goals and roadmap
plans, not promises. dates and scope will move as the measurements come in.
- hide who talks to whom
- not only what is said. the relay chain, fixed-size cells and node clocks target the metadata that encryption leaves in the open.
- measure what it is worth
- each protection is meant to ship with the attack against it and a measured price in bandwidth and latency. that is done for flow linking with one baseline attack. the cooperative client cell-key series is complete and descriptive; it does not replace the passive measurements. the historical c25519 timing-mark series is measured on f0f1885 with a joint identification/responsiveness endpoint. external key acquisition, recorded-traffic decryption, node compromise and client container measurements remain unmeasured. the remaining full node-observation work is required for v0.4.0, in design and not implemented.
- keep keys out of reach
- key buffers sit in locked memory and are zeroed after use, and a node writes nothing to disk itself. the client container holds no key material, but its file with the password of a volume reproduces the identity key and the fetch capability. copies the crypto libraries keep on the heap are not locked and can reach swap; locking all process memory is planned.
- stay open
- the system, the attack and the harness are public under agpl-3.0, so anyone can rerun the figures.
thesis
the system and its measurements.
- three-relay chain, nested layers, fixed-size cells
- key buffers in locked memory, a relay writes nothing to disk itself
- own traffic correlation attack as a measuring tool
- x25519 suite by default, gost suite behind the same interface
- node authentication: signed descriptors the client checks against a ca anchor
- authenticated links between relays: a relay extends a circuit only to a node of its roster, and the client takes the bundles of its chain from its entry alone
- forward secrecy for circuit layers: a node replaces its onion key on a timer and releases the replaced one, so a kept setup cell opens only while that key lives
- a node list longer than three: the client draws its entry and the rest of its chain at random from the nodes it lists, five relays on the testbed
- an end-to-end layer between clients: a kk handshake and a hash ratchet over the same crypto interface, on both suites
- a mailbox at the exit that keeps only records it cannot read, in memory, and two clients that talk through it on the testbed
- offline deniable authentication between clients, shown by forging a conversation with the production session code
- a client container of a constant size with one or two volumes, written once: the file holds no key, but with the password of a volume it reproduces the identity key and the fetch capability
- a measured historical c25519 timing-mark series, with active/sham controls, wrong declarations and original-circuit responsiveness kept visible
- a cooperative assay of three client cell keys in exported Object payloads, none versus all during the circuit and after cleanup; the registered series is measured
- next: the remaining full node-observation measurements, required for v0.4.0 and still in design, the -peer client that keeps its identity in the container, a distinguisher of one volume from two and measuring the end-to-end path through the mailbox; external acquisition, disk/swap/history and recorded-traffic decryption remain unmeasured and deferred beyond v0.4.0
alpha
a client people can hold.
- mobile and desktop client over the same go core
- the app screens shown on this site, made real
research in japan
a master's programme, and study for the product.
- one research contribution on metadata protection
- trust split across relays with independent operators
- hardened node systems, confidential computing later
- publication at security venues
product
open core, relays that forget.
- open core under agpl, relays kept in ram only
- pluggable transports from the client to the entry node
- modern link handshake with pinned keys, fixed frames kept
- public beta, then an independent audit of a frozen version