Gmaxwell, I studied the code, and noticed that the "version" message would include the "addrMe" field, which is populated from LocalAddrs, which again contains the own public IP (for example gotten from UPNP). Would that be a concern when using tor? If so, using Tor would be pointless.
Study harder. It doesn't in that case. (And, even if it did make such a colossal goof the other advantages of using tor would still persist.).There is no feasible way to MITM diffie hellman. If you can do so, you will get all my BTC if you provide a working way.
So you've flipped to the other side of wrong these days. MITMing a DH key exchange is trivial, you just _do_.Quote
I should have mentioned that we need some kind of authentication.
Authentication is basically all the complexity in a system, not something you just can wave away.Quote
Similar to the way it is implemented in TOR.
It's unclear of what you mean here; if you mean the way the tor network prevents MITM/sybil attacks between it's own participants; thats accomplished via centralized "directory authorities". 
