Pedantic response: There's surprisingly little provable (in the mathematical sense) security in the crypto world. It's possible, though rather unlikely, that th

Pedantic response: There's surprisingly little provable (in the mathematical sense) security in the crypto world. It's possible, though rather unlikely, that the NSA has a cheap way to factor large numbers and has been laughing at us all for decades. Less pedantic response: Tor does use good strong crypto and has been examined by many experts, both practical and theoretical; I'd be surprised if the crypto, protocol design, or even the implementation is the weakest spot. One weak spot it does have is traffic analysis. Any low-latency anonymity network has this problem: if someone can observe the traffic in and out of enough nodes on the network (even if they can't decrypt any of it) they can statistically correlate arrival times and figure out who is talking to whom pretty reliably. Even if you can't read the data, reading the envelopes is enough to plug leaks, find dissidents, etc.. (Consider the Associated Press phone records affair.) If the attacker can experiment by causing brief interruptions or delays on the circuits between nodes they can extract even more information. Google will find you many cites on this subject. The Tor project tries to mitigate this but considers a full solution out-of-scope (for fairly good reasons, I think). There aren't many projects that really do try to address it --- the old cypherpunk Mixmaster network is the only one I know of offhand. And even there, the best you can do really is up the constant factors of the attack, or push the attack one level up into the greater network of human communication ("who knew X, at a time they could have communicated it to Y? Who knew Z, at such a time?").