Galtland Index

Tor

8 min read

Tor

Tor is the mix reborn for real time: a volunteer-run overlay that routes traffic through layered circuits so that no single relay ever sees both who you are and where you are going. It is the cypherpunk remailer’s usable descendant and — two decades after the 2004 design paper, by common repute rather than any claim in that paper — the internet’s most widely used anonymity and censorship-resistance network, a tool the United States government paid to build and now cannot easily switch off.

What Tor Is

Tor — the name derives from “the onion router” — is a distributed overlay network for anonymizing everyday TCP traffic — web browsing, chat, SSH, and the like. A user’s client builds a circuit through several volunteer-run relays and wraps each packet in nested layers of encryption, one per hop, so that each relay peels a single layer and forwards the rest. The entry relay sees the user but not the destination; the exit relay sees the destination but not the user; no relay in between sees either end. In the design paper’s phrase, “each server only knows the adjacent servers in the circuit.” The full mechanism — telescoping circuit construction, forward secrecy, directory servers, exit policies, rendezvous points — is documented in the 2004 paper by Roger Dingledine, Nick Mathewson, and Paul Syverson, cataloged here as Tor: The Second-Generation Onion Router; this page is about Tor as a living system and a political object, and defers the walkthrough to that reference.

The paper describes Tor as a “circuit-based low-latency anonymous” communication service, and every design choice is framed as a compromise among anonymity, usability, and efficiency. That framing is the key to the whole project. Tor deliberately does not try to win against the strongest imaginable attacker. “A global passive adversary is the most commonly assumed” threat in the anonymity literature, the authors note — and yet like all practical low-latency systems, Tor does not protect against one. An adversary who can watch both ends of a circuit can still correlate timing and volume and confirm who is talking to whom. Tor’s stated goal is narrower and honest: deployable anonymity against a realistic adversary who sees only part of the network — a system people will actually run, not a theoretical ideal nobody deploys.

From the Mix: The Real-Time Descendant

Tor is the low-latency heir to a lineage that begins with David Chaum’s 1981 mix and runs through the cypherpunks’ Anonymous Remailers. The remailer took Chaum’s design literally — batch messages, reorder them, strip correlations, and accept minutes or hours of delay as the price of resistance to traffic analysis. That delay is fatal for the interactive internet: you cannot browse or log in through a network that holds your packets for an hour. Tor keeps the mix’s two structural invariants and discards the latency. The first invariant is the anonymity set — you hide inside “the people a given user is hiding among”, so more honest users mean more cover for each. The second is that no participant is trusted with the whole path, exactly as in the mix chain. What Tor abandons is high-latency mixing itself; the design leaves reordering and padding out until some proven, convenient traffic-shaping scheme justifies its cost. The remailer bought resistance with delay; Tor buys usability by narrowing its threat model. David Chaum supplied the mathematics, and the Cypherpunk milieu supplied the appetite to run it as real infrastructure rather than as a paper.

Political Economy: Exits, Funding, and Hidden Services

Three tensions define Tor as a political object, and none of them are settled.

Exit nodes carry the network’s liability. A relay’s exit policy lets each operator advertise which destinations it will serve, because the paper’s own deployability rule is that the design “must not place a heavy liability burden” on operators. But someone’s traffic still leaves the network from a real machine with a real owner, and abuse complaints, police visits, and blocklists land on that owner. The authors are candid rather than triumphant here: “Exit abuse is a serious barrier to wide-scale Tor deployment”, and although they stress that Tor enables no new class of abuse — the same attacks are available more cheaply elsewhere — they concede that “preventing abuse of open exit nodes is an unsolved problem” and will “probably remain an arms race.” Because a network’s reputation is itself a security property, abuse that drives operators and users away literally shrinks everyone’s anonymity. Running an exit, in the paper’s dry formulation, requires “volunteers who can tolerate some political heat.”

Then the funding paradox. Onion routing was invented at the U.S. Naval Research Laboratory, where Syverson worked, and the 2004 paper’s own acknowledgments credit support from the Office of Naval Research and DARPA. The state built the thing the cypherpunks wanted, and the honest reading of that fact is contested, not settled. Suspicious observers treat government provenance as grounds to distrust the tool outright. The standard defense (an argument about the tool, not a claim in the paper) turns on the anonymity-set logic the paper does establish: a network hides each user among the others, so a funder that wants cover for its own traffic needs a crowd of unrelated users — which an open, widely used, source-auditable network supplies precisely by serving everyone else. Tor’s threat model, which openly declines to defend against a global passive adversary, is also frank about what a signals-intelligence agency could still do to it. The tool is real; the provenance is real; the tension is permanent, and a page that pretended otherwise would be cheerleading.

Third, hidden (onion) services invert the anonymity. Rendezvous points let an operator run a service, “such as a webserver, without revealing his IP address”, so publication itself becomes location-independent. The paper claims the network property (IP-address hiding); the political reading is the wiki’s: with no advertised location there is often no host to seize and no address to lean on — the property the remailer lineage sought for senders, extended to publishers. This is the concrete routing-layer mechanism behind Censorship Resistance: not a promise that speech is protected, but an architecture in which there is often no one to compel.

Why It Matters: Exit over Voice at the Routing Layer

For the libertarian and cypherpunk reading, Tor is exit made mechanical. Where politics offers voice — petition, vote, reform — cryptography offers exit: route around the control point rather than argue with it. The paper names the move in its own analysis of legal coercion, observing that “building circuits that cross jurisdictions can make” prosecution harder — a phenomenon it calls “jurisdictional arbitrage.” What Jurisdictional Competition does between states, a Tor circuit does within a single connection: it spreads one act of communication across enough legal boundaries that no one authority can compel the whole path. The paper’s own cautionary example is the rival Java Anon Proxy, whose operators a German court “forced […] to add a backdoor to their nodes” — precisely the single-jurisdiction compliance point that Tor’s topology is built to dissolve.

This is Crypto Anarchy compiled into routing, and it is why Tor sits near the center of the second crypto war. Where Crypto Wars 2 is fought largely through chokepoints the state can actually reach — app-store review, default settings, platform pressure, client-side-scanning mandates — Tor is awkward precisely because it offers no such chokepoint: no company to pressure, no default to flip, no update server whose keys compel the network. It is volunteer-run, open-source, and jurisdictionally smeared by construction. That does not make it invulnerable; traffic correlation, exit-node pressure, relay enumeration, and the sheer difficulty of recruiting operators are real and ongoing limits. But it makes Tor the hardest kind of target — infrastructure that routes around control rather than asking its permission.

See Also

Graph View

Backlinks