Onion Routing
A method in which data is encrypted multiple times and passed through several relays. Each relay removes only its own encryption layer and therefore knows only the previous and the next hop. Tor implements this with typically three relays. It protects the transport path, but does not replace end-to-end encryption to the destination.
The principle of shared ignorance
Onion routing distributes knowledge instead of hiding it. The client negotiates a separate key with each relay on the path and then wraps the data in as many layers. Each relay can open exactly one layer and finds only the address of the next hop. No participant knows sender and destination at the same time — not because the information is withheld, but because it is never present together anywhere on the path.
Distinct from end-to-end encryption
The onion layers exist between client and relays, not between client and destination. They are fully stripped once the data leaves the Exit Node. Onion routing therefore protects the transport path and the metadata, not the content as seen by the destination. The two together make a complete picture: HTTPS for the content, onion routing for the question of who is talking to whom.
Limits of the method
Against an observer who sees both the entry and the exit of the network at once, the principle only helps so far. Timing and volume can be compared at both ends and correlated. Tor makes this traffic analysis harder, but cannot rule it out against a global passive observer. Selection of the first hop therefore follows its own rules; see Guard Node.
A full walkthrough of all three hops is in What is Tor?.
Category: Technical