# Achieving Sender Anonymity in Tor against the Global Passive Adversary
## 4 The Proposed Protocol
### Communication Phase
#### 4.3.3 Transmission of a Message  
Consider a node \(r_{i}\) that wants to send a message \(M\) to a destination \(D\) (outside the ring). Suppose \(M\) is already encrypted for \(D\). First, \(r_{i}\) splits \(M\) into blocks \(M_{1},\ldots,M_{q}\) (\(q\geq 1\)) with size 498 bytes (i.e., the size of the payload \(P\) of a token). \(r_{i}\) waits for the first empty token (with \(F=00\)). Let be \(HID=H(PK_{r_{j}})\) (this means that \(r_{j}\) will play the role of proxy node for a communication session started by \(r_{i}\), as we will see next). Through \(HID\), \(r_{i}\) identifies the public key \(PK_{r_{j}}\) and the corresponding sender key \(k_{ij}\). The token is filled as follows. \(F\) is set to 10 (used). \(HID=H(PK_{r_{j}})\) is unaltered. \(CI\) is set to \(E_{k_{ij}}(R)\) where \(R\) is a random value identifying the current _communication session_ associated with the sender key \(k_{ij}\) (note that for a given communication session, a Tor circuit will be established outside the ring). The field \(DA\) includes the encryption with key \(k_{ij}\) of the network address of the destination \(D\). Observe that the size of this field is 4 bytes, and thus is compliant only with IPv4. Obviously, for IPv6, the size should be increased. Moreover, the TCP port is not included in this field for privacy reasons. It will be included in the payload encrypted at application layer. Finally, \(P\) is set to \(E_{k_{ij}}(M_{1})\) (possibly padded, if \(q=1\)). The token moves through the ring (encrypted hop-by-hop) until it reaches \(r_{j}\). Regarding the other messages \(M_{t}\) (with \(2\leq t\leq q\)), \(r_{i}\) waits for either (1) an empty token with \(HID=H(PK_{r_{j}})\) or (2) a reserved token (\(F=01\)) with \(HID=H(R)\), meaning that the token is reserved for the communication session started by \(r_{i}\) identified by \(R\). In both cases, the token is filled as follows. \(F\) is set to 10, \(HID\) is set to \(H(R)\) in case (2) (indeed, in case (1) it is already set with this value), \(CI=E_{k_{ij}}(R)\), \(DA\) includes the encryption with key \(k_{ij}\) of the network address of the destination \(D\) and \(P=E_{k_{ij}}(M_{t})\). Additionally, these tokens move through the ring until they reach \(r_{j}\). Eventually, all the blocks of the message \(M\) reach the same proxy node \(r_{j}\), which will use the same Tor circuit. We now see how such Tor circuit is established by \(r_{j}\). When \(r_{j}\) receives the (used) token containing \(M_{1}\), \(r_{j}\) identifies this token through \(HID=H(PK_{r_{j}})\). Anyway, it does not know the sender \(r_{i}\). Therefore, \(r_{j}\) tries to decrypt the fields \(CI,DA,P\) with all its \(k-1\) proxy keys until it finds the correct key \(k_{ij}\). Since \(D_{k_{ij}}(DA)\
eq S\) (we recall that \(S\) is a fixed string denoting that the token does not contain a message), \(r_{j}\) has to send the message outside the ring to the destination \(D\) through the Tor system. Before doing this, \(r_{j}\) sets the flag \(F=01\) (reserved) and the field \(HID=H(R)\) where \(R=D_{k_{ij}}(CI)\). This means that this token is associated with the communication session identified by \(R\). \(R\) is also stored by \(r_{j}\) and associated with \(k_{ij}\) in such a way that further tokens can be associated with this communication session. The random \(R\) is also used by \(r_{i}\) to detect further reserved tokens for this communication session. The other fields are filled with random bits and the token is then forwarded into the ring. Figure 3: Process of generation of the tokens. At this point, \(r_{j}\) can send the message \(M_{1}=D_{k_{j_{j}}}(P)\) to the destination \(D\). To do this, it builds a Tor circuit with destination \(D_{k_{j_{j}}}(DA)\) and sends the message \(M_{1}\) to \(D\) through this circuit. The construction of the Tor circuit is performed in the standard way, by contacting the Directory Server (DS) and by selecting the entry, middle and exit nodes as illustrated in Section 3.