# Post-Quantum Migration of the Tor Application
## 2 Literature Review
### Tor Design and Architecture
#### 2.1.2 Relay and Link Layer  
Also called onion skinning, the Relay \"layer\" is one of the most important of Tor's protocols. At the origin OP, a symmetric key is shared with each relay in the circuit using a telescoping key exchange protocol. During the circuit creation, as shown in Figure 1, instead of encrypting an entire circuit in one go, the circuit is built incrementally, with the client negotiating session keys with one node at a time. The OP encrypts the message multiple times, starting with the key for the final relay and moving backwards. When a message is transmitted, each intermediate relay decrypts one layer using its symmetric key, revealing the next hop or, for R_N, the destination. The message is always padded to a fixed size, preventing traffic analysis based on message length. This approach ensures that no single relay has a full view of the communication path, enhancing anonymity. However, according to [PERSON] and [PERSON] [15], due to its use of AES-128 in counter mode for each layer of encryption, Tor's relay protocol is susceptible to tagging attacks, where a malicious entry and exit node can tamper with and detect changes in the data to de-anonymise the user. This is exacerbated by Tor's low-latency design, which prioritises performance over stronger cryptographic guarantees. [PERSON] and [PERSON] [16] introduce the concept of Onion Authenticated Encryption, including indistinguishability from random bits and end-to-end authenticity verification as critical security measures. While [PERSON] and [PERSON] [15] assess the relay protocol under CCA, identifying potential metadata leakage or improper handling of intermediary nodes, [PERSON] and [PERSON]'s findings [16] highlight that Tor's current protocol fails to meet these security benchmarks, specifically showing vulnerability to tagging attacks due to its reliance on counter-mode AES with an absence of a mechanism for authenticity checking throughout the relay path. They suggest improving integrity validation by applying robust authenticated encryption with associated data (AEAD) schemes, which would ensure the detection of tampering at an intermediary (middle node) layer. Moreover, they propose to add layer-specific nonce usage and key diversification across encryption layers against tagging attacks. Globally, their work calls for a protocol restructuring, which would not be solved by the implementation of PQC. Since [PERSON]'s algorithm [2] demonstrates limited parallelisation capabilities, the quantum threat is not estimated to be significant to asymmetric cryptosystems; thus, increasing the key size is expected to provide sufficient security [17]. Concerning the link layer, TLS ensures authentication, integrity, and encryption of data in transit between nodes. Its speed is a crucial metric in the Tor protocol for the user experience as it directly impacts circuit creation latency (every new Tor circuit requires a fresh TLS handshake between nodes) and the network scalability, as a higher TLS connection capacity allows it to handle more users efficiently. At present, Tor's TLS avoids session resumption for additional security and relies on stateless connections to avoid potential state-carrying [10]. Hence, treating each connection independently makes it harder for one to track connections or identify patterns. The newer version omits client certificates and uses a single-element, non-distinctive certificate chain to avoid detection by deep packet inspection systems, mimicking HTTPS traffic. TLS renegotiation was added but later moved to encrypted data records in version 3 to improve anti-blocking features and limit observable TLS signatures. To aims to cease using TLS 1.2 [5] #294, as 1.3 incorporates significant improvements such as the handshake design, particularly with its 1-RTT, meaning only one round-trip time is required until the first application message is sent, decreasing latency [18].