1 · What an observer reads off your encrypted traffic
Encryption hides your words. An observer watching your link still learns that you sent something, when you sent it, how big it was, and how often you send. Give that observer a week of timestamps and packet sizes and they can draw your social graph without touching a cipher. Police, advertisers, and intelligence agencies buy and build exactly this.
The mixnet starves that observer. The design goal: someone watching any link, or many links at once, should learn as close to nothing as the mathematics allows about who is communicating with whom.
2 · The wire has one shape
Your mixnet link transmits fixed-size frames at a fixed rate while you talk, while you sleep, and while your phone sits in your pocket. When you send a message, it displaces a padding frame. The padding costs the same cryptographic work as a real frame, so a stopwatch can't separate them either. Speak or stay silent; the wire looks the same. An observer who reads volume and timing reads a flat line.
3 · Onions: each relay learns one fact
You wrap each packet in one encryption layer per relay, the Sphinx construction. Each relay peels its own layer, reads the single fact inside (the next hop), and forwards a packet of unchanged size. No relay sees both ends of a conversation.
- Each layer authenticates itself. A relay that receives a tampered header drops the packet. The payload rides inside a wide-block permutation (Lioness): flip one bit anywhere and all 1,024 bytes scramble. An attacker who marks a packet at one relay finds nothing to recognize at the next, which kills the classic tagging attack.
- You can be answered without being found. You enclose a single-use reply block: a return path you built, which the responder can use once and cannot read. They answer you without learning who you are.
4 · The chain rolls the dice for your route
Let clients pick relays and an attacker running a few popular relays wins more often. So nobody picks. The Chia blockchain publishes the output of a verifiable delay function: a random value nobody can predict before it exists or bend after, and one your own node checks for itself. Your client draws its path across the stratified relay layers from that shared roll.
5 · Delivery names no sender
Bytes arrive. That is all the transport tells the receiving application: no sender field, no return address. A sender field would either leak or lie. You and your contact prove yourselves to each other end to end, above the network, where no relay can watch. The network stores nothing that maps who knows whom.
6 · Pay for speed without writing a diary
Relays sell capacity. Meter it in bytes and the meter becomes a diary of when you talked, the record cover traffic exists to erase. So the mixnet prices reserved rate over a window of time. You buy the right to fill more of your constant frames with real data. The relay enforces a rate cap and counts nothing. Tickets are issued blind and bound to one relay-and-link pair: they name no buyer and spend nowhere else. Your paid link and your neighbor's free one look identical on the wire.
7 · The network hands you its own client: the seed
Download an anonymity app from a store and you have taken the store's word for what you got. The mixnet routes around the store. You start from the seed, a program short enough to read: 1,479 lines today, a 2,000-line ceiling the build enforces, ten cryptography libraries, one UDP socket, no DNS, no web client.
The seed sends one anonymous request through the mix and asks for a signed index
of software. The first entry is the full mixnet client. The seed fetches the
pieces, checks every piece against its hash, checks the whole file against a
signature from a release key printed in the seed's own source, refuses any index
older than one it has seen, stages the file, renames it, prints what it verified,
and exits. Distrust your computer's random number generator? Run
--dice, roll a hundred dice, and type the faces. The seed hashes your
rolls together with the machine's randomness, so weak dice still get the machine's
entropy and a rigged machine still gets your dice.
You fetch the seed itself over the ordinary web once. That one download is the entire leap of faith, it comes with published checksums, and it is small enough that reading the source is a genuine alternative to trusting us.
8 · Claims come with commands
The seed ships an audit protocol, AUDIT.md, that maps each claim to something you can run: the line-count gate, the dependency gate, the dead-code gate, and a harness that compiles the seed's code beside the real relay implementation and replays every exchange in both directions. Six theorems, published here, state the seed's promises: exact parsers, no unverified write, one network destination, no rollback, bounded retries, format conformance. A Lean 4 proof development for the six is in progress and will check in the same CI that builds these downloads. We publish the obligations first so you can hold us to them.
9 · Limits, in writing
- Anonymity here is a budget. An observer's residual chance of linking you never reaches zero, and your protection grows as more real traffic shares the cover. A young, quiet network protects less than a busy one.
- Your application owns the content. The transport hides who and when. Encrypting what you said, and proving who you are to your contact, happens end to end above it.
- A stolen link key opens recorded link traffic. The point-to-point session key derives from two static keys, so an attacker who records your link and later steals one of them opens those frames. The onion layers inside carry their own keys. The source states this limit at the line where the session is derived.
- The proofs cover our code, and stop there. The theorem work proves the seed implements what it says. Sphinx itself, and the ciphers under it, stand on the published cryptography literature, which the proofs name as assumptions.