Why V3 Onion Addresses Are Cryptographically Superior

A technical deep-dive into the cryptographic architecture of v3 .onion addresses explains why the 56-character format provides meaningfully stronger security guarantees than the deprecated v2 10-character format, and why Nexus and other security-conscious platforms have standardized exclusively on v3 addressing.

V2 onion addresses were derived from an 80-bit truncation of an RSA-1024 public key hash — a scheme vulnerable to both collision attacks and advances in factoring algorithms. The transition to v3 uses Ed25519 keys with full 256-bit security, generating a 32-byte public key encoded as a 56-character base32 string. The address itself is a cryptographic commitment to the server's identity — connecting to a v3 address and receiving a valid response proves you are talking to the server holding the corresponding private key.

This architecture means v3 address forgery requires an attacker to generate an Ed25519 keypair whose public key produces the same 56-character encoding — computationally infeasible against current hardware. Combined with Tor's hidden service authentication protocol, v3 addressing provides strong resistance to MITM and impersonation attacks that affected earlier darknet platforms.