How TOR Works- Computerphile

Summary

This script delves into the intricacies of anonymization, focusing on onion routing and the Tor network. Developed in the mid-90s by US Naval research, onion routing enhances privacy by bouncing connections through multiple routers, encrypting messages at each layer to obscure the sender and receiver. The Tor browser exemplifies this, using a circuit of three nodes to maintain user anonymity. Despite potential speed drawbacks and the challenge of traffic analysis, Tor remains a powerful tool for privacy-conscious users, illustrating the delicate balance between security and surveillance.

Takeaways

• 🌐 Tor, short for 'The Onion Router', is an implementation of onion routing developed in the mid-90s by the US Naval Research Lab to provide anonymity online.
• 🔒 Onion routing differs from encryption in that it focuses on hiding the fact that a communication is taking place, rather than just the content of the communication.
• 🔄 The process of onion routing involves bouncing the connection through multiple layers of routers, each peeling away a layer of encryption to reveal the next destination.
• 🛡️ Tor uses three intermediate nodes in its implementation, known as hops, to create a path that is difficult to trace back to the origin.
• 🔑 Each node in the Tor network only knows the previous and next node in the circuit, not the entire path or the user's identity.
• 🔒 The encryption used in Tor is layered, with each node only able to decrypt the layer intended for it, ensuring that the message remains encrypted for the rest of its journey.
• 🌐 Users of Tor can remain anonymous to the server they are communicating with, as the final node is the only one that knows the server's identity and the user's request.
• 📈 While Tor provides anonymity, it can be slower due to the multiple hops and encryption/decryption processes involved in routing the data.
• 🕵️‍♂️ Despite the robustness of onion routing, traffic analysis can potentially de-anonymize users if an attacker controls both the entry and exit nodes of a circuit.
• 🔒 Tor messages, called 'cells', are always 512 bytes long to maintain consistency in message size and prevent attackers from gaining information through size variations.
• 🛠️ Tor can be used as a browser or a service to proxy other network traffic, and while it is not illegal, it is a powerful tool for maintaining privacy and anonymity online.

Q & A

What is the primary purpose of onion routing?

The primary purpose of onion routing is to provide anonymity to users by bouncing their connections between different routers, making it difficult to track the source of the communication.

What does Tor stand for and what is its relation to onion routing?

Tor stands for The Onion Router, and it is an implementation of onion routing, developed in the mid-90s by US Naval research.

How does onion routing differ from confidentiality provided by encryption?

While encryption ensures that the contents of a message cannot be read by unauthorized parties, onion routing focuses on ensuring that the communication itself is anonymous, so that even the fact that a message is being sent is hidden.

What is the typical number of hops used in the Tor implementation of onion routing?

In the Tor implementation, the typical number of hops used is three intermediate nodes.

Why is it important for the Tor network to have multiple intermediate nodes?

Multiple intermediate nodes are important because they help maintain anonymity by ensuring that no single node knows the entire path of the communication, only what's before and after it in the chain.

How does the encryption process work in onion routing?

In onion routing, messages are encrypted multiple times with different keys in layers. Each node in the network can only decrypt its own layer of encryption, revealing the next node in the path, without knowing the entire communication content or the source and destination.

What is the significance of using the same message size in onion routing?

Using the same message size ensures that all messages between any nodes in the network appear identical, making it impossible to determine the position of a message in the circuit or its content based on size, which enhances anonymity.

How does the Tor browser differ from a regular browser in terms of privacy?

The Tor browser is designed to route all traffic through the Tor network, creating a circuit through multiple nodes to ensure anonymity. Regular browsers do not have this built-in functionality and rely on the user's IP address for web requests.

What are some potential downsides of using the Tor network?

Some potential downsides include slower internet speeds due to multiple hops, the possibility of traffic analysis to de-anonymize users, and the reliance on the trustworthiness of the intermediate nodes.

How can an attacker potentially de-anonymize a Tor user?

An attacker could potentially de-anonymize a Tor user by conducting traffic analysis, correlating patterns of encrypted messages at different points in the network, and identifying matching patterns at the entry and exit nodes.

What measures can be taken to mitigate the risk of de-anonymization on the Tor network?

Measures include using trusted guard nodes, ensuring the use of HTTPS or TLS for end-to-end encryption, and being vigilant about the types of activities performed over the Tor network to avoid revealing identifiable information.