Pith. sign in

REVIEW 4 major objections 5 minor 1 cited by

Echomix: a Strong Anonymity System with Messaging

T0 review · 4 major / 5 minor · reviewed 2026-08-10 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read Echomix claims to be the first practical messaging system whose mix-network design hides metadata from global, active, quantum-capable adversaries using symmetric echo round-trips, unlinkable storage, and post-quantum Sphinx packets.

desk verdict A genuinely novel mixnet design with real engineering, but the headline privacy claims outrun the paper's own analysis; worth refereeing for the architecture, not the stated guarantees. read the letter →

arxiv 2501.02933 v2 pith:SF4T7LW4 submitted 2025-01-06 cs.CR

Ewa J Infeld , David Stainton , Leif Ryge , Threebit Hacker This is my paper · ORCID
classification cs.CR
keywords mixnetworktrafficanalysisresistancemetadataprivacyanonymousmessagingpost-quantumcryptographySphinxpacketformatunobservabilitydecoy
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

Echomix claims to be the first practical messaging system whose threat model includes a global passive adversary, active compromise of network elements and contacts, and quantum-capable cryptanalysis. It argues that by making every interaction a round-trip echo to a uniformly random service behind the mix network, application traffic can be made statistically indistinguishable from decoy traffic, defeating the traffic-analysis vulnerabilities of prior designs such as Loopix. On top of that base it adds BACAP, a blinding-and-capability scheme for unlinkable message boxes, and Pigeonhole, a storage layer that provides reliability without automatic acknowledgements. The paper also presents hybrid post-quantum Sphinx packet formats and reports latency and bandwidth figures meant to show the system is deployable today.

What carries the argument

The load-bearing mechanism is the echo round-trip combined with the Traffic coupling lemma. Every client action is a Sphinx packet sent through three mix layers to a service node, with the reply returned through a Single-Use Reply Block, so sending and receiving are structurally symmetric and both look like uniformly random decoy traffic. The lemma does the work of showing unobservability: given two histories indistinguishable from uniform random, any interleaving remains indistinguishable from uniform, which lets real writes and reads hide inside the decoy stream. Supporting machinery includes BACAP's KDF-derived blinding sequence for unlinkable box addressing and signing, Pigeonhole's consistent-hashing replica selection with courier-mediated reads and writes, and hybrid post-quantum Sphinx variants (NIKE and KEM) that preserve the packet format's blinding trick or trade header size for speed.

What would settle it

Measure the empirical distribution of Pigeonhole read requests across replicas in the deployed system and compare it to the uniform distribution over replicas. If the statistical distance is non-negligible—for instance, because consistent hashing makes some boxes more likely to be read from a subset of replicas—then the Traffic coupling lemma's premise fails and the claimed unobservability does not hold.

Watch

Extended reading notes

Core claim

The paper's central claim is that a mix network can provide strong metadata privacy for persistent multi-client messaging against a sophisticated, global, active, quantum-capable adversary. The design justifies this with the Traffic coupling lemma: if both application traffic and decoy traffic are indistinguishable from uniformly random service selection and independent of history, any algorithm that chooses between them produces a stream still indistinguishable from uniform, so a real message hidden among decoy echos creates no observable anomaly. The authors identify a specific flaw in Loopix—application traffic at the last hop goes to the receiver's designated provider while decoys are uniformly distributed—and replace persistent providers with random gateways and far-side service nodes accessed only by echo round-trips. For messaging, BACAP derives pseudorandom single-use box IDs from shared keys so storage servers cannot link boxes of the same conversation, and Pigeonhole splits storage between replicas and couriers so that retransmissions and acknowledgements do not reveal box IDs. The claim concludes that Echomix is the first practical messaging system design with this threat model.

Load-bearing premise

The unobservability of real messages rests on the assumption that a client's actual service requests are statistically indistinguishable from uniformly random decoy traffic and independent of past traffic, and the paper does not prove that Pigeonhole's deterministic replica selection satisfies that condition.

Editorial extensions

If this is right

  • A global passive adversary who can watch the entire network should not be able to distinguish a real message from a decoy echo, so the confirmation and statistical disclosure attacks that work against Loopix are neutralized if the coupling premise holds.
  • Because acknowledgements are never automatic and retransmissions use all-or-nothing courier copy operations, a compromised contact cannot use forced interactivity or message-loss patterns to test whether the writer is online.
  • A single compromised service role—gateway, courier, or replica—does not learn both a user's identity and the target box IDs; only specific pairs of colluding roles mount partial attacks, and the paper enumerates which pairs gain what.
  • Post-quantum protection is available in two flavors: hybrid NIKE Sphinx preserves compact 476-500 byte headers at higher computational cost, while hybrid KEM Sphinx unwraps roughly twice as fast with headers up to about 14 KB.
  • Round-trip latency follows an Erlang distribution with mean 9µ, giving about 1.8 s average round-trip time in the example deployment with a 0.2% chance of exceeding 4 s, which is practical for messaging and low-bitrate audio.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • The unobservability guarantee for reads is less established than for writes: Pigeonhole selects replicas by consistent hashing on the box ID, and the paper itself notes that reads reveal a rough probabilistic ordering of box IDs; a PIR scheme, suggested as future work, would be needed to close that gap.
  • The all-or-nothing retransmission channel is a general anonymous reliable broadcast primitive that could be reused for other group applications, such as anonymous file distribution or key rotation ceremonies, without exposing box IDs.
  • The bandwidth model implies a continuously connected client sends and receives about 6.7 GB per day at the example parameters; that is affordable for messaging but would become a practical limit for higher-volume uses like video.
  • The 'first practical messaging system' claim is comparative rather than absolute: it holds for the class of deployed, latency-tolerant messaging systems with the stated threat model, and would be weakened by any later deployment achieving equally strong guarantees with lower overhead.
Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 5 minor

Summary. The paper presents Echomix, a mix network framework implemented as Katzenpost, together with the BACAP cryptographic messaging protocol and Pigeonhole storage. The design replaces persistent providers with random gateways and far-side service nodes, uses memoryless mixing and decoy echoes, and introduces couriers and replicas for reliable unlinkable messaging. It also proposes hybrid post-quantum Sphinx variants and gives latency and bandwidth measurements. The central claim is strong metadata privacy against global passive/active adversaries, compromised contacts and network infrastructure, quantum decryption, and statistical/confirmation attacks, with the conclusion that Echomix is the first practical messaging system with such a threat model.

Significance. If the security claims were established, this would be a substantial practical contribution: an implemented and deployed mixnet with measured overheads, a novel blinded storage protocol, and a messaging layer that does not rely on persistent providers. The paper contains useful engineering ideas, including echo-based round trips, the coupling of decoy and application traffic, BACAP's deterministic key blinding for unlinkable box IDs, and the courier/replica split for hidden retransmissions. The performance tables for Sphinx variants and PKI documents are also informative. However, the central security claims are not supported by the analysis presented: the paper's own Section 6 enumerates attacks that directly contradict the abstract's claims, and Section 5.7 admits a statistical leak in the sharding scheme. As a security analysis, the manuscript is therefore not yet at the standard required for acceptance.

major comments (4)
  1. [§6.2] The paper's own enumeration of colluding-pair capabilities admits that a Replica+Contact adversary learns when the other party was online in 1:1 conversations, and for groups learns when someone in the group was reading. Under the broad metadata definition in Section 2, online status is metadata, and compromised contacts and replicas are explicitly in the threat model. The paper merely lists this capability and does not argue that it is outside the claimed protection or quantify the leak, so the abstract's claim of resistance to compromised contacts and statistical/confirmation attacks is not supported.
  2. [§5.7 and §5.3] The Traffic Coupling lemma in Section 3.2 requires service selection to be indistinguishable from uniformly random and independent of history, but Pigeonhole read requests are addressed to replicas selected deterministically by consistent hashing on the BACAP box ID (Section 5.3), and Section 5.7 admits that 'read and write requests provide replicas with a rough, probabilistic ordering of the box IDs, and the guesses get better with each reader.' The manuscript never shows that the messaging process satisfies the lemma's premise; in fact, replicas observe box IDs directly, so the claimed unobservability of read and write operations is an assumption, not a demonstrated property.
  3. [§6.2] The same section states that a Gateway+Courier adversary can accumulate SURBs and 'link a user to that copy request,' and that a Gateway+Replica pair can perform a long-term intersection attack by observing which clients are connected when certain boxes are read. These are exactly the kinds of global and compromised-infrastructure adversaries the paper claims to resist. No bounds, mitigation proofs, or arguments are given that these attacks are outside the threat model or have negligible effect, so the headline privacy claim is not established.
  4. [§6] The 'Security properties' section is a table of unquantified adversary capabilities with no derivations, despite the introduction's promise of 'rigorous analysis.' There are no formal definitions of the claimed properties, no adversary models with explicit oracles, no probabilistic bounds, and no proof that the Traffic Coupling lemma applies to the Pigeonhole protocols. As written, Section 6 is an informal enumeration, not a security proof.
minor comments (5)
  1. [§3.2] In the Traffic Coupling lemma, the notation p = PA(A|H) and p' = PA(B|H) is confusing: the first term should be the probability of selecting sequence A, not a conditional probability of A itself. Please clarify.
  2. [§4.3] The unlinkability argument for BACAP is a heuristic sketch rather than a formal reduction; for example, the statement that 'there is no unique solution' to the ECDLP equation needs a precise indistinguishability argument to be a proof.
  3. [Appendix I] The paper promises 'machine-checkable proofs' but only provides a URL; no proofs appear in the manuscript itself, so the reader cannot verify the claimed rigorous analysis from the submitted document.
  4. [§6.1] There is a typo in 'speciic client' in the Courier paragraph.
  5. [§9] The word 'meaningffully' appears in the conclusion and should be corrected to 'meaningfully.'

Circularity Check

0 steps flagged · score 0.0 of 10

No circular derivation found: the central claims rest on stated cryptographic and traffic assumptions, while the admitted leaks in Sections 5.7 and 6.2 are gaps, not self-referential reductions.

full rationale

I walked the claimed derivation chain. The traffic-coupling lemma (Section 3.2) is an if-then statement about mixtures of uniform processes; its proof is correct and it is used as a design criterion, not as a fitted parameter or as a conclusion that assumes itself. The BACAP unlinkability argument (Section 4.3) reduces to stated KDF/ECDLP assumptions and does not rename a fitted value as a prediction. The Pigeonhole protocols (Section 5) are evaluated qualitatively; no parameter is fitted to data and then presented as an independent result. The self-references to Katzenpost, Masala, and the PKI source files ([9], [32], [43], [50]) are implementation and deployment pointers; they are not load-bearing mathematical premises, and no uniqueness theorem is imported from the authors' prior work. The closest candidates for concern are Section 5.7's admission that "read and write requests provide replicas with a rough, probabilistic ordering of the box IDs" and Section 6.2's Replica+Contact and Gateway+Courier attacks; these undercut the abstract's strong-metadata-privacy claim, but they are stated limitations and attack descriptions rather than circular derivations in which an output equals an input by construction. Accordingly, no circular step can be exhibited with a quote and a specific reduction; score 0.

Assumptions & free parameters 4 free parameters · 5 assumptions · 0 invented entities

The listed free parameters are hand-picked values used in the performance evaluation, not fitted to external data. The axioms are the background security assumptions the design relies on, mostly carried over from prior literature or stated without proof. No new physical entities are introduced; 'couriers' and 'replicas' are software components within the system, not independent theoretical postulates.

free parameters (4)
  • per-hop mean delay mu = 0.2 s in the Zero Knowledge Network example
    Latency claims (average round-trip 1.8 s, 0.2% probability over 4 s) are computed from this chosen value; it is not measured or fitted.
  • client packet send rate = 2.5 packets/s in the example
    Bandwidth overhead estimates (77 kB/s, 6.7 GB/day) depend on this chosen Poisson rate.
  • user payload size = 30 kB
    The claim that 96% of bandwidth is usable payload depends on this chosen packet size.
  • PKI epoch length = 20 minutes
    PKI download frequency and WSRV rotation interval are set to 20 minutes by design choice.
assumptions (5)
  • domain assumption Application traffic destinations can be made indistinguishable from uniformly random service selection
    The traffic-coupling lemma in Section 3.2 requires this premise for unobservability; the paper does not prove Pigeonhole reads and writes satisfy it, and Section 5.7 concedes replicas learn box-ID orderings.
  • domain assumption Sphinx provides the assumed anonymity and integrity properties
    The design builds on Sphinx [30] and assumes its security properties hold as a black box.
  • domain assumption The KDF is a secure pseudorandom function and the reduction mod ℓ has negligible bias
    BACAP unlinkability (Section 4.3) and forward secrecy (Section 4.2) rest on these assumptions; no specific KDF or security proof is given.
  • domain assumption The modified Ed25519 signing algorithm operating directly on scalars is secure
    BACAP uses 'Ed25519-SIGN' which skips the standard hashing step; the paper cites no security proof for this variant.
  • domain assumption The hybrid KEM combiner preserves IND-CCA2
    Post-quantum security of KEM Sphinx relies on the theorem from [59]; the paper does not prove the combination in its own context.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Echomix: a Strong Anonymity System with Messaging." pith.science (2026). https://pith.science/paper/SF4T7LW4

@misc{pith2026250102933,
  author       = {Pith},
  title        = {Pith review of: Echomix: a Strong Anonymity System with Messaging},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/SF4T7LW4}},
  note         = {Machine review of arXiv:2501.02933}
}
read the original abstract

Echomix is a practical mix network framework and a suite of associated protocols providing strong metadata privacy against realistic modern adversaries. It is distinguished from other anonymity systems by a resistance to traffic analysis by global adversaries, compromised contacts and network infrastructure, quantum decryption algorithms, and statistical and confirmation attacks typical for multi-client messaging setting. It is implemented as Katzenpost, a robust software project, and used in multiple deployed systems, and features relatively low latency and bandwidth overhead. The contributions of this paper are: (1) Improvements on leading mix network designs, supported by rigorous analysis. These include solutions to crucial vulnerabilities to traffic analysis, malicious servers and active attacks. (2) A cryptographic group messaging protocol with strong metadata protection guarantees and reliability. (3) Hybrid post-quantum nested packet encryption.

Figures

Figures reproduced from arXiv: 2501.02933 by the authors.

Figure 1
Figure 1. A client’s interaction with the service node is a [PITH_FULL_IMAGE:figures/full_fig_p002_1.png] view at source ↗
Figure 2
Figure 2. In Loopix, as Alice communicates with Bob, the [PITH_FULL_IMAGE:figures/full_fig_p004_2.png] view at source ↗
Figure 3
Figure 3. Replication is marked in blue, Alice’s write operation green, Bob’s read operation red, and Couriers’ fixed-throughput connection to the replicas in purple [PITH_FULL_IMAGE:figures/full_fig_p007_3.png] view at source ↗
Figures from the paper (1 more)
Figure 4
Figure 4. Figure 4: A circuit diagram of unwrapping a KEM Sphinx [PITH_FULL_IMAGE:figures/full_fig_p011_4.png]

Discussion (0). Continue with ORCID to comment.

Forward citations

Cited by 1 Pith paper

Reviewed papers in the Pith corpus that reference this work. Sorted by Pith novelty score. Full citation record

  1. Towards Anonymous Neural Network Inference

    cs.CR 2025-05 reject novelty 5.0 of 10

    funion applies Echomix's Pigeonhole storage and BACAP capabilities to run neural network inference through a store-compute-store pipeline, claiming sender-receiver unlinkability inherited from the mixnet.

Reference graph

Works this paper leans on

68 extracted references · 68 canonical work pages · cited by 1 Pith paper

  1. [1]

    Data and metadata brokering: Th eory and practice from the bcube project

    Siri Jodha Singh Khalsa. Data and metadata brokering: Th eory and practice from the bcube project. Data Science Journal , Jan 2017

    work page 2017

  2. [2]

    Me, my metadata, and the n sa: Privacy and government metadata surveillance programs

    Bryce Newell and Joseph Tennis. Me, my metadata, and the n sa: Privacy and government metadata surveillance programs. 03 2014

    work page 2014

  3. [3]

    https://www.aljazeera.com/news/2021/10/29/ belarus-classifies-social-media-channels-as-extremis t

    Belarus classifies social media channels as ‘ex- tremist’. https://www.aljazeera.com/news/2021/10/29/ belarus-classifies-social-media-channels-as-extremis t

    work page 2021

  4. [4]

    https://shorturl.at/QnPIg

    Nsa can map your movements, determine your fellow travel ers with cell data. https://shorturl.at/QnPIg

    work page

  5. [5]

    Ex-nsa chief: ’we kill people based on metadata’

    Lee Ferran. Ex-nsa chief: ’we kill people based on metadata’. https://abcnews.go.com/blogs/headlines/20 14/05/ ex-nsa-chief-we-kill-people-based-on-metadata

    work page

  6. [6]

    This undisclosed whatsapp vulnerability le ts govern- ments see who you message

    Sam Biddle. This undisclosed whatsapp vulnerability le ts govern- ments see who you message. https://theintercept.com/2024 /05/22/ whatsapp-security-vulnerability-meta-israel-palesti ne/

    work page 2024

  7. [8]

    https://www.cloaked.io/

    work page

  8. [9]

    https://github.com/katzenpost/katzen

    Masala. https://github.com/katzenpost/katzen

    work page

Show all 68 references
  1. [10]

    https://torproject.org

  2. [11]

    Network flow water marking: A survey

    Alfonso Iacovazzi and Y uval Elovici. Network flow water marking: A survey. Commun. Surveys Tuts. , 19(1):512–530, jan 2017

    2017

  3. [12]

    Reiter, Chenxi Wang, and Matthew K

    Brian Neil Levine, Michael K. Reiter, Chenxi Wang, and Matthew K. Wright. Timing attacks in low-latency mix system s (extended abstract). In Financial Cryptography, 2004

    2004

  4. [13]

    Spying in the dark: Tcp an d tor traffic analysis

    Y ossi Gilad and Amir Herzberg. Spying in the dark: Tcp an d tor traffic analysis. In International Symposium on Privacy Enhancing Technologies, 2012

    2012

  5. [14]

    Malaney, R afiqul M

    Ishan Karunanayake, Nadeem Ahmed, Robert A. Malaney, R afiqul M. D. Islam, and Sanjay Kumar Jha. De-anonymisation attacks on tor: A survey. IEEE Communications Surveys & Tutorials , 23:2324–2350, 2020

    2020

  6. [15]

    Dropping on the e dge: Flexibility and traffic confirmation in onion routing protoc ols

    Florentin Rochet and Olivier Pereira. Dropping on the e dge: Flexibility and traffic confirmation in onion routing protoc ols. Proceedings on Privacy Enhancing Technologies , 2018:27 – 46, 2018

    2018

  7. [16]

    https://www.ndr.de/fernsehen/sendungen/panorama/aktuell/ Anonymisierungsdienst-Tor-angreifbar-Snowden-Effekt-verpufft, tor192.html

    Anonymisierungsdienst tor angreifbar: Snowden-effe kt verpufft. https://www.ndr.de/fernsehen/sendungen/panorama/aktuell/ Anonymisierungsdienst-Tor-angreifbar-Snowden-Effekt-verpufft, tor192.html

  8. [17]

    Piotrowska, Jamie Hayes, Tariq Elahi, Sebastia n Meiser, and George Danezis

    Ania M. Piotrowska, Jamie Hayes, Tariq Elahi, Sebastia n Meiser, and George Danezis. The loopix anonymity system. In 26th USENIX Security Symposium (USENIX Security 17) , pages 1199– 1216, V ancouver, BC, August 2017. USENIX Association

    2017

  9. [18]

    The Ny m Network https://nymtech.net/nym-whitepaper.pdf

    Claudia Diaz, Harry Halpin, and Aggelos Kiayias. The Ny m Network https://nymtech.net/nym-whitepaper.pdf

  10. [19]

    vs Jeremy Hammond complaint

    U.S. vs Jeremy Hammond complaint. https://www. justice.gov/archive/usao/nys/pressreleases/March12/hackers/ hammondjeremycomplaint.pdf

  11. [21]

    https://github.com/CloakedServices/CloakedNetwo rkPoC/tree/ main/katzensocks

  12. [22]

    David L. Chaum. Untraceable electronic mail, return ad dresses, and digital pseudonyms. Commun. ACM , 24(2):84–90, feb 1981

    1981

  13. [23]

    Anonymity trilemma: Strong anonymity, low ban d- width overhead, low latency—choose two

    Debajyoti Das, Sebastian Meiser, Esfandiar Mohammadi , and Aniket Kate. Anonymity trilemma: Strong anonymity, low ban d- width overhead, low latency—choose two. Cryptology ePrint Archive, Paper 2017/954, 2017. https://eprint.iacr.org/ 2017/954

    2017

  14. [24]

    https://hoprnet.org/

  15. [25]

    Luis von Ahn, Andrew Bortz, and Nicholas J. Hopper. k- anonymous message transmission. In Proceedings of the 10th ACM Conference on Computer and Communications Security , CCS ’03, page 122–130, New Y ork, NY , USA, 2003. Association for Computing Machinery

    2003

  16. [26]

    DC Network , pages 313–315

    Gerrit Bleumer. DC Network , pages 313–315. Springer US, Boston, MA, 2011

    2011

  17. [27]

    Hang wit h your buddies to resist intersection attacks

    David Isaac Wolinsky, Ewa Syta, and Bryan Ford. Hang wit h your buddies to resist intersection attacks. In Proceedings of the 2013 ACM SIGSAC conference on Computer &; communications security - CCS ’13 , CCS ’13. ACM Press, 2013

    2013

  18. [28]

    Eluding carnivores: file sharing with strong anonymi ty

    Emin G¨ un Sirer, Sharad Goel, Mark Robson, and Doundefin edan Engin. Eluding carnivores: file sharing with strong anonymi ty. In Proceedings of the 11th Workshop on ACM SIGOPS European Workshop, EW 11, page 19–es, New Y ork, NY , USA, 2004. Association for Computing Machinery

    2004

  19. [29]

    Talek: Private group messaging with hidden access patterns

    Raymond Cheng, William Scott, Elisaweta Masserova, Ir ene Zhang, Vipul Goyal, Thomas Anderson, Arvind Krishnamurthy , and Bryan Parno. Talek: Private group messaging with hidden access patterns. Cryptology ePrint Archive, Paper 2020/06 6, 2020. https://eprint.iacr.org/2020/066

    2020

  20. [30]

    Sphinx: A compact and p rov- ably secure mix format

    George Danezis and Ian Goldberg. Sphinx: A compact and p rov- ably secure mix format. In 2009 30th IEEE Symposium on Security and Privacy , pages 269–282, 2009

    2009

  21. [31]

    Stop- and- go-mixes providing probabilistic anonymity in an open syst em

    Dogan Kesdogan, Jan Egner, and Roland B¨ uschkes. Stop- and- go-mixes providing probabilistic anonymity in an open syst em. volume 1525, pages 83–98, 04 1998

    1998

  22. [32]

    https://github.com/katzenpost

  23. [33]

    Post quantum noise

    Y awning Angel, Benjamin Dowling, Andreas H¨ ulsing, Pe ter Schwabe, and Florian Weber. Post quantum noise. IACR Cryp- tology ePrint Archive , 2022, 2022

    2022

  24. [34]

    https://spec.torproject.org/dir-spec/index.html

  25. [35]

    Bridging and fingerpr inting: Epistemic attacks on route selection

    George Danezis and Paul Syverson. Bridging and fingerpr inting: Epistemic attacks on route selection. volume 5134, pages 15 1–166, 07 2008

    2008

  26. [36]

    Bernstein, Niels Duif, Tanja Lange, Peter Sch wabe, and Bo-Yin Y ang

    Daniel J. Bernstein, Niels Duif, Tanja Lange, Peter Sch wabe, and Bo-Yin Y ang. High-speed high-security signatures. In B art Preneel and Tsuyoshi Takagi, editors, Cryptographic Hardware and Embedded Systems – CHES 2011 , pages 124–142, Berlin, Heidelberg, 2011. Springer Berli...

    2011

  27. [37]

    Bernstein, Daira Hopwood, Andreas H¨ ulsing, Tanja Lange, Ruben Niederhagen, Louiza Papachristodoulou, Mich ael Schneider, Peter Schwabe, and Zooko Wilcox-O’Hearn

    Daniel J. Bernstein, Daira Hopwood, Andreas H¨ ulsing, Tanja Lange, Ruben Niederhagen, Louiza Papachristodoulou, Mich ael Schneider, Peter Schwabe, and Zooko Wilcox-O’Hearn. Sphin cs: Practical stateless hash-based signatures. In Elisabeth O swald and Marc Fischlin, editors, A...

    2015

  28. [38]

    https://cordis.eur opa.eu/ project/id/653497

    Privacy and accountability in networks via optimized r andomized mix-nets, grant agreement id: 653497. https://cordis.eur opa.eu/ project/id/653497

  29. [39]

    Heartbeat traffic to co unter (n-1) attacks: Red-green-black mixes

    George Danezis and Len Sassaman. Heartbeat traffic to co unter (n-1) attacks: Red-green-black mixes. In Proceedings of the 2003 ACM Workshop on Privacy in the Electronic Society , WPES ’03, page 89–93, New Y ork, NY , USA, 2003. Association for Comput- ing Machinery

    2003

  30. [40]

    Murdoch, and Carmela Troncoso

    Claudia Diaz, Steven J. Murdoch, and Carmela Troncoso. Impact of network topology on anonymity and overhead in low-latenc y anonymity networks. In Mikhail J. Atallah and Nicholas J. Ho pper, editors, Privacy Enhancing Technologies , pages 184–201, Berlin, Heidelberg, 2010. Spr...

    2010

  31. [41]

    From a trickle to a flood: Active attacks on several mix types

    Andrei Serjantov, Roger Dingledine, and Paul Syverson . From a trickle to a flood: Active attacks on several mix types. volum e 2578, 02 2003

    2003

  32. [42]

    Compulsion resistan t anony- mous communications

    George Danezis and Jolyon Clulow. Compulsion resistan t anony- mous communications. pages 11–25, 06 2005

    2005

  33. [43]

    https ://github

    David Stainton, Y awning Angel, and Masala, 2022. https ://github. com/katzenpost/katzenpost/blob/main/core/pki/document.go

    2022

  34. [44]

    No right to remain silent: Isolating malicious mi xes, 09 2018

    Hemi Leibowitz, Ania Piotrowska, George Danezis, and A mir Herzberg. No right to remain silent: Isolating malicious mi xes, 09 2018

    2018

  35. [45]

    Tor Project, November 2013

    Tor rendezvous specification - version 3. Tor Project, November 2013. https://github.com/torproject/torspec/ blob/main/ rend-spec-v3.txt#L2302-L2307

    2013

  36. [46]

    AES-GCM -SIV: Nonce Misuse-Resistant Authenticated Encryption

    Shay Gueron, Adam Langley, and Y ehuda Lindell. AES-GCM -SIV: Nonce Misuse-Resistant Authenticated Encryption. RFC 845 2, April 2019. https://www.rfc-editor.org/info/rfc8452

    2019

  37. [47]

    Seda: an arch itecture for well-conditioned, scalable internet services

    Matt Welsh, David Culler, and Eric Brewer. Seda: an arch itecture for well-conditioned, scalable internet services. SIGOPS Oper . Syst. Rev., 35(5):230–243, oct 2001

    2001

  38. [48]

    Kara oke: distributed private messaging immune to passive traffic ana lysis

    David Lazar, Y ossi Gilad, and Nickolai Zeldovich. Kara oke: distributed private messaging immune to passive traffic ana lysis. In Proceedings of the 13th USENIX Conference on Operating Syst ems Design and Implementation , OSDI’18, page 711–725, USA, 2018. USENIX Association

    2018

  39. [49]

    Consistent hashing and random trees: distributed caching protocols for relieving hot spots on the world wide web

    David Karger, Eric Lehman, Tom Leighton, Rina Panigrah y, Matthew Levine, and Daniel Lewin. Consistent hashing and random trees: distributed caching protocols for relieving hot spots on the world wide web. In Proceedings of the Twenty-Ninth Annual ACM Symposium on Theory of Co...

    1997

  40. [50]

    https ://github

    David Stainton, Y awning Angel, and Masala, 2022. https ://github. com/katzenpost/katzenpost/blob/main/core/pki/sharedrandom.go

    2022

  41. [51]

    https://github.com/katzenpost/hpqc

  42. [52]

    The noise protocol framework

    Trevor Perrin. The noise protocol framework. noiseprotocol, Protocol Revision , 34, 2018. https://noiseprotocol.org/noise.pdf

    2018

  43. [53]

    Fle xible authenticated and confidential channel establishment (fac ce): Ana- lyzing the noise protocol framework

    Benjamin Dowling, Paul R¨ osler, and J¨ org Schwenk. Fle xible authenticated and confidential channel establishment (fac ce): Ana- lyzing the noise protocol framework. In Aggelos Kiayias, Ma rkulf Kohlweiss, Petros Wallden, and V assilis Zikas, editors, Public-Key Cryptography ...

    2020

  44. [54]

    Universal hash proofs a nd a paradigm for adaptive chosen ciphertext secure public-ke y en- cryption

    Ronald Cramer and Victor Shoup. Universal hash proofs a nd a paradigm for adaptive chosen ciphertext secure public-ke y en- cryption. In Lars R. Knudsen, editor, Advances in Cryptology — EUROCRYPT 2002 , pages 45–64, Berlin, Heidelberg, 2002. Springer Berlin Heidelberg

    2002

  45. [55]

    Bernstein

    Daniel J. Bernstein. Curve25519: New diffie-hellman sp eed records. In Public Key Cryptography - PKC 2006, 9th International Conference on Theory and Practice of Public-Key Cryptograp hy, volume 3958 of Lecture Notes in Computer Science , pages 207–

    2006

  46. [56]

    Bernstein, Fabio Campos, Tu ng Chou, Tanja Lange, Michael Meyer, Benjamin Smith, and Jana Sot´ akov´ a

    Gustavo Banegas, Daniel J. Bernstein, Fabio Campos, Tu ng Chou, Tanja Lange, Michael Meyer, Benjamin Smith, and Jana Sot´ akov´ a. CTIDH: faster constant-time CSIDH. Cryptology ePrint Arch ive, Paper 2021/633, 2021. https://eprint.iacr.org/2021/633

    2021

  47. [57]

    Eduarda S. V . Freire, Dennis Hofheinz, Eike Kiltz, and K enneth G. Paterson. Non-interactive key exchange. In Kaoru Kurosawa and Goichiro Hanaoka, editors, Public-Key Cryptography – PKC 2013, pages 254–271, Berlin, Heidelberg, 2013. Springer Berlin Heidelberg

    2013

  48. [58]

    X- wing: The hybrid KEM you’ve been looking for

    Manuel Barbosa, Deirdre Connolly, Jo˜ ao Diogo Duarte, Aaron Kaiser, Peter Schwabe, Karoline V arner, and Bas Westerbaan . X- wing: The hybrid KEM you’ve been looking for. Cryptology ePr int Archive, Paper 2024/039, 2024. https://eprint.iacr.org/ 2024/039

    2024

  49. [59]

    KEM combiners

    Federico Giacon, Felix Heuer, and Bertram Poettering. KEM combiners. Cryptology ePrint Archive, Paper 2018/024, 201 8. https://eprint.iacr.org/2018/024

    2018

  50. [60]

    EROR: Efficient repliable onion routin g with strong provable privacy

    Michael Klooß, Andy Rupp, Daniel Schadt, Thorsten Stru fe, and Christiane Weis. EROR: Efficient repliable onion routin g with strong provable privacy. Cryptology ePrint Archive, P aper 2024/020, 2024. https://eprint.iacr.org/2024/020. Appendix I: Machine-checkable proofs For th...

    2024

  51. [61]

    The sender’s ephemeral hybrid public key: a) x25519 public key b) CTIDH-1024 public key

  52. [62]

    for each designated replica: a) 256-bit DEK encrypted to the replica’s public key

  53. [63]

    enveloped message which the courier can’t decrypt For write requests, couriers see:

  54. [64]

    SURB for courier to ACK receipt of request once at least one replica has accepted it For read requests, couriers see:

  55. [65]

    Immediate-use SURB, for courier to ACK receipt of the encrypted (to the client) reply from the designated replica

  56. [66]

    replica/shard id designating each replica to contact Appendix III: Structure of replica envelopes Replicas see write requests as:

  57. [69]

    enveloped message, encrypted with DEK, containing a BACAP message: a) BACAP box ID ( M ctx i ) b) BACAP payload ( c ctx i ) c) BACAP signature ( s ctx i ) Replicas see read requests as:

  58. [70]

    sender’s ephemeral public key

  59. [71]

    envelope DEK encrypted with shared secret between sender private key and replica public key

  60. [72]

    enveloped message, encrypted with DEK, containing a BACAP box ID: a) BACAP box ID ( M ctx i )

Pith tools

Reviewed August 10, 2026 · model on record in the stance chip above.