Tor has fixed their long standing tagging attack, improved forward security, and added sufficient authentication. See [the Arti 2.5 stable release announcement](https://blog.torproject.org/arti_2_5_0_released/) too, as well as [2025/583](https://eprint.iacr.org/2025/583), [2025/2017](https://eprint.iacr.org/2025/2017), and [tor spec 359](https://spec.torproject.org/proposals/359-cgo-redux.html).
*"Jean Paul Degabriele, Alessandro Melloni, Jean-Pierre Münch, and Martijn Stam have a design that they're calling Counter Galois Onion (CGO). It's based on a kind of construction called a [Rugged Pseudorandom Permutation](https://eprint.iacr.org/2022/817) (RPRP): essentially, it's a design for a wide-block cipher that resists malleability in one direction (for the encrypt operation, but not the decrypt operation). If we deploy this so that clients always decrypt and relays always encrypt, then we have a tagging resistant cipher at less cost than a full SPRP!"*
