# Post-Quantum Migration of the Tor Application
###### Abstract  
The efficiency of [PERSON]'s and [PERSON]'s algorithms and the advancement of quantum computers implies that the cryptography used until now to protect one's privacy is potentially vulnerable to retrospective decryption, also known as the harvest now, decrypt later attack in the near future. This dissertation proposes an overview of the cryptographic schemes used by Tor, highlighting the non-quantum-resistant ones and introducing theoretical performance assessment methods of a local Tor network. The measurement is divided into three phases. We start with benchmarking a local Tor network simulation on constrained devices to isolate the time taken by classical cryptography processes. Secondly, the analysis incorporates existing benchmarks of quantum-secure algorithms and compares these performances on the devices. Lastly, the estimation of overhead is calculated by replacing the measured times of traditional cryptography with the times recorded for Post-Quantum Cryptography (PQC) execution within the specified Tor environment. By focusing on the replaceable cryptographic components, using theoretical estimations, and leveraging existing benchmarks, valuable insights into the potential impact of PQC can be obtained without needing to implement it fully.  
Tor; post-quantum cryptography; NIST; onion routing +
Footnote †: journal: Cybersecurity and Privacy  
0000-0001-5000-0000-0000-0000-0000-0000-0000-0000-00000-00000-00000-00000-00000-00000-00000-00000-000000-000000-000000000000000000000000000000  
paper reveal a discrepancy between the proportion of onion service traffic and that of the total network bandwidth. While unlawful content is hosted on onion services, this constitutes only a small fraction of the overall activity enabled by the Tor network (see A). OS are a way to present content within the network itself without having to leave Tor. They conceal the physical location of the server and are accessible exclusively through the network using addresses ending in \".onion\". Since the implementation of Version 3, these 56-character alphanumeric strings are created by encoding the service's long-term public key (32 bytes Ed25519), checksum, and version (\"x03\" by default) in Base32 [5] #224. [PERSON] and [PERSON] [4] introduced a new mechanism called rendezvous-point relying on a DH key exchange where the user and OS establish a shared secret through Diffie-Hellman, with a \"rendezvous\" relay connecting the circuits from both parties without learning their identities or reading the data transmitted. Yet, since version 0.3.2.1--alpha--onion service cryptography has been improved by replacing the schemes SHA1, DH, and 1024-RSA with SHA3, Ed25519, and curve25519. Today, the main usage of cryptography in the network, as shown in Tables A1 and A2 relies on RSA, ECC, and AES. The latter, as a symmetric encryption algorithm, is less vulnerable to QC. An attacker equipped with a sufficiently advanced quantum computer could, in theory, compromise these cryptographic schemes to impersonate relay nodes, decrypt confidential content, and forge digital signatures, thereby creating documents that appear authentic to recipients. [PERSON] and [PERSON] [6] estimate 20 million required physical qubits to break RSA-2048 encryption and highlight a considerable decrease in this estimation from 2015 to 2021, thus encouraging a faster adoption of PQC.