Tor's Counter Galois Onion (CGO) Upgrade: How 2025 Cryptography Crushes a 2002 Standard

Tor is moving its relay encryption from the aging "tor1" algorithm to Counter Galois Onion (CGO), and the change is a fascinating piece of engineering.

Here is exactly what is changing and why you should be excited about it, or at least feel a little safer.

Why "tor1" Had to Go

The old protocol dates back to around 2002. Its developers only recently gave it a name, "tor1," mostly so they would have something to call it in the documentation while retiring it. It was built on the AES-128-CTR stream cipher.

Its core weakness was the malleability of the stream cipher. In counter (CTR) mode, the ciphertext ($C$) is produced by XORing the keystream ($S$) with the plaintext ($P$), so $C = S \oplus P$. That is grade-school math, and it was a fatal blow to anonymity:

• If an attacker (let's call them Mr. Nosy) intercepts an encrypted cell and XORs it with a pattern of their own ($M$), that pattern is still in the plaintext after the victim decrypts it.
• This lets the attacker "tag" traffic as it enters the network and then watch for where the corrupted pattern appears on the way out.
• The result is complete deanonymization of the circuit, before any data has even been sent.

To make matters worse, users often mistook the side effects of these attacks (dropped connections) for DDoS attacks, which produced false alarms in Tor client logs.

CGO: Cryptographic "All or Nothing"

The new standard, Counter Galois Onion (CGO), is based on the UIV+ construction and the concept of a Rugged Pseudorandom Permutation (RPRP). Instead of a simple stream cipher, it uses a wide-block cipher design that resists malleability.

How does this work in practice?

1. A domino effect: Each cell is encrypted so that it depends on the cells before it. CGO uses a 16-byte tag $T$ that is chained to the next cell as $T'$.
2. Destruction instead of modification: If an attacker flips even a single bit in a cell in transit, decryption "blows up." That message, and every message after it on the same circuit, becomes unreadable. The attacker can no longer quietly "add a dot" to the traffic. At most, they can destroy the cell, which is easy to detect and reveals nothing about the sender's identity.
3. Forward secrecy: In "tor1," the AES keys lived for the entire lifetime of the circuit. In CGO, the keys are refreshed by an Update function every time a cell is sent or received. If someone steals a key five minutes into a connection, they cannot decrypt what happened in minute four.

Performance: Where Tor Gains and Where It Loses

This is probably the biggest surprise. Usually "more secure" means "slower," but here there is an interesting exception. The old protocol used SHA-1 for integrity checks, and SHA-1 is slow. CGO eliminates that overhead.

Benchmarks (run on Intel Cascade Lake processors) show the following:

• Endpoints (client/proxy and exit node): Here CGO is 3x faster than the old Tor. That is a huge relief for heavily loaded exit nodes.
• Middle relays: Here there is a slowdown of roughly 20–50%. That is because middle relays in the old Tor performed only very fast AES-CTR operations, while now they have to do CGO's somewhat more complex math.

The developers say this is no cause for concern. The gains at the edges of the network matter more, and modern processors with AES-NI and PCLMUL instructions (used to optimize CGO) can absorb the extra load on middle relays.

What's Next

CGO is already implemented in Arti (the Tor client written in Rust) and in the classic C implementation. The next steps are enabling CGO by default in Arti and adding CGO negotiation for onion services.

This is a fascinating moment: we are watching academic cryptography (research by Degabriele, Melloni, Münch and Stam) actually fix the internet.

Read more: Why a VPN Isn't Enough, our in-depth analysis of online anonymity, where we cover the strengths and limitations of the Tor network in the context of today's threats.

Aleksander

Sources:

• Tor Project Blog: Counter Galois Onion
• Paper: Counter Galois Onion: Fast Non-Malleable Onion Encryption for Tor
• Tagging attack details (based on the "Problem 1: Tagging attacks" section)
• Arti implementation specification