fill in a gap in the spec

2. Connections

   There are two ways to connect to an OR. The first is as an onion

   proxy (OP), which allows the OP to authenticate the OR without

   authenticating itself.  The second is as another OR, which allows

   mutual authentication.

   There are two ways to connect to an onion router (OR). The first is

   as an onion proxy (OP), which allows the OP to authenticate the OR

   without authenticating itself.  The second is as another OR, which

   allows mutual authentication.

   Tor uses TLS for link encryption, using the cipher suite

   "TLS_DHE_RSA_WITH_AES_128_CBC_SHA".  An OR always sends a

   All parties receiving certificates must confirm that the public

   key is as it appears in the server directory, and close the

   connection if it does not.

   connection if it is not.

   Once a TLS connection is established, the two sides send cells

   (specified below) to one another.  Cells are sent serially.  All

   of TLS records should not leak information about the type or

   contents of the cells.

   OR-to-OR connections are never deliberately closed.  OP-to-OR

   connections are closed when the OP has no more circuits running

   over a connection, and an amount of time (????) has passed.

   OR-to-OR connections are never deliberately closed.  An OP should

   close a connection to an OR if there are no circuits running over

   the connection, and an amount of time (KeepalivePeriod, defaults to

   5 minutes) has passed.

3. Cell Packet format