Tor switches to new Counter Galois Onion relay encryption algorithm

Tor is replacing its legacy tor1 relay encryption with Counter Galois Onion (CGO), a research-driven scheme using a Rugged Pseudorandom Permutation (UIV+) to deliver tagging resistance, immediate forward secrecy via per‑cell key updates, and stronger 16‑byte authentication while maintaining low overhead. CGO removes SHA‑1 from relay encryption, employs wide‑block encryption with tag chaining, and ensures circuit integrity by chaining encrypted tags and nonces across cells. The feature is currently experimental with integration in Tor’s C implementation and the Rust-based Arti client, and will be enabled automatically for users upon full deployment.