Tor uses AES in CTR mode, keystream blocks are XORed with the plaintext to get the resulting ciphertext. https://en.wikipedia.org/wiki/Keystream ....so yes I guess I do think that Tor XOR's data? Hm this paper looks interesting, from december 2011. http://freehaven.net/anonbib/cache/acsac11-backlit.pdf