 | |
| Introduced | 2004 |
|---|---|
| TLD type | Host suffix |
| Status | Not in root, but used by Tor clients, servers, and proxies |
| Registry | Tor |
| Intended use | To designate an onion service reachable via Tor |
| Actual use | Used by Tor users for services in which both the provider and the user are anonymous and difficult to trace |
| Registration restrictions | Addresses are "registered" automatically by Tor client when an onion service is set up |
| Structure | Names are opaque strings generated from public keys |
| Documents | |
| Dispute policies | N/A |
.onion is a special-usetop-level domain name designating an anonymousonion service, which was formerly known as a "hidden service",[1] reachable via theTor network. Such addresses are not actualDNS names, and the .onion TLD is not in theInternet DNS root, but with the appropriate proxy software installed, Internet programs such asweb browsers can access sites with .onionaddresses by sending the request through the Tor network.
The "onion" name refers toonion routing, the technique used by Tor to achieve a degree ofanonymity.
The purpose of using such a system is to make both the information provider and the person accessing the information more difficult to trace, whether by one another, by an intermediate network host, or by an outsider. Sites that offer dedicated .onion addresses may provide an additional layer of identity assurance viaEV HTTPS Certificates.[citation needed] Provision of an onion site also helps mitigateSSL stripping attacks bymalicious exit nodes on the Tor network upon users who would otherwise access traditional HTTPSclearnet sites over Tor.[citation needed]
Addresses in the onion TLD are generally opaque, non-mnemonic, alpha-numerical strings which are automatically generated based on apublic key when anonion service is configured. Formerly 16 characters long prior to V2 onion services being made obsolete by V3 services, which are 56 characters long.[2] These strings can be made up of any letter of the alphabet, and decimal digits from 2 to 7, representing inbase32 either an 80-bithash ("version 2", or 16-character) or a 256-bited25519 public key along with a version number and a checksum of the key and version number ("version 3", "next gen", or 56-character). As a result, in the past all combinations of sixteen base32 characters could potentially be valid version 2 addresses (though as the output of a cryptographic hash, a randomly selected string of this form having a corresponding onion service should beextremely unlikely), while in the current version 3 only combinations of 56 base32 characters that correctly encoded an ed25519 public key, a checksum, and a version number (i.e., 3) are valid addresses.[3]It is possible to set up a partially human-readable .onion URL (e.g. starting with an organization name) by generating massive numbers ofkey pairs (a computational process that can beparallelized) until a sufficiently desirable URL is found.[4][5]
Beginning in October 2021, stable releases of Tor software no longer support V2 (16 character) addresses.[6]
Proxies into the Tor network likeTor2web allow access to onion services from non-Tor browsers and for search engines that are not Tor-aware. By using a gateway, users give up their own anonymity and trust the gateway to deliver the correct content. Both the gateway and the onion service canfingerprint the browser, and access user IP address data. Some proxies use caching techniques that claim to provide better page-loading[7] than the officialTor Browser.
.exit was apseudo-top-level domain used byTor users to indicate on the fly to the Tor software the preferredexit node that should be used while connecting to a service such as aweb server, without having to edit the configuration file for Tor (torrc).
The syntax used with this domain washostname +.exitnode +.exit, so that a user wanting to connect to http://www.torproject.org/ through nodetor26 would have to enter the URLhttp://www.torproject.org.tor26.exit.
Example uses for this would include accessing a site available only to addresses of a certain country or checking if a certain node is working.
Users could also typeexitnode.exit alone to access the IP address ofexitnode.
The .exit notation was deprecated as of version 0.2.9.8.[8] It is disabled by default as of version 0.2.2.1-alpha due to potential application-level attacks,[9] and with the release of 0.3-series Tor as "stable"[10] may now be considered defunct.
The domain was formerly apseudo-top-level domain host suffix, similar in concept to such endings as.bitnet and.uucp used in earlier times.
On 9 September 2015ICANN,IANA and theIETF designated .onion as a 'special use domain', giving the domain an official status following a proposal fromJacob Appelbaum of the Tor Project andFacebook security engineerAlec Muffett.[11][12][13]
Prior to the adoption ofCA/Browser Forum Ballot 144, anHTTPS certificate for a .onion name could only be acquired by treating .onion as an Internal Server Name.[14] Per the CA/Browser Forum's Baseline Requirements, these certificates could be issued, but were required to expire before 1 November 2015.[15]
Despite these restrictions,DuckDuckGo launched an onion site with a self-signed certificate in July 2013;[16]Facebook obtained the first SSL Onion certificate to be issued by a Certificate authority in October 2014,[17]Blockchain.info in December 2014,[18] andThe Intercept in April 2015.[19]The New York Times later joined in October 2017.[20]
Following the adoption of CA/Browser Forum Ballot 144 and the designation of the domain as 'special use' in September 2015, .onion meets the criteria for RFC 6761.[21] Certificate authorities may issue SSL certificates for HTTPS .onion sites per the process documented in theCA/Browser Forum's Baseline Requirements,[22] introduced in Ballot 144.[14]
As of August 2016, 13 onion domains are https signed across 7 different organisations viaDigiCert.[23]
Anonymous browsing via Tor, used to access .onion sites