The encyclopedia · Software & IT · Technical decision · 2004
Tor hid who talks to whom by wrapping traffic in onion layers
Tor routes traffic through relays that each see only one hop, so no single node knows both sender and destination — no special privileges needed.
Tor Project (Free Haven Project)
The solution
On the open internet, a proxy that anonymizes your traffic sees everything you do, and early onion routing pre-built whole encrypted paths, so one compromised node could undo the anonymity.
Tor (2004) builds each circuit incrementally: the initiator negotiates a fresh session key with every successive relay and deletes old keys as it moves on, adding perfect forward secrecy, congestion control, integrity checking and directory servers.
It runs on the real-world internet with no special privileges or kernel modifications, and the first deployment linked an international network of more than 30 volunteer nodes.
Because no relay ever holds both the source and the destination, no single operator — even a compromised one — can de-anonymize the user.
Why it worked
- Layered encryption means no relay sees both source and destination.
- Telescoping lets a failed hop be rebuilt instead of losing the circuit.
- Deleting old keys protects recorded traffic from future compromise.
- No special privileges lowered the barrier for volunteers to run relays.
What can be applied
If no single party may be trusted with the whole secret, split the secret across parties so each holds a useless fragment — anonymity from the crowd instead of from one gatekeeper.
Aftermath
The design became the Tor anonymity network run by the nonprofit Tor Project, still the standard tool for private browsing, journalism and censorship circumvention.
Sources
- Tor: The Second-Generation Onion Router (13th USENIX Security Symposium)
- Tor: The Second-Generation Onion Router (paper PDF)
- Tor (network) — history and operation
spotted an error? The archive wants to know.