Who decides what the Tor network is: the consensus, the directory authorities and the bridge split
Every Tor connection starts with an act of agreement. Before the browser builds its first circuit, it needs a current answer to a deceptively simple question: which relays exist, and which of them can be trusted right now? Nothing in the Tor network is decided by a single server. Instead, a small, fixed group of machines called directory authorities settles that question together, on a schedule, in public.
One document, one network
The document they produce is the consensus: in the Tor Project's glossary, a single document compiled and voted on by the directory authorities once per hour. Each consensus lists the known relays as router status entries carrying a nickname, key material and addresses, and annotates every entry with flags and bandwidth weights. The format, including the full flag vocabulary, is documented in the directory specification. Clients never learn these facts from the network at large. The addresses and long-term identity keys of the authorities are built into the Tor source itself, and the specification calls for each authority to keep its identity key offline, using it only to certify shorter-lived signing keys. The network's root of trust is deliberately small, auditable and slow to change.The hourly vote, step by step
The mechanics are laid out in the spec's voting timeline. Each authority periodically publishes its vote: the network status it believes to be true. A timed window collects votes from all authorities, then a second window collects signatures on the resulting document, and the spec requires each of those windows to last at least twenty seconds. The finished consensus carries three timestamps in a fixed order: valid-after, fresh-until and valid-until, with the full lifetime required to be at least twice the fresh period. At least three consensuses are meant to be valid at any given time. Directory caches download each new document between valid-after and fresh-until, ordinary clients fetch it in the longer window that follows, and a consensus more than a day past its expiry is dropped entirely."Every hour, these volunteer-run directory authorities vote on and reach a consensus on the relays that make up the Tor network."That line comes from the Tor Project's November 2017 post announcing Bastet, a new authority added to increase what the project called the diversity and stability of the directory authority system. It is also, quietly, a description of the whole arrangement: the authorities are volunteer-run, they vote, and their agreement is what turns thousands of individual relays into one network.
Flags, bandwidth and microdescriptors
What the authorities vote on is more than mere existence. A relay can carry flags such as Authority, Exit, Fast, Guard, Running, Stable or V2Dir, each one asserting a tested property, and each vote records the relay's measured bandwidth, which the consensus distills into the weights clients use when choosing paths. Modern clients mostly fetch the microdescriptor flavor of the consensus, which pairs the voted status lines with hashes of the compact descriptor pieces clients need instead of full server descriptors.- Guard marks a relay as suitable for the entry position of a circuit.
- Exit marks a relay as willing to carry traffic to the wider internet on commonly used ports.
- Stable marks a relay as fit for long-lived connections.
- HSDir admits a relay to the ring that stores onion service introductions.
- V2Dir marks a relay as capable of serving directory documents.