Hidden Service Descriptor
Signed metadata published to distributed hash tables that tells Tor clients how to reach an onion service without revealing its IP.
A hidden service descriptor is the signed document an onion service publishes so clients can find it. It lists the service’s current introduction points and the keys needed to contact them, and it is uploaded to a rotating set of relays acting as hidden service directories (HSDirs), chosen via a distributed hash table rather than any central registry.
Why it matters
The descriptor is the lookup mechanism that replaces DNS for .onion names: a client fetches it, picks an introduction point, and begins the handshake that ends at a rendezvous point. In the v3 protocol, descriptors are encrypted and uploaded under daily-changing blinded keys, so directory relays cannot trivially enumerate which services exist or count their lookups — a direct response to earlier harvesting attacks on HSDirs.
Common mistake
A descriptor reveals introduction points, not the service’s IP. The real failure is exposure of the service’s own keys: whoever holds them can publish competing descriptors and impersonate the service at its own address.
Category: Network