what jimichi does not protect

a tool that hides some metadata is easy to overtrust. these are the edges, stated plainly.

a global observer: the model does not cover an adversary who watches every link at once.
a compromised device: if your phone or computer is taken over, jimichi cannot help. neither can side-channel attacks on it.
root on a relay host: locked memory stops swapping, not a privileged reader. against root on the machine hosting a node, process-level measures do not work.
connection timing: each circuit opens and closes its own tcp connections along the chain. those moments match and are visible to a global observer; the attack here does not measure them.
coercion: the deniable container gives a cover story, not immunity against being forced to hand over a password.

where the results stop.

nodes are containers on a single machine. network delays and the separation between operators are modelled, not reproduced.
the correlation attack runs where the true flow labels are known. carrying the estimates to a real network needs care.
the dataset is synthetic: cover traffic is generated, not captured from real users.
latency needs a clock finer than a millisecond, so latency runs happen on linux, not on a windows host.

the gost implementation is not a certified cryptographic facility. the algorithms are the same and checked against the standards test vectors, but no protection class is claimed.
libraries keep their own copies of keys on the go heap, and the aead working key stays there for the life of the circuit. secmem protects only its own buffers.
circuit layers have no forward secrecy against a neighbour: the node key lives until the node restarts. a wire capture alone cannot be read without the ephemeral link keys.
the cell format has constant size and replay protection but is not full sphinx: nothing else hides a node’s position in the chain.

sending on a node’s own clock needs the node period a few percent shorter than the client’s; the testbed uses 5%. with equal periods a missed tick is never caught up.
a link is covered only if the node sending on it has the measure on. the client cannot check that its nodes do.
the circuit setup cell leaves at once, not on the node clock, and marks the start of a circuit on every link.
without own-clock sending, the exit reply leaves after delivery, so a real recipient’s delivery time would show.

it breaks through the environment rather than the cryptography: filesystem journals, shadow copies, timestamps, ssd wear-leveling and trim leave traces of writes.
an adversary with several snapshots of the container over time sees changes where the decoy claims nothing happened. the property is not claimed against that adversary.