whose hex representation is:
39 "FFFFFFFFFFFFFFFFC90FDAA22168C234C4C6628B80DC1CD129024E08"
40 "8A67CC74020BBEA63B139B22514A08798E3404DDEF9519B3CD3A431B"
41 "302B0A6DF25F14374FE1356D6D51C245E485B576625E7EC6F44C42E9"
42 "A637ED6B0BFF5CB6F406B7EDEE386BFB5A899FA5AE9F24117C4B1FE6"
43 "49286651ECE65381FFFFFFFFFFFFFFFF"
45 As an optimization, implementations SHOULD choose DH private keys (x) of
46 320 bits. Implementations that do this MUST never use any DH key more
49 All "hashes" are 20-byte SHA1 cryptographic digests.
51 When we refer to "the hash of a public key", we mean the SHA1 hash of the
52 DER encoding of an ASN.1 RSA public key (as specified in PKCS.1).
56 Onion Routing is a distributed overlay network designed to anonymize
57 low-latency TCP-based applications such as web browsing, secure shell,
58 and instant messaging. Clients choose a path through the network and
59 build a ``circuit'', in which each node (or ``onion router'' or ``OR'')
60 in the path knows its predecessor and successor, but no other nodes in
61 the circuit. Traffic flowing down the circuit is sent in fixed-size
62 ``cells'', which are unwrapped by a symmetric key at each node (like
63 the layers of an onion) and relayed downstream.
67 There are two ways to connect to an onion router (OR). The first is
68 as an onion proxy (OP), which allows the OP to authenticate the OR
69 without authenticating itself. The second is as another OR, which
70 allows mutual authentication.
72 Tor uses TLS for link encryption. All implementations MUST support
73 the TLS ciphersuite "TLS_EDH_RSA_WITH_DES_192_CBC3_SHA", and SHOULD
74 support "TLS_DHE_RSA_WITH_AES_128_CBC_SHA" if it is available.
75 Implementations MAY support other ciphersuites, but MUST NOT
76 support any suite without ephemeral keys, symmetric keys of at
77 least 128 bits, and digests of at least 160 bits.
79 An OP or OR always sends a two-certificate chain, consisting of a
80 certificate using a short-term connection key and a second, self-
81 signed certificate containing the OR's identity key. The commonName of the
82 first certificate is the OR's nickname, and the commonName of the second
83 certificate is the OR's nickname, followed by a space and the string
86 All parties receiving certificates must confirm that the identity key is
87 as expected. (When initiating a connection, the expected identity key is
88 the one given in the directory; when creating a connection because of an
89 EXTEND cell, the expected identity key is the one given in the cell.) If
90 the key is not as expected, the party must close the connection.
92 All parties SHOULD reject connections to or from ORs that have malformed
93 or missing certificates. ORs MAY accept or reject connections from OPs
94 with malformed or missing certificates.
96 Once a TLS connection is established, the two sides send cells
97 (specified below) to one another. Cells are sent serially. All
98 cells are 512 bytes long. Cells may be sent embedded in TLS
99 records of any size or divided across TLS records, but the framing
100 of TLS records MUST NOT leak information about the type or contents
103 TLS connections are not permanent. An OP or an OR may close a
104 connection to an OR if there are no circuits running over the
105 connection, and an amount of time (KeepalivePeriod, defaults to 5
108 (As an exception, directory servers may try to stay connected to all of
111 3. Cell Packet format
113 The basic unit of communication for onion routers and onion
114 proxies is a fixed-width "cell". Each cell contains the following
119 Payload (padded with 0 bytes) [509 bytes]
120 [Total size: 512 bytes]
122 The CircID field determines which circuit, if any, the cell is
125 The 'Command' field holds one of the following values:
126 0 -- PADDING (Padding) (See Sec 6.2)
127 1 -- CREATE (Create a circuit) (See Sec 4)
128 2 -- CREATED (Acknowledge create) (See Sec 4)
129 3 -- RELAY (End-to-end data) (See Sec 5)
130 4 -- DESTROY (Stop using a circuit) (See Sec 4)
131 5 -- CREATE_FAST (Create a circuit, no PK) (See sec 4)
132 6 -- CREATED_FAST (Circtuit created, no PK) (See Sec 4)
134 The interpretation of 'Payload' depends on the type of the cell.
135 PADDING: Payload is unused.
136 CREATE: Payload contains the handshake challenge.
137 CREATED: Payload contains the handshake response.
138 RELAY: Payload contains the relay header and relay body.
139 DESTROY: Payload contains a reason for closing the circuit.
141 Upon receiving any other value for the command field, an OR must
144 The payload is padded with 0 bytes.
146 PADDING cells are currently used to implement connection keepalive.
147 If there is no other traffic, ORs and OPs send one another a PADDING
148 cell every few minutes.
150 CREATE, CREATED, and DESTROY cells are used to manage circuits;
153 RELAY cells are used to send commands and data along a circuit; see
156 4. Circuit management
158 4.1. CREATE and CREATED cells
160 Users set up circuits incrementally, one hop at a time. To create a
161 new circuit, OPs send a CREATE cell to the first node, with the
162 first half of the DH handshake; that node responds with a CREATED
163 cell with the second half of the DH handshake plus the first 20 bytes
164 of derivative key data (see section 4.2). To extend a circuit past
165 the first hop, the OP sends an EXTEND relay cell (see section 5)
166 which instructs the last node in the circuit to send a CREATE cell
167 to extend the circuit.
169 The payload for a CREATE cell is an 'onion skin', which consists
170 of the first step of the DH handshake data (also known as g^x).
172 The data is encrypted to Bob's PK as follows: Suppose Bob's PK
173 modulus is L octets long. If the data to be encrypted is shorter
174 than L-42, then it is encrypted directly (with OAEP padding: see
175 ftp://ftp.rsasecurity.com/pub/pkcs/pkcs-1/pkcs-1v2-1.pdf). If the
176 data is at least as long as L-42, then a randomly generated 16-byte
177 symmetric key is prepended to the data, after which the first L-16-42
178 bytes of the data are encrypted with Bob's PK; and the rest of the
179 data is encrypted with the symmetric key.
181 So in this case, the onion skin can be thought of as:
183 OAEP padding [42 bytes]
184 Symmetric key [16 bytes]
185 First part of g^x [70 bytes]
186 Symmetrically encrypted:
187 Second part of g^x [58 bytes]
189 The relay payload for an EXTEND relay cell consists of:
192 Onion skin [186 bytes]
193 Identity fingerprint [20 bytes]
195 The port and address field denote the IPV4 address and port of the next
196 onion router in the circuit; the public key hash is the SHA1 hash of the
197 PKCS#1 ASN1 encoding of the next onion router's identity (signing) key.
198 (Including this hash allows the extending OR verify that it is indeed
199 connected to the correct target OR, and prevents certain man-in-the-middle
202 The payload for a CREATED cell, or the relay payload for an
203 EXTENDED cell, contains:
204 DH data (g^y) [128 bytes]
205 Derivative key data (KH) [20 bytes] <see 4.2 below>
207 The CircID for a CREATE cell is an arbitrarily chosen 2-byte integer,
208 selected by the node (OP or OR) that sends the CREATE cell. To prevent
209 CircID collisions, when one OR sends a CREATE cell to another, it chooses
210 from only one half of the possible values based on the ORs' public
211 identity keys: if the sending OR has a lower key, it chooses a CircID with
212 an MSB of 0; otherwise, it chooses a CircID with an MSB of 1.
214 Public keys are compared numerically by modulus.
216 As usual with DH, x and y MUST be generated randomly.
218 (Older versions of Tor compared OR nicknames, and did it in a broken and
219 unreliable way. To support versions of Tor earlier than 0.0.9pre6,
220 implementations should notice when the other side of a connection is
221 sending CREATE cells with the "wrong" MSB, and switch accordingly.)
223 4.1.1. CREATE_FAST/CREATED_FAST cells
225 When initializing the first hop of a circuit, the OP has already
226 established the OR's identity and negotiated a secret key using TLS.
227 Because of this, it is not always necessary for the OP to perform the
228 public key operations to create a circuit. In this case, the
229 OP MAY send a CREATE_FAST cell instead of a CREATE cell for the first
230 hop only. The OR responds with a CREATED_FAST cell, and the circuit is
233 A CREATE_FAST cell contains:
235 Key material (X) [20 bytes]
237 A CREATED_FAST cell contains:
239 Key material (Y) [20 bytes]
240 Derivative key data [20 bytes] (See 4.2 below)
242 The values of X and Y must be generated randomly.
244 [Versions of Tor before 0.1.0.6-rc did not support these cell types;
245 clients should not send CREATE_FAST cells to older Tor servers.]
247 4.2. Setting circuit keys
249 Once the handshake between the OP and an OR is completed, both can
250 now calculate g^xy with ordinary DH. Before computing g^xy, both client
251 and server MUST verify that the received g^x or g^y value is not degenerate;
252 that is, it must be strictly greater than 1 and strictly less than p-1
253 where p is the DH modulus. Implementations MUST NOT complete a handshake
254 with degenerate keys. Implementions MAY discard other "weak" g^x values.
256 (Discarding degenerate keys is critical for security; if bad keys are not
257 discarded, an attacker can substitute the server's CREATED cell's g^y with
258 0 or 1, thus creating a known g^xy and impersonating the server.)
260 (The mainline Tor implementation, in the 0.1.1.x-alpha series, discarded
261 all g^x values less than 2^24, greater than p-2^24, or having more than
262 1024-16 identical bits. This served no useful purpose, and we stopped.)
264 If CREATE or EXTEND is used to extend a circuit, the client and server
265 base their key material on K0=g^xy, represented as a big-endian unsigned
268 If CREATE_FAST is used, the client and server base their key material on
271 From the base key material K0, they compute 100 bytes of derivative
272 key data as K = SHA1(K0 | [00]) | SHA1(K0 | [01]) | ... SHA1(K0 |
273 [04]) where "00" is a single octet whose value is zero, [01] is a
274 single octet whose value is one, etc. The first 20 bytes of K form
275 KH, bytes 21-40 form the forward digest Df, 41-60 form the backward
276 digest Db, 61-76 form Kf, and 77-92 form Kb.
278 KH is used in the handshake response to demonstrate knowledge of the
279 computed shared key. Df is used to seed the integrity-checking hash
280 for the stream of data going from the OP to the OR, and Db seeds the
281 integrity-checking hash for the data stream from the OR to the OP. Kf
282 is used to encrypt the stream of data going from the OP to the OR, and
283 Kb is used to encrypt the stream of data going from the OR to the OP.
285 4.3. Creating circuits
287 When creating a circuit through the network, the circuit creator
288 (OP) performs the following steps:
290 1. Choose an onion router as an exit node (R_N), such that the onion
291 router's exit policy includes at least one pending stream that
292 needs a circuit (if there are any).
294 2. Choose a chain of (N-1) onion routers
295 (R_1...R_N-1) to constitute the path, such that no router
296 appears in the path twice.
298 3. If not already connected to the first router in the chain,
299 open a new connection to that router.
301 4. Choose a circID not already in use on the connection with the
302 first router in the chain; send a CREATE cell along the
303 connection, to be received by the first onion router.
305 5. Wait until a CREATED cell is received; finish the handshake
306 and extract the forward key Kf_1 and the backward key Kb_1.
308 6. For each subsequent onion router R (R_2 through R_N), extend
311 To extend the circuit by a single onion router R_M, the OP performs
314 1. Create an onion skin, encrypted to R_M's public key.
316 2. Send the onion skin in a relay EXTEND cell along
317 the circuit (see section 5).
319 3. When a relay EXTENDED cell is received, verify KH, and
320 calculate the shared keys. The circuit is now extended.
322 When an onion router receives an EXTEND relay cell, it sends a CREATE
323 cell to the next onion router, with the enclosed onion skin as its
324 payload. The initiating onion router chooses some circID not yet
325 used on the connection between the two onion routers. (But see
326 section 4.1. above, concerning choosing circIDs based on
327 lexicographic order of nicknames.)
329 When an onion router receives a CREATE cell, if it already has a
330 circuit on the given connection with the given circID, it drops the
331 cell. Otherwise, after receiving the CREATE cell, it completes the
332 DH handshake, and replies with a CREATED cell. Upon receiving a
333 CREATED cell, an onion router packs it payload into an EXTENDED relay
334 cell (see section 5), and sends that cell up the circuit. Upon
335 receiving the EXTENDED relay cell, the OP can retrieve g^y.
337 (As an optimization, OR implementations may delay processing onions
338 until a break in traffic allows time to do so without harming
339 network latency too greatly.)
341 4.4. Tearing down circuits
343 Circuits are torn down when an unrecoverable error occurs along
344 the circuit, or when all streams on a circuit are closed and the
345 circuit's intended lifetime is over. Circuits may be torn down
346 either completely or hop-by-hop.
348 To tear down a circuit completely, an OR or OP sends a DESTROY
349 cell to the adjacent nodes on that circuit, using the appropriate
352 Upon receiving an outgoing DESTROY cell, an OR frees resources
353 associated with the corresponding circuit. If it's not the end of
354 the circuit, it sends a DESTROY cell for that circuit to the next OR
355 in the circuit. If the node is the end of the circuit, then it tears
356 down any associated edge connections (see section 5.1).
358 After a DESTROY cell has been processed, an OR ignores all data or
359 destroy cells for the corresponding circuit.
361 To tear down part of a circuit, the OP may send a RELAY_TRUNCATE cell
362 signaling a given OR (Stream ID zero). That OR sends a DESTROY
363 cell to the next node in the circuit, and replies to the OP with a
364 RELAY_TRUNCATED cell.
366 When an unrecoverable error occurs along one connection in a
367 circuit, the nodes on either side of the connection should, if they
368 are able, act as follows: the node closer to the OP should send a
369 RELAY_TRUNCATED cell towards the OP; the node farther from the OP
370 should send a DESTROY cell down the circuit.
372 The payload of a RELAY_TRUNCATED or DESTROY cell contains a single octet,
373 describing why the circuit is being closed or truncated. When sending a
374 TRUNCATED or DESTROY cell because of another TRUNCATED or DESTROY cell,
375 the error code should be propagated. The origin of a circuit always sets
376 this error code to 0, to avoid leaking its version.
379 0 -- NONE (No reason given.)
380 1 -- PROTOCOL (Tor protocol violation.)
381 2 -- INTERNAL (Internal error.)
382 3 -- REQUESTED (A client sent a TRUNCATE command.)
383 4 -- HIBERNATING (Not currently operating; trying to save bandwidth.)
384 5 -- RESOURCELIMIT (Out of memory, sockets, or circuit IDs.)
385 6 -- CONNECTFAILED (Unable to reach server.)
386 7 -- OR_IDENTITY (Connected to server, but its OR identity was not
388 8 -- OR_CONN_CLOSED (The OR connection that was carrying this circuit
391 [Versions of Tor prior to 0.1.0.11 didn't sent versions; implementations
392 MUST accept empty TRUNCATED and DESTROY cells.]
394 4.5. Routing relay cells
396 When an OR receives a RELAY cell, it checks the cell's circID and
397 determines whether it has a corresponding circuit along that
398 connection. If not, the OR drops the RELAY cell.
400 Otherwise, if the OR is not at the OP edge of the circuit (that is,
401 either an 'exit node' or a non-edge node), it de/encrypts the payload
402 with AES/CTR, as follows:
403 'Forward' relay cell (same direction as CREATE):
404 Use Kf as key; decrypt.
405 'Back' relay cell (opposite direction from CREATE):
406 Use Kb as key; encrypt.
407 Note that in counter mode, decrypt and encrypt are the same operation.
409 The OR then decides whether it recognizes the relay cell, by
410 inspecting the payload as described in section 5.1 below. If the OR
411 recognizes the cell, it processes the contents of the relay cell.
412 Otherwise, it passes the decrypted relay cell along the circuit if
413 the circuit continues. If the OR at the end of the circuit
414 encounters an unrecognized relay cell, an error has occurred: the OR
415 sends a DESTROY cell to tear down the circuit.
417 When a relay cell arrives at an OP, the OP decrypts the payload
418 with AES/CTR as follows:
419 OP receives data cell:
421 Decrypt with Kb_I. If the payload is recognized (see
422 section 5.1), then stop and process the payload.
424 For more information, see section 5 below.
426 5. Application connections and stream management
430 Within a circuit, the OP and the exit node use the contents of
431 RELAY packets to tunnel end-to-end commands and TCP connections
432 ("Streams") across circuits. End-to-end commands can be initiated
433 by either edge; streams are initiated by the OP.
435 The payload of each unencrypted RELAY cell consists of:
436 Relay command [1 byte]
437 'Recognized' [2 bytes]
443 The relay commands are:
444 1 -- RELAY_BEGIN [forward]
445 2 -- RELAY_DATA [forward or backward]
446 3 -- RELAY_END [forward or backward]
447 4 -- RELAY_CONNECTED [backward]
448 5 -- RELAY_SENDME [forward or backward]
449 6 -- RELAY_EXTEND [forward]
450 7 -- RELAY_EXTENDED [backward]
451 8 -- RELAY_TRUNCATE [forward]
452 9 -- RELAY_TRUNCATED [backward]
453 10 -- RELAY_DROP [forward or backward]
454 11 -- RELAY_RESOLVE [forward]
455 12 -- RELAY_RESOLVED [backward]
457 Commands labelled as "forward" must only be sent by the originator
458 of the circuit. Commands labelled as "backward" must only be sent by
459 other nodes in the circuit back to the originator. Commands marked
460 as either can be sent either by the originator or other nodes.
462 The 'recognized' field in any unencrypted relay payload is always set
463 to zero; the 'digest' field is computed as the first four bytes of
464 the running SHA-1 digest of all the bytes that have been destined for
465 this hop of the circuit or originated from this hop of the circuit,
466 seeded from Df or Db respectively (obtained in section 4.2 above),
467 and including this RELAY cell's entire payload (taken with the digest
470 When the 'recognized' field of a RELAY cell is zero, and the digest
471 is correct, the cell is considered "recognized" for the purposes of
472 decryption (see section 4.5 above).
474 (The digest does not include any bytes from relay cells that do
475 not start or end at this hop of the circuit. That is, it does not
476 include forwarded data. Therefore if 'recognized' is zero but the
477 digest does not match, the running digest at that node should
478 not be updated, and the cell should be forwarded on.)
480 All RELAY cells pertaining to the same tunneled stream have the
481 same stream ID. StreamIDs are chosen arbitrarily by the OP. RELAY
482 cells that affect the entire circuit rather than a particular
483 stream use a StreamID of zero.
485 The 'Length' field of a relay cell contains the number of bytes in
486 the relay payload which contain real payload data. The remainder of
487 the payload is padded with NUL bytes.
489 If the RELAY cell is recognized but the relay command is not
490 understood, the cell must be dropped and ignored. Its contents
491 still count with respect to the digests, though. [Before
492 0.1.1.10, Tor closed circuits when it received an unknown relay
493 command. Perhaps this will be more forward-compatible. -RD]
495 5.2. Opening streams and transferring data
497 To open a new anonymized TCP connection, the OP chooses an open
498 circuit to an exit that may be able to connect to the destination
499 address, selects an arbitrary StreamID not yet used on that circuit,
500 and constructs a RELAY_BEGIN cell with a payload encoding the address
501 and port of the destination host. The payload format is:
503 ADDRESS | ':' | PORT | [00]
505 where ADDRESS can be a DNS hostname, or an IPv4 address in
506 dotted-quad format, or an IPv6 address surrounded by square brackets;
507 and where PORT is encoded in decimal.
509 [What is the [00] for? -NM]
510 [It's so the payload is easy to parse out with string funcs -RD]
512 Upon receiving this cell, the exit node resolves the address as
513 necessary, and opens a new TCP connection to the target port. If the
514 address cannot be resolved, or a connection can't be established, the
515 exit node replies with a RELAY_END cell. (See 5.4 below.)
516 Otherwise, the exit node replies with a RELAY_CONNECTED cell, whose
517 payload is in one of the following formats:
518 The IPv4 address to which the connection was made [4 octets]
519 A number of seconds (TTL) for which the address may be cached [4 octets]
521 Four zero-valued octets [4 octets]
522 An address type (6) [1 octet]
523 The IPv6 address to which the connection was made [16 octets]
524 A number of seconds (TTL) for which the address may be cached [4 octets]
525 [XXXX Versions of Tor before 0.1.1.6 ignore and do not generate the TTL
526 field. No version of Tor currently generates the IPv6 format.]
528 The OP waits for a RELAY_CONNECTED cell before sending any data.
529 Once a connection has been established, the OP and exit node
530 package stream data in RELAY_DATA cells, and upon receiving such
531 cells, echo their contents to the corresponding TCP stream.
532 RELAY_DATA cells sent to unrecognized streams are dropped.
534 Relay RELAY_DROP cells are long-range dummies; upon receiving such
535 a cell, the OR or OP must drop it.
539 When an anonymized TCP connection is closed, or an edge node
540 encounters error on any stream, it sends a 'RELAY_END' cell along the
541 circuit (if possible) and closes the TCP connection immediately. If
542 an edge node receives a 'RELAY_END' cell for any stream, it closes
543 the TCP connection completely, and sends nothing more along the
544 circuit for that stream.
546 The payload of a RELAY_END cell begins with a single 'reason' byte to
547 describe why the stream is closing, plus optional data (depending on
548 the reason.) The values are:
550 1 -- REASON_MISC (catch-all for unlisted reasons)
551 2 -- REASON_RESOLVEFAILED (couldn't look up hostname)
552 3 -- REASON_CONNECTREFUSED (remote host refused connection) [*]
553 4 -- REASON_EXITPOLICY (OR refuses to connect to host or port)
554 5 -- REASON_DESTROY (Circuit is being destroyed)
555 6 -- REASON_DONE (Anonymized TCP connection was closed)
556 7 -- REASON_TIMEOUT (Connection timed out, or OR timed out
558 8 -- (unallocated) [**]
559 9 -- REASON_HIBERNATING (OR is temporarily hibernating)
560 10 -- REASON_INTERNAL (Internal error at the OR)
561 11 -- REASON_RESOURCELIMIT (OR has no resources to fulfill request)
562 12 -- REASON_CONNRESET (Connection was unexpectedly reset)
563 13 -- REASON_TORPROTOCOL (Sent when closing connection because of
564 Tor protocol violations.)
566 (With REASON_EXITPOLICY, the 4-byte IPv4 address or 16-byte IPv6 address
567 forms the optional data; no other reason currently has extra data.
568 As of 0.1.1.6, the body also contains a 4-byte TTL.)
570 OPs and ORs MUST accept reasons not on the above list, since future
571 versions of Tor may provide more fine-grained reasons.
573 [*] Older versions of Tor also send this reason when connections are
575 [**] Due to a bug in versions of Tor through 0095, error reason 8 must
576 remain allocated until that version is obsolete.
578 --- [The rest of this section describes unimplemented functionality.]
580 Because TCP connections can be half-open, we follow an equivalent
581 to TCP's FIN/FIN-ACK/ACK protocol to close streams.
583 An exit connection can have a TCP stream in one of three states:
584 'OPEN', 'DONE_PACKAGING', and 'DONE_DELIVERING'. For the purposes
585 of modeling transitions, we treat 'CLOSED' as a fourth state,
586 although connections in this state are not, in fact, tracked by the
589 A stream begins in the 'OPEN' state. Upon receiving a 'FIN' from
590 the corresponding TCP connection, the edge node sends a 'RELAY_FIN'
591 cell along the circuit and changes its state to 'DONE_PACKAGING'.
592 Upon receiving a 'RELAY_FIN' cell, an edge node sends a 'FIN' to
593 the corresponding TCP connection (e.g., by calling
594 shutdown(SHUT_WR)) and changing its state to 'DONE_DELIVERING'.
596 When a stream in already in 'DONE_DELIVERING' receives a 'FIN', it
597 also sends a 'RELAY_FIN' along the circuit, and changes its state
598 to 'CLOSED'. When a stream already in 'DONE_PACKAGING' receives a
599 'RELAY_FIN' cell, it sends a 'FIN' and changes its state to
602 If an edge node encounters an error on any stream, it sends a
603 'RELAY_END' cell (if possible) and closes the stream immediately.
605 5.4. Remote hostname lookup
607 To find the address associated with a hostname, the OP sends a
608 RELAY_RESOLVE cell containing the hostname to be resolved. (For a reverse
609 lookup, the OP sends a RELAY_RESOLVE cell containing an in-addr.arpa
610 address.) The OR replies with a RELAY_RESOLVED cell containing a status
611 byte, and any number of answers. Each answer is of the form:
614 Value (variable-width)
616 "Length" is the length of the Value field.
621 0xF0 -- Error, transient
622 0xF1 -- Error, nontransient
624 If any answer has a type of 'Error', then no other answer may be given.
626 The RELAY_RESOLVE cell must use a nonzero, distinct streamID; the
627 corresponding RELAY_RESOLVED cell must use the same streamID. No stream
628 is actually created by the OR when resolving the name.
634 Each node should do appropriate bandwidth throttling to keep its
637 Communicants rely on TCP's default flow control to push back when they
642 Currently nodes are not required to do any sort of link padding or
643 dummy traffic. Because strong attacks exist even with link padding,
644 and because link padding greatly increases the bandwidth requirements
645 for running a node, we plan to leave out link padding until this
646 tradeoff is better understood.
648 6.3. Circuit-level flow control
650 To control a circuit's bandwidth usage, each OR keeps track of
651 two 'windows', consisting of how many RELAY_DATA cells it is
652 allowed to package for transmission, and how many RELAY_DATA cells
653 it is willing to deliver to streams outside the network.
654 Each 'window' value is initially set to 1000 data cells
655 in each direction (cells that are not data cells do not affect
656 the window). When an OR is willing to deliver more cells, it sends a
657 RELAY_SENDME cell towards the OP, with Stream ID zero. When an OR
658 receives a RELAY_SENDME cell with stream ID zero, it increments its
661 Each of these cells increments the corresponding window by 100.
663 The OP behaves identically, except that it must track a packaging
664 window and a delivery window for every OR in the circuit.
666 An OR or OP sends cells to increment its delivery window when the
667 corresponding window value falls under some threshold (900).
669 If a packaging window reaches 0, the OR or OP stops reading from
670 TCP connections for all streams on the corresponding circuit, and
671 sends no more RELAY_DATA cells until receiving a RELAY_SENDME cell.
672 [this stuff is badly worded; copy in the tor-design section -RD]
674 6.4. Stream-level flow control
676 Edge nodes use RELAY_SENDME cells to implement end-to-end flow
677 control for individual connections across circuits. Similarly to
678 circuit-level flow control, edge nodes begin with a window of cells
679 (500) per stream, and increment the window by a fixed value (50)
680 upon receiving a RELAY_SENDME cell. Edge nodes initiate RELAY_SENDME
681 cells when both a) the window is <= 450, and b) there are less than
682 ten cell payloads remaining to be flushed at that edge.
684 7. Directories and routers
686 7.1. Extensible information format
688 Router descriptors and directories both obey the following lightweight
689 extensible information format.
691 The highest level object is a Document, which consists of one or more Items.
692 Every Item begins with a KeywordLine, followed by one or more Objects. A
693 KeywordLine begins with a Keyword, optionally followed by whitespace and more
694 non-newline characters, and ends with a newline. A Keyword is a sequence of
695 one or more characters in the set [A-Za-z0-9-]. An Object is a block of
696 encoded data in pseudo-Open-PGP-style armor. (cf. RFC 2440)
700 Document ::= (Item | NL)+
701 Item ::= KeywordLine Object*
702 KeywordLine ::= Keyword NL | Keyword WS ArgumentsChar+ NL
703 Keyword = KeywordChar+
704 KeywordChar ::= 'A' ... 'Z' | 'a' ... 'z' | '0' ... '9' | '-'
705 ArgumentChar ::= any printing ASCII character except NL.
707 Object ::= BeginLine Base-64-encoded-data EndLine
708 BeginLine ::= "-----BEGIN " Keyword "-----" NL
709 EndLine ::= "-----END " Keyword "-----" NL
711 The BeginLine and EndLine of an Object must use the same keyword.
713 When interpreting a Document, software MUST reject any document containing a
714 KeywordLine that starts with a keyword it doesn't recognize.
716 The "opt" keyword is reserved for non-critical future extensions. All
717 implementations MUST ignore any item of the form "opt keyword ....." when
718 they would not recognize "keyword ....."; and MUST treat "opt keyword ....."
719 as synonymous with "keyword ......" when keyword is recognized.
721 7.2. Router descriptor format.
723 Every router descriptor MUST start with a "router" Item; MUST end with a
724 "router-signature" Item and an extra NL; and MUST contain exactly one
725 instance of each of the following Items: "published" "onion-key" "link-key"
726 "signing-key" "bandwidth". Additionally, a router descriptor MAY contain any
727 number of "accept", "reject", "fingerprint", "uptime", and "opt" Items.
728 Other than "router" and "router-signature", the items may appear in any
731 The items' formats are as follows:
732 "router" nickname address ORPort SocksPort DirPort
734 Indicates the beginning of a router descriptor. "address"
735 must be an IPv4 address in dotted-quad format. The last
736 three numbers indicate the TCP ports at which this OR exposes
737 functionality. ORPort is a port at which this OR accepts TLS
738 connections for the main OR protocol; SocksPort is deprecated and
739 should always be 0; and DirPort is the port at which this OR accepts
740 directory-related HTTP connections. If any port is not supported,
741 the value 0 is given instead of a port number.
743 "bandwidth" bandwidth-avg bandwidth-burst bandwidth-observed
745 Estimated bandwidth for this router, in bytes per second. The
746 "average" bandwidth is the volume per second that the OR is willing
747 to sustain over long periods; the "burst" bandwidth is the volume
748 that the OR is willing to sustain in very short intervals. The
749 "observed" value is an estimate of the capacity this server can
750 handle. The server remembers the max bandwidth sustained output
751 over any ten second period in the past day, and another sustained
752 input. The "observed" value is the lesser of these two numbers.
756 A human-readable string describing the system on which this OR is
757 running. This MAY include the operating system, and SHOULD include
758 the name and version of the software implementing the Tor protocol.
760 "published" YYYY-MM-DD HH:MM:SS
762 The time, in GMT, when this descriptor was generated.
766 A fingerprint (20 byte SHA1 hash of asn1 encoded public key, encoded
767 in hex, with a single space after every 4 characters) for this router's
770 [We didn't start parsing this line until Tor 0.1.0.6-rc; it should
771 be marked with "opt" until earlier versions of Tor are obsolete.]
775 If the value is 1, then the Tor server was hibernating when the
776 descriptor was published, and shouldn't be used to build circuits.
778 [We didn't start parsing this line until Tor 0.1.0.6-rc; it should
779 be marked with "opt" until earlier versions of Tor are obsolete.]
783 The number of seconds that this OR process has been running.
785 "onion-key" NL a public key in PEM format
787 This key is used to encrypt EXTEND cells for this OR. The key MUST
788 be accepted for at least XXXX hours after any new key is published in
789 a subsequent descriptor.
791 "signing-key" NL a public key in PEM format
793 The OR's long-term identity key.
798 These lines, in order, describe the rules that an OR follows when
799 deciding whether to allow a new stream to a given address. The
800 'exitpattern' syntax is described below.
802 "router-signature" NL Signature NL
804 The "SIGNATURE" object contains a signature of the PKCS1-padded SHA1
805 hash of the entire router descriptor, taken from the beginning of the
806 "router" line, through the newline after the "router-signature" line.
807 The router descriptor is invalid unless the signature is performed
808 with the router's identity key.
812 Describes a way to contact the server's administrator, preferably
813 including an email address and a PGP key fingerprint.
817 'Names' is a whitespace-separated list of server nicknames. If two ORs
818 list one another in their "family" entries, then OPs should treat them
819 as a single OR for the purpose of path selection.
821 For example, if node A's descriptor contains "family B", and node B's
822 descriptor contains "family A", then node A and node B should never
823 be used on the same circuit.
825 "read-history" YYYY-MM-DD HH:MM:SS (NSEC s) NUM,NUM,NUM,NUM,NUM... NL
826 "write-history" YYYY-MM-DD HH:MM:SS (NSEC s) NUM,NUM,NUM,NUM,NUM... NL
828 Declare how much bandwidth the OR has used recently. Usage is divided
829 into intervals of NSEC seconds. The YYYY-MM-DD HH:MM:SS field defines
830 the end of the most recent interval. The numbers are the number of
831 bytes used in the most recent intervals, ordered from oldest to newest.
833 [We didn't start parsing these lines until Tor 0.1.0.6-rc; they should
834 be marked with "opt" until earlier versions of Tor are obsolete.]
836 nickname ::= between 1 and 19 alphanumeric characters, case-insensitive.
838 exitpattern ::= addrspec ":" portspec
839 portspec ::= "*" | port | port "-" port
840 port ::= an integer between 1 and 65535, inclusive.
841 addrspec ::= "*" | ip4spec | ip6spec
842 ipv4spec ::= ip4 | ip4 "/" num_ip4_bits | ip4 "/" ip4mask
843 ip4 ::= an IPv4 address in dotted-quad format
844 ip4mask ::= an IPv4 mask in dotted-quad format
845 num_ip4_bits ::= an integer between 0 and 32
846 ip6spec ::= ip6 | ip6 "/" num_ip6_bits
847 ip6 ::= an IPv6 address, surrounded by square brackets.
848 num_ip6_bits ::= an integer between 0 and 128
850 Ports are required; if they are not included in the router
851 line, they must appear in the "ports" lines.
853 7.3. Directory format
855 A Directory begins with a "signed-directory" item, followed by one each of
856 the following, in any order: "recommended-software", "published",
857 "router-status", "dir-signing-key". It may include any number of "opt"
858 items. After these items, a directory includes any number of router
859 descriptors, and a single "directory-signature" item.
863 Indicates the start of a directory.
865 "published" YYYY-MM-DD HH:MM:SS
867 The time at which this directory was generated and signed, in GMT.
871 The key used to sign this directory; see "signing-key" for format.
873 "recommended-software" comma-separated-version-list
875 A list of which versions of which implementations are currently
876 believed to be secure and compatible with the network.
878 "running-routers" whitespace-separated-list
880 A description of which routers are currently believed to be up or
881 down. Every entry consists of an optional "!", followed by either an
882 OR's nickname, or "$" followed by a hexadecimal encoding of the hash
883 of an OR's identity key. If the "!" is included, the router is
884 believed not to be running; otherwise, it is believed to be running.
885 If a router's nickname is given, exactly one router of that nickname
886 will appear in the directory, and that router is "approved" by the
887 directory server. If a hashed identity key is given, that OR is not
888 "approved". [XXXX The 'running-routers' line is only provided for
889 backward compatibility. New code should parse 'router-status'
892 "router-status" whitespace-separated-list
894 A description of which routers are currently believed to be up or
895 down, and which are verified or unverified. Contains one entry for
896 every router that the directory server knows. Each entry is of the
899 !name=$digest [Verified router, currently not live.]
900 name=$digest [Verified router, currently live.]
901 !$digest [Unverified router, currently not live.]
902 or $digest [Unverified router, currently live.]
904 (where 'name' is the router's nickname and 'digest' is a hexadecimal
905 encoding of the hash of the routers' identity key).
907 When parsing this line, clients should only mark a router as
908 'verified' if its nickname AND digest match the one provided.
910 "directory-signature" nickname-of-dirserver NL Signature
912 The signature is computed by computing the SHA-1 hash of the
913 directory, from the characters "signed-directory", through the newline
914 after "directory-signature". This digest is then padded with PKCS.1,
915 and signed with the directory server's signing key.
917 If software encounters an unrecognized keyword in a single router descriptor,
918 it MUST reject only that router descriptor, and continue using the
919 others. Because this mechanism is used to add 'critical' extensions to
920 future versions of the router descriptor format, implementation should treat
921 it as a normal occurrence and not, for example, report it to the user as an
922 error. [Versions of Tor prior to 0.1.1 did this.]
924 If software encounters an unrecognized keyword in the directory header,
925 it SHOULD reject the entire directory.
927 7.4. Network-status descriptor
929 A "network-status" (a.k.a "running-routers") document is a truncated
930 directory that contains only the current status of a list of nodes, not
931 their actual descriptors. It contains exactly one of each of the following
938 "published" YYYY-MM-DD HH:MM:SS
946 "directory-signature" NL signature
950 7.5. Behavior of a directory server
952 lists nodes that are connected currently
953 speaks HTTP on a socket, spits out directory on request
955 Directory servers listen on a certain port (the DirPort), and speak a
956 limited version of HTTP 1.0. Clients send either GET or POST commands.
957 The basic interactions are:
958 "%s %s HTTP/1.0\r\nContent-Length: %lu\r\nHost: %s\r\n\r\n",
959 command, url, content-length, host.
960 Get "/tor/" to fetch a full directory.
961 Get "/tor/dir.z" to fetch a compressed full directory.
962 Get "/tor/running-routers" to fetch a network-status descriptor.
963 Post "/tor/" to post a server descriptor, with the body of the
964 request containing the descriptor.
966 "host" is used to specify the address:port of the dirserver, so
967 the request can survive going through HTTP proxies.
969 A.1. Differences between spec and implementation
971 - The current specification requires all ORs to have IPv4 addresses, but
972 allows servers to exit and resolve to IPv6 addresses, and to declare IPv6
973 addresses in their exit policies. The current codebase has no IPv6
976 B. Things that should change in a later version of the Tor protocol
979 B.1. ... but which will require backward-incompatible change
981 - Circuit IDs should be longer.
983 - Maybe, keys should be longer.
984 - Drop backward compatibility.
985 - We should use a 128-bit subgroup of our DH prime.
986 - Handshake should use HMAC.
987 - Multiple cell lengths
988 - Ability to split circuits across paths (If this is useful.)
989 - SENDME windows should be dynamic.
992 - Stop ever mentioning socks ports
994 B.1. ... and that will require no changes
996 - Mention multiple addr/port combos
997 - Advertised outbound IP?
998 - Migrate streams across circuits.
1000 B.2. ... and that we have no idea how to do.
1002 - UDP (as transport)
1004 - Use a better AES mode that has built-in integrity checking,
1005 doesn't grow with the number of hops, is not patented, and
1006 is implemented and maintained by smart people.