2. Connections
- There are two ways to connect to an OR. The first is as an onion
- proxy (OP), which allows the OP to authenticate the OR without
- authenticating itself. The second is as another OR, which allows
- mutual authentication.
+ There are two ways to connect to an onion router (OR). The first is
+ as an onion proxy (OP), which allows the OP to authenticate the OR
+ without authenticating itself. The second is as another OR, which
+ allows mutual authentication.
Tor uses TLS for link encryption, using the cipher suite
"TLS_DHE_RSA_WITH_AES_128_CBC_SHA". An OR always sends a
All parties receiving certificates must confirm that the public
key is as it appears in the server directory, and close the
- connection if it does not.
+ connection if it is not.
Once a TLS connection is established, the two sides send cells
(specified below) to one another. Cells are sent serially. All
of TLS records should not leak information about the type or
contents of the cells.
- OR-to-OR connections are never deliberately closed. OP-to-OR
- connections are closed when the OP has no more circuits running
- over a connection, and an amount of time (????) has passed.
+ OR-to-OR connections are never deliberately closed. An OP should
+ close a connection to an OR if there are no circuits running over
+ the connection, and an amount of time (KeepalivePeriod, defaults to
+ 5 minutes) has passed.
3. Cell Packet format