How Onion Routing Works

This is part of a series of articles on Privacy Enhancing Technologies (PET) – clever techniques to help protect our data, at rest and in motion. While onion routing isn’t new, it’s a powerful and little-understood tool for protecting your identity on the web.

A Little Background First

Onion routing is a technique for masking the origin of a message by wrapping the message “envelope” in layers of obfuscation – like layers of an onion. It was pioneered by the US Navy and the Defense Advanced Research Projects Agency (DARPA) back in the mid-to-late 1990s and released to the public. This then led to the creation of The Onion Routing project (Tor) in the early 2000’s, supported by groups like the Electronic Frontier Foundation (EFF).

When we surf the internet (from any device), we communicate using the Internet Protocol (IP). To send digital packets of information across the room or across the globe, we address them like we address a letter in the mail with a ‘from’ and a ‘to’ address. These IP addresses look like 192.1.1.23 or 34.174.87.100. Your IP address is assigned to you by your Internet Service Provider (ISP). While you might at first think of your home internet provider (fiber, cable, etc.), your ISP is really just any entity who controls the access point you’re currently using to connect to the internet. That could be the coffee shop, airport, hotel, or your cellular provider.

Your IP address can be used to identify you. Your home ISP or cellular provider actually knows what name is associated with the IP address they gave your device. But even when using public WiFi, your IP address will be the same for every website you visit, correlating your identity across the sites. It would be like reading your car’s license plate – it’s associated with the owner of the car. Even with a rental car, it could be tied to you by getting records from the car rental company. So if you want to try to surf the web anonymously, you want to hide your IP address from the websites you visit.

Masking Your IP Address

The primary tool we use to mask our IP address from the sits we visit is by using a Virtual Private Network (VPN). However, VPN’s are not a silver bullet for privacy, despite what many services will claim. You should read my article on this, but the short version is that you’re really just shifting your trust from your ISP to the VPN provider. Your VPN provider will still know your real IP address and what websites you’ve visiting. If they log this information, then your mask can still be removed later. Nevertheless, it’s still a useful tool and we’ll come back to it later.

Another, more complicated way to mask your IP address is to use onion routing. Let’s first explain this with an analogy. Alice wants to send a letter to Bob, but doesn’t want Bob to know who sent it. In fact, she doesn’t want anyone to be able to trace the letter back to her. There’s an anonymous delivery service that caters to this need. They have a large set of workers who know how to route packages privately. Each worker has a lockbox they provide with a unique key. Alice obtains two lockboxes from the private delivery service from two random workers, Charlie and Dave. She puts her letter to Bob in Dave’s box, locking it with Dave’s key. She then puts that in the box from Charlie, locking it with Charlie’s key.

She sends the set of nested boxes to Charlie. Charlie opens the outside box with his key and finds the box inside. Charlie knows he got a box from Alice, but doesn’t know what’s in Alice’s message to Bob or even that the message is destined for Bob. Charlie sends this inner box to Dave. Dave opens the inner box with his key and finds the letter to Bob. Dave knows that Bob is getting a letter from someone, but has no idea who sent it or what it contains. Dave sends the letter to Bob. Bob can read the letter, but only knows that it came from Dave. That’s it. That’s onion routing in a nutshell. Now let’s see how it really works.

Peeling the Onion

Real onion routing works very much like the nested box scenario. In fact, Apple’s Private Relay (and the newer Obscura VPN) works almost exactly like this because it uses two intermediate nodes. Tor onion routing adds a third node to the “circuit” for one extra layer of privacy protection. Let’s revisit the nested package analogy, this time using nodes N1 and N2 to represent Charlie and Dave. In the onion routing network, these nodes are chosen at random using special algorithms. The nodes change with new connections, but not always at the same rate – that is, the first node may change less often than subsequent nodes. There’s a lot of science behind all of this that trades off efficiency and privacy.

The nested addressing mechanism is shown in the diagram below. (Again, Tor actually uses three nodes, but I’ve shown two here to make it simpler.)

You can see that the layers of the “onion” are peeled off one at a time at each node in the circuit. Notice that node N1 knows the message comes from Alice, but doesn’t know who it’s ultimately destined for. And node N2 knows that the letter is destined for Bob, but doesn’t know who sent it originally. Similarly, when surfing the web through an onion routing network, the first node knows who’s making the request but not the where it’s going and the last node knows where the request is going but not who sent it. And if Bob responds to Alice, the process works the same in reverse, adding layers as it traverses the path. Alice has all the keys and can unlock all the boxes.

Internet connections are often thought of as a series of tubes or pipes (famously by Senator Ted Stevens). Onion routing therefore is often depicted as a set of concentric pipes between the nodes, one pipe (layer) being removed at each node. The process for selecting the nodes for any given connection and extending the connection step-wise through them to the final destination is fairly complex. As the connection is extended, a nifty process called Diffie-Hellman key exchange takes place to securely retrieve the encryption keys from each node that is then used to “lock” each layer of the nested package.

The bottom line is that the Tor network effectively masks your IP address, which could give away your identity, to the websites you visit.

How to Use Onion Routing

So, how do you actually use onion routing? Well, if you’re an Apple user and you’re paying for iCloud+, you can use Apple Private Relay (see this article for help setting it up). Note that currently it only works with Apple’s Safari browser and not in all regions of the world, which sucks. Privacy enhancing technologies should be available to everyone, on any system or browser.

But the easiest way to use onion routing is to download and run the Tor Browser. Now before I even link to that browser, you need to know a few things. First of all, the Tor network can be very slow – adding all those intermediate nodes and layers of encryption has a cost. Second, it is possible for ISPs to recognize Tor traffic – not the contents, but the fact that you’re using the Tor network – just like it’s often possible to tell that someone is using a VPN. Let me be clear: this should not be a bad thing. Wanting privacy and using privacy-enhancing tech to get it doesn’t make you a criminal. The Tor Browser can be used to access the dark web – which sounds scary, but it’s mostly just different. Anyway, some countries and even some organizations will try to detect and block the use of Tor. So, before you use the Tor network (specifically), you should think about why you want to use it. This article from Privacy Guides does an excellent job of explaining all of this.

I personally have used the Tor Browser many times at home, just to play around with it. But when I do, I usually connect to my VPN first – which will mask the fact that I’m using Tor from my ISP (but not my VPN provider). Again, that article explains how and why to do this. It’s a bummer that it matters. Wanting real privacy should not have any stigma.

So, after all that, if you’d like to try it out, you can download the Tor Browser here. Tor Browser is based off Firefox and comes with lots of strict privacy settings and mechanisms enabled by default that can help to defeat tricky tracking techniques like browser fingerprinting, though it’s not perfect. The main thing it will do – and do very well – is mask your real IP address. This is a list of some totally legit, non-crimey onion sites you can check out.

Some Final Thoughts

Note that masking your IP address can have some weird side effects. For example, your approximate location can be determined by looking at your IP address, which is often used to recommend local stores when shopping or give you the local weather forecast without asking for your location. It can also be used to choose a default language for the entire website. You can test this yourself – check out this web location tool. If your masked IP doesn’t match your real IP location, you may see some strange results on web pages that try to use your IP to offer you localized results.

So to wrap this up, onion routing is a cool PET that allows you to mask your IP address. Your IP address can be used to identify and track you as you surf the web, so masking that address makes your browsing more private. I personally like the idea of Apple’s Private Relay over Tor, but it’s currently limited to paying Apple users that browse with Safari. Tor is an important tool for people whose physical safety depends on anonymity, but it’s rather clunky for average people to use on a daily basis. But it’s still good to have this option.

Today, the simpler solution for most people to mask their IP address is to use a Virtual Private Network (VPN). However, you are now shifting your trust from your ISP to the VPN provider, so be sure you choose a reputable provider. I hope we see wider adoption of fast, efficient onion routing like Private Relay, which splits the trust between multiple parties – requiring collusion to unmask your IP address.