Counter Galois Onion: A Major Upgrade For Tor's Relay Encryption

What is Counter Galois Onion

CGO is a new way to encrypt the individual cells that carry data through Tor. Each cell is a small unit of information that hops through multiple relays, forming the layers of the onion that protect user activity. Unlike the older system, which protected only the payload and used static keys, CGO ensures that every part of the cell—including headers and metadata—is fully encrypted and authenticated. Any tampering is immediately detected, and corrupted cells are rejected to prevent exploitation.

A key feature of CGO is its per-cell key evolution. After each cell is sent or received, the encryption keys are irreversibly updated. This forward secrecy means that even if a relay’s current key is compromised, all previous traffic remains secure. By combining full-cell protection with evolving keys, CGO significantly strengthens the security of Tor traffic against both passive and active attacks.

The Big Change

The most significant change with CGO is how Tor encrypts and protects each relay cell. In the previous system, known as tor1, cells were encrypted using a simple counter mode and had only a weak four-byte integrity tag. This meant that while the payload was mostly secure, headers and other parts of the cell were less protected, and it was possible for attackers to tamper with cells or even try tagging attacks to link traffic across relays. The static keys used for an entire circuit also meant that if a relay’s key was compromised, all traffic on that circuit could be exposed.

With CGO, everything inside the cell is fully authenticated and encrypted. It uses a much stronger sixteen-byte authenticator, making tampering nearly impossible. Keys are now evolved after every cell, providing forward secrecy and ensuring that past traffic stays safe even if a relay is later compromised. Any modified or corrupted cells are immediately rejected, preventing attackers from exploiting the network. Essentially, CGO turns each cell into a fully self-contained, secure package, greatly strengthening Tor’s resistance to active attacks and enhancing the overall privacy of its users.

Why It Matters

CGO tackles some longstanding weaknesses. Tagging and malleability attacks that could link traffic across relays are now much harder, and the per-cell forward secrecy ensures old communications remain secure even if current keys are exposed. Cells are fully authenticated, so attempts to manipulate or forge them fail. The upgrade gives Tor a modern cryptographic backbone, making it harder for adversaries to interfere with traffic.

Deployment

CGO is already live in Tor’s Rust client, Arti, with work underway to bring it to the standard C-based relays. Adoption will take time, as both clients and relays need to support it for full benefits, but it represents a crucial step forward. While it’s still experimental, the direction is clear: Tor is becoming much stronger under the hood.

Improving Trust and Strengthening Privacy

Tor has faced criticism in recent years for decisions that some felt compromised user privacy or transparency. One notable controversy involved the network's response to the Raptor incident, where reliance on an emergency patch rather than full transparency raised concerns within the community. Another point of debate was the adjustment to the user agent spoofing system. Previously, all Tor users appeared to run the same operating system, enhancing uniform anonymity, but the new system only hides the Tor version while revealing the OS type.

Despite these concerns, the implementation of Counter Galois Onion encryption shows a strong commitment to improving security and privacy at a fundamental level. CGO addresses weaknesses in relay encryption, making the network more resilient against active attacks. These improvements demonstrate that Tor is taking proactive steps to restore trust and strengthen its role as a reliable tool for anonymous communication.

Conclusion

Counter Galois Onion represents a meaningful upgrade to Tor’s security, focusing on strengthening the encryption and integrity of each relay cell. By implementing per-cell forward secrecy, full-cell authentication, and tamper detection, CGO addresses real vulnerabilities that existed in the older system. While the broader Tor network continues to evolve and faces ongoing challenges, these improvements demonstrate a practical step forward in protecting user privacy and making the network more resilient against attacks. It’s a concrete example of how thoughtful cryptographic updates can enhance security without altering the core functionality.