How is a 3-hop Onion route built step by step, and why is each hop layered on the previous keys?
Alice negotiates a symmetric key with each router in turn (K1, K2, K3), tunnelling each new handshake through the keys already established, so no router sees the whole circuit.
* Incremental circuit build — each new key is negotiated through the layers already established. *
* Step 1 — the client fetches relays to build a circuit. — Electronic Frontier Foundation, CC BY 3.0, via Wikimedia Commons. *
The circuit is built incrementally using authenticated Diffie-Hellman:
- Alice ↔ OR1: authenticated DH directly with Onion Router 1 → shared symmetric key K1.
- Alice ↔ OR2: authenticated DH with OR2, sent through the K1-encrypted tunnel → key K2.
- Alice ↔ OR3: authenticated DH with OR3, sent through K1 and K2 → key K3.
- Connection to Bob: the TCP connection is triple-encrypted with K1, K2, K3 — each router can strip only its own layer.
Why build it this way? Because each extension is wrapped in the previous layers, OR2 never learns Alice's identity (it only ever talks to OR1), and OR3 only talks to OR2. Alice alone knows all three keys and the full path.
Tip: Authenticated DH (not plain DH) is essential — it prevents a man-in-the-middle from impersonating a relay during key exchange.
Go deeper:
Tor (network) (Wikipedia) — incremental circuit construction and per-hop key negotiation.