Counter Galois Onion (CGO) – A Safer Way to Encrypt Tor Traffic

#Counter Galois Onion (CGO) – A Safer Way to Encrypt Tor Traffic

#The Problem with Tor’s Old Relay Encryption (tor1)

These weaknesses let active adversaries deanonymize users or read old traffic.

#What CGO Brings

• Tag‑resistant – a wide‑block cipher makes any bit‑flip corrupt the whole message, killing covert channels.
• Instant forward secrecy – keys and nonces are updated after every cell, so past cells can’t be decrypted later.
• Strong authentication – a 16‑byte tag (instead of 4 bytes) drops the forgery chance to 1 in 2¹²⁸.
• Acceptable performance – only two passes (tweakable block cipher + PRF) versus the many passes required by older wide‑block modes.

#How CGO Works (Simplified)

1. Cell format

   T (16‑byte tag) | C (493‑byte ciphertext)
   

2. UIV+ building block

   • Split the input into a short left part X_L and a longer right part X_R.
   • X_R + a tweak H feed a tweakable block cipher (LRW2) that encrypts X_L.
   • The result seeds a PRF; the PRF output XORs into X_R to produce the final ciphertext.

   

3. Middle‑layer encryption – the tag T from the current cell becomes the tweak for the next cell, chaining them together.

   

4. Originating a cell – start with a nonce N. After each cell, run the Update algorithm to change N and the keys, then use the new values for the next cell.

   

Result: Any tampering destroys the current and all subsequent cells, and the keys used for earlier cells are gone forever.

#Security Benefits at a Glance

#Where We Are Now

• Arti (Rust) – core crypto done, behind an experimental flag.
• C Tor – prototype merged; cell‑layout code refactored.

Next steps

1. Make CGO the default in Arti after performance tuning.
2. Add CGO negotiation for onion services (initially Arti‑only).
3. Optimize CPU usage with SIMD tricks from the authors’ reference implementation.

#Bottom Line

CGO upgrades Tor’s relay encryption to modern standards: it blocks tagging attacks, gives immediate forward secrecy, and uses a strong 16‑byte authenticator—all while keeping the performance impact manageable. This makes Tor traffic harder for adversaries to tamper with or decrypt, strengthening anonymity for users of the dark‑web and beyond.

#Read the Full Announcement

For the complete technical details, original diagrams, and full specification, see the Tor forum post:

Introducing Counter Galois Onion (CGO)