Tor Network Switches to Galois Onion Encryption to Defend Users Against Online Attacks

The Tor Project has announced a major cryptographic overhaul, replacing its decades-old relay encryption algorithm with a new research-backed design called Counter Galois Onion (CGO).

This upgrade marks a significant step forward in defending anonymity network users against a broader class of sophisticated online attackers, particularly those conducting tagging attacks that could previously compromise user privacy.

The Problem with Legacy Encryption

Tor’s original relay encryption algorithm, now retroactively named “tor1,” encrypted user data as it traversed multiple relays in a circuit using AES-128-CTR stream cipher combined with a weak 4-byte SHA-1 digest.

While functional, this design contained critical vulnerabilities that modern cryptography has since addressed.

The most severe issue was that attackers could modify encrypted data in transit and predict how changes would propagate through the network, enabling them to trace traffic and potentially deanonymize users.

The legacy system also suffered from inadequate forward secrecy, maintaining the duplicate encryption keys throughout a circuit’s entire lifetime.

If an attacker compromised keys while a circuit remained active, they could decrypt all previous traffic.

Additionally, the 4-byte authenticator provided only a one-in-four-billion chance of undetected cell forgery, leaving circuits vulnerable to manipulation.

CGO, developed by cryptographers Jean Paul Degabriele, Alessandro Melloni, Jean-Pierre Münch, and Martijn Stam, represents a modern solution to these problems.

Built on a Rugged Pseudorandom Permutation (RPRP) construction, CGO ensures that tampering with any part of encrypted data renders the entire message and all subsequent messages unrecoverable.

This wide-block cipher approach provides tagging attack resistance without the excessive bandwidth overhead associated with traditional wide-block designs.

The new algorithm implements immediate forward secrecy through an “Update” construction that transforms encryption keys after processing each cell, preventing decryption of earlier messages even if current keys are compromised.

CGO also upgrades authentication with a robust 16-byte authenticator, replacing the obsolete SHA-1 digest with modern cryptographic standards.

The Tor Project has already implemented CGO in Arti, its Rust implementation, and is developing C implementations for relay support.

Current roadmap priorities include enabling CGO by default in Arti, implementing CGO negotiation for onion services, and optimizing performance for modern processors.

The transition will require refactoring core assumptions across Tor’s codebase regarding relay cell layouts and encryption mechanisms.

While CGO represents a significant advancement, the Tor Project acknowledges that, as a relatively recent design, it will benefit from ongoing cryptographic scrutiny.

Find this Story Interesting! Follow us on Google News, LinkedIn and X to Get More Instant Updates