.onion

Pseudo–top-level internet domain

.onion

Introduced| 2004
TLD type| Host suffix
Status| Not in root, but used by Tor clients, servers, and proxies
Registry| Tor
Intended use| To designate an onion service reachable via Tor
Actual use| Used by Tor users for services in which both the provider and the user are anonymous and difficult to trace
Registration restrictions| Addresses are "registered" automatically by Tor client when an onion service is set up
Structure| Names are opaque strings generated from public keys
Documents|

* RFC 7686
* Tor design document
* Special Hostnames in Tor specification

Dispute policies| N/A

.onion is a special-use top-level domain name designating an anonymous onion service, which was formerly known as a "hidden service",[1] reachable via the Tor network. Such addresses are not actual DNS names, and the .onion TLD is not in the Internet DNS root, but with the appropriate proxy software installed, Internet programs such as web browsers can access sites with .onion addresses by sending the request through the Tor network.

The "onion" name refers to onion routing, the technique used by Tor to achieve a degree of anonymity.

The purpose of using such a system is to make both the information provider and the person accessing the information more difficult to trace, whether by one another, by an intermediate network host, or by an outsider. Sites that offer dedicated .onion addresses may provide an additional layer of identity assurance via EV HTTPS Certificates.[citation needed] Provision of an onion site also helps mitigate SSL stripping attacks by malicious exit nodes on the Tor network upon users who would otherwise access traditional HTTPS clearnet sites over Tor.[citation needed]

## Format

[edit]

Addresses in the onion TLD are generally opaque, non-mnemonic, alpha-numerical strings which are automatically generated based on a public key when an onion service is configured. Formerly 16 characters long prior to V2 onion services being made obsolete by V3 services, which are 56 characters long.[2] These strings can be made up of any letter of the alphabet, and decimal digits from 2 to 7, representing in base32 either an 80-bit hash ("version 2", or 16-character) or a 256-bit ed25519 public key along with a version number and a checksum of the key and version number ("version 3", "next gen", or 56-character). As a result, in the past all combinations of sixteen base32 characters could potentially be valid version 2 addresses (though as the output of a cryptographic hash, a randomly selected string of this form having a corresponding onion service should be extremely unlikely), while in the current version 3 only combinations of 56 base32 characters that correctly encoded an ed25519 public key, a checksum, and a version number (i.e., 3) are valid addresses.[3] It is possible to set up a partially human-readable .onion URL (e.g. starting with an organization name) by generating massive numbers of key pairs (a computational process that can be parallelized) until a sufficiently desirable URL is found.[4][5]

Beginning in October 2021, stable releases of Tor software no longer support V2 (16 character) addresses.[6]

## WWW to .onion gateways

[edit]

Proxies into the Tor network like Tor2web allow access to onion services from non-Tor browsers and for search engines that are not Tor-aware. By using a gateway, users give up their own anonymity and trust the gateway to deliver the correct content. Both the gateway and the onion service can fingerprint the browser, and access user IP address data. Some proxies use caching techniques that claim to provide better page-loading[7] than the official Tor Browser.

## .exit (defunct pseudo-top-level domain)

[edit]

.exit was a pseudo-top-level domain used by Tor users to indicate on the fly to the Tor software the preferred exit node that should be used while connecting to a service such as a web server, without having to edit the configuration file for Tor (torrc).

The syntax used with this domain was hostname \+ .exitnode \+ .exit, so that a user wanting to connect to http://www.torproject.org/ through node tor26 would have to enter the URL http://www.torproject.org.tor26.exit.

Example uses for this would include accessing a site available only to addresses of a certain country or checking if a certain node is working.

Users could also type exitnode.exit alone to access the IP address of exitnode.

The .exit notation was deprecated as of version 0.2.9.8.[8] It is disabled by default as of version 0.2.2.1-alpha due to potential application-level attacks,[9] and with the release of 0.3-series Tor as "stable"[10] may now be considered defunct.

## Official designation

[edit]

The domain was formerly a pseudo-top-level domain host suffix, similar in concept to such endings as .bitnet and .uucp used in earlier times.

On 9 September 2015 ICANN, IANA and the IETF designated .onion as a 'special use domain', giving the domain an official status following a proposal from Jacob Appelbaum of the Tor Project and Facebook security engineer Alec Muffett.[11][12][13]

## HTTPS support

[edit]

Prior to the adoption of CA/Browser Forum Ballot 144, an HTTPS certificate for a .onion name could only be acquired by treating .onion as an Internal Server Name.[14] Per the CA/Browser Forum's Baseline Requirements, these certificates could be issued, but were required to expire before 1 November 2015.[15]

Despite these restrictions, DuckDuckGo launched an onion site with a self-signed certificate in July 2013;[16] Facebook obtained the first SSL Onion certificate to be issued by a Certificate authority in October 2014,[17] Blockchain.info in December 2014,[18] and The Intercept in April 2015.[19] The New York Times later joined in October 2017.[20]

Following the adoption of CA/Browser Forum Ballot 144 and the designation of the domain as 'special use' in September 2015, .onion meets the criteria for RFC 6761.[21] Certificate authorities may issue SSL certificates for HTTPS .onion sites per the process documented in the CA/Browser Forum's Baseline Requirements,[22] introduced in Ballot 144.[14]

As of August 2016, 13 onion domains are https signed across 7 different organisations via DigiCert.[23]

## See also

[edit]

* .tor
* .i2p
* .bit
* Darknet
* Dark web
* GlobaLeaks
* List of Tor onion services
* Onion routing

## References

[edit]

1. ^ Winter, Philipp. "How Do Tor Users Interact With Onion Services?" (PDF). Retrieved 27 December 2018.
2. ^ "Intro to Next Gen Onion Services (aka prop224)". The Tor Project. Retrieved 5 May 2018.
3. ^ "Encoding onion addresses [ONIONADDRESS]". gitweb.torproject.org. Retrieved 8 February 2021.
4. ^ "Scallion". GitHub. Retrieved 2 November 2024.
5. ^ Muffett, Alec (31 October 2014). "Re: Facebook brute forcing hidden services". tor-talk (Mailing list). Simple End-User Linux. Retrieved 2 November 2014.
6. ^ "V2 Onion Services Deprecation". Tor Project | Support. Retrieved 7 July 2024.
7. ^ "Onion.cab: Advantages of this TOR2WEB-Proxy". Archived from the original on 21 May 2014. Retrieved 21 May 2014.
8. ^ "Tor Release Notes". Retrieved 4 October 2017.
9. ^ "Special Hostnames in Tor". Retrieved 30 June 2012.
10. ^ "Tor 0.3.2.9 is released: We have a new stable series!". The Tor Project. Retrieved 7 May 2018.
11. ^ Willis, Nathan (10 September 2015). "Tor's .onion domain approved by IETF/IANA". LWN.net.
12. ^ Franceschi-Bicchierai, Lorenzo (10 September 2015). "Internet Regulators Just Legitimized The Dark Web". Retrieved 10 September 2015.
13. ^ "Special-Use Domain Names". Retrieved 10 September 2015.
14. ^ a b "CA/Browser Forum Ballot 144 – Validation rules for .onion names". 18 February 2015. Retrieved 13 September 2015.
15. ^ "Baseline Requirements for the Issuance and Management Publicly-Trusted Certificates, v1.0" (PDF). Archived from the original (PDF) on 14 January 2016. Retrieved 13 September 2015.
16. ^ _zekiel (1 July 2013). "We've updated our Tor hidden service to work over SSL. No solution for the cert. warning, yet!". Reddit. Retrieved 20 December 2016.
17. ^ Muffett, Alec (31 October 2014). "Making Connections to Facebook more Secure". Retrieved 11 September 2015.
18. ^ Alyson (3 December 2014). "Improved Security for Tor Users". Retrieved 11 September 2015.
19. ^ Lee, Micah (8 April 2015). "Our SecureDrop System for Leaks Now Uses HTTPS". Retrieved 10 September 2015.
20. ^ Sandvik, Runa (27 October 2017). "The New York Times is Now Available as a Tor Onion Service". The New York Times. Retrieved 17 November 2017.
21. ^ Arkko, Jari (10 September 2015). ".onion". Retrieved 13 September 2015.
22. ^ "Baseline Requirements Documents". 4 September 2013. Retrieved 13 September 2015.
23. ^ Jamie Lewis, Sarah (7 August 2016). "OnionScan Report: July 2016 – HTTPS Somewhere Sometimes". Retrieved 15 August 2016.

## External links

[edit]

* "Tor Browser". Tor Project. "Anonymous browsing via Tor, used to access .onion sites"
* "Tor: Onion Service Configuration Instructions". Tor Project.
* "Tor Rendezvous Specification". Tor Project.
* Biryukov, Alex; Pustogarov, Ivan; Weinmann, Ralf-Philipp (2013), "Trawling for Tor Hidden Services: Detection, Measurement, Deanonymization" (PDF), Symposium on Security and Privacy, IEEE
* "Ballot 144". CA/Browser Forum. 18 February 2015.

* v
* t
* e

Tor — Onion routing

Authors of source code|

* DARPA
* Free Haven
* Massachusetts Institute of Technology
* Office of Naval Research

The Tor Project, Inc|

* Matt Blaze
* Wendy Seltzer
* Ian Goldberg
* Roger Dingledine
* Gabriella Coleman
* Cindy Cohn
* Megan Price
* Bruce Schneier
* Jacob Appelbaum (former)

Sponsors|

* United States Agency for Global Media
* Electronic Frontier Foundation
* Knight Foundation
* Mozilla Foundation
* Swedish International Development Cooperation Agency
* SRI International
* United States Department of State
* United States Department of Defense
* National Science Foundation

Realisations|

| Proxifiers|

* Orbot

|

Graphical user interface|

* Nyx status monitor
* Vidalia (outdated)

Web browsers|

* PirateBrowser
* Tor Browser Bundle
* xB Browser (outdated)

Operating systems|

* Anonym.OS (outdated)
* Incognito (outdated)
* TAILS
* Whonix
* xB Machine (outdated)

Instant messaging|

* Briar
* Ricochet (outdated)
* TorChat (outdated)
* Tor Messenger (outdated)

File sharing|

* Tribler
* Vuze

Peer-to-peer web hosting|

* ZeroNet

Computer appliances|

* Snowflake
* Tor Phone(outdated)
* Wireless onion router

Pseudo-top-level domains|

* .exit
* .onion
* .tor

Law Enforcement Operations|

* Operation Bayonet
* Operation Dark Huntor
* J-CODE
* Operation Onymous
* Operation Pacifier
* Operation Torpedo
* Operation Lobos 1
* Project Habitance

* v
* t
* e

Notable generic top-level domains

Current

| General|

* .bar
* .biz
* .blog
* .cam
* .cloud
* .club
* .college
* .com
* .fun
* .gay
* .gdn
* .global
* .guru
* .inc
* .info
* .kaufen
* .lgbt
* .name
* .mobi
* .moe
* .monster
* .music
* .net
* .ngo/.ong
* .one
* .online
* .ooo
* .org
* .pro
* .sexy
* .shop
* .site
* .tech
* .top
* .video
* .wiki
* .wtf
* .xyz
* .zip

|

Sponsored|

* .aero
* .amazon
* .app
* .art
* .bank
* .bible
* .cern
* .coop
* .design
* .dev
* .eco
* .edu
* .google
* .gov
* .hiv
* .int
* .jobs
* .kids
* .kiwi
* .kosher
* .mil
* .museum
* .post
* .radio
* .realtor
* .tel
* .travel
* .xxx

Geographic|

* .africa
* .alsace
* .amsterdam
* .asia
* .barcelona
* .bcn
* .berlin
* .brussels
* .bzh
* .cat
* .cymru
* .eu
* .eus
* .frl
* .gal
* .gent
* .irish
* .ist
* .istanbul
* .koeln
* .krd
* .lat
* .london
* .melbourne
* .nyc
* .paris
* .quebec
* .rio
* .saarland
* .scot
* .stockholm
* .sydney
* .taipei
* .tokyo
* .vegas
* .vlaanderen
* .wales
* .wien
* .zuerich

Infrastructure|

* .arpa

Deleted/retired|

* .nato

Reserved|

* .example
* .internal
* .invalid
* .local
* .localhost
* .onion
* .test

Proposed

| Language and
nationality|

* .eng
* .ker
* .nai
* .sic

|

Technical|

* .geo
* .mail
* .web

Other|

* .kid

* Category
* Full list
* Country code top-level domains

*[v]: View this template
*[t]: Discuss this template
*[e]: Edit this template