# Achieving Sender Anonymity in Tor against the Global Passive Adversary
## 4 The Proposed Protocol
### Communication Phase
#### 4.3.4 Transmission of the Response  
When \(r_{j}\) receives the response \(M^{\prime}\) (already encrypted by \(D\)) through the Tor circuit, \(r_{j}\) injects the response into the ring. Specifically, let \(P^{\prime}_{1},\ldots P^{\prime}_{t}\) be the Tor cells including the response \(M^{\prime}\), and let denote by \(P_{k}\) the payload of the cell \(P^{\prime}_{k}\) (\(1\leq k\leq l\)). For each \(P_{k}\), \(r_{j}\) waits for either (1) an empty token or (2) a reserved token with \(HID=H(R)\). The token is  
Figure 4: Transmission of the message \(M\). filled as follows. \(F\) is set to 10. Only in the case of an empty token is the field \(HID\) set to \(H(R)\), and the communication identifier \(CI\), is derivable by the random \(R\) associated with the current communication session; and then, with this Tor circuit stored by \(r_{j}\) when the Tor circuit has been established, the field is set properly. That is, \(CI=E_{k_{ij}}(R)\). The field \(DA\) is filled with random bits. Finally, \(P\) is set to \(E_{k_{ij}}(P_{k})\). At this point, the token moves through the ring and is identified by \(r_{i}\) through \(HID\). When \(r_{i}\) receives all the tokens containing the block \(P_{k}\), it retrieves the entire response \(M^{\prime}\). For each of these tokens, \(r_{i}\) changes the state from used to reserved and forwards the token. Specifically, \(F\) is set to 01, \(HID=H(R)\) is unaltered and the other fields are filled with random bits. These reserved tokens (along with other possible empty tokens) are used by \(r_{i}\) and \(r_{j}\) to exchange the other requests/responses associated with the communication session identified by \(R\). The transmission of the response \(M^{\prime}\) is represented in the sequence diagram in Figure 5.  
When the communication session ends, \(r_{i}\) and \(r_{j}\) perform some actions aimed at emptying the tokens reserved for this session and destroying the Tor circuit. Specifically, for each reserved token with \(HID=H(R)\), \(r_{i}\) fills the token in such a way that \(r_{j}\) recognizes that they have to be emptied. To do this, \(F\) is set to \(10\), \(HID=H(R)\) remains unaltered, \(CI\) is set to \(E_{k_{ij}}(R)\), \(DA\) is set to the encryption with key \(k_{ij}\) of \(S\) and \(P\) is filled with random bits. When \(r_{j}\) receives such token, it retrieves the string \(S\) and recognizes that the session deactivation actions have to be performed. If this token is the first including \(S\), \(r_{j}\) destroys the Tor circuit. For this token and the successive ones, including \(S\), \(r_{j}\) empties them and forwards them into the ring. Specifically, \(F\) is set to 00 and \(HID=H(PK_{next(r_{j})})\). The other fields are filled with random bits. This process of emptying the tokens and destroying the Tor circuit is represented in the sequence diagram in Figure 6.  
To conclude this section, we provide a brief summary, by omitting the technical details of the communication phase. In Figure 7, we sketched a high level graphical representation of this phase. The sender waits for an empty token, selects a proxy node and fills the token with a message. This token will be injected into the ring, in which it will move until the proxy node is reached. The path of the ring from the sender to the proxy node is represented with a red arrow. Once the proxy node receives the message (possibly, encrypted), it contacts the Directory Server (dashed arrow) to select the entry, middle and exit routers and builds a Tor circuit through them. At this point, the proxy node forwards the message through this Tor circuit until the destination. The latter will provide the response (possibly  
Figure 5: Transmission of the response \(M^{\prime}\). encrypted) through the same Tor circuit until the proxy node. Both the ongoing path and the return path are represented by the green arrow in the figure. Finally, when the proxy node receives the response, it waits for a number of empty or reserved tokens and fills them with the response.