Hiding Network Metadata: Introduction to Mixnets

Transcript

[music] Um, okay, let's go to the first slide. We don't have much time, but as you've heard, uh, you know, Vitalic and other people have understood that mix nets are imported and that they offer better privacy for certain kinds of traffic uh than even tour. So I think it's important that people understand how they work and what they are and what design choices you can make in a mix that so obviously uh if you use only something like ZK snarks on chain you will not be private. It's like building a house on sand. Uh the the reason is that network level metadata is

everywhere. It's obviously TCP IP UDP TLS all current web protocols. not it's particularly bad situation uh with Ethereum's uh blockchain broadcast traffic and uh it's the same for every blockchain. So we do need this and as someone like Akmed Gapor would note uh metadata has no or lower legal protection in almost every single jurisdiction than data. So if you're a private company like chain analysis or nation state wanting to dox people that's what you aim for. You don't try to break the crypto. As Whitfield Diffy said, you go for signals intelligence.

Um, now what mixnetss are built to defeat is something called a global passive adversary. Uh, which to rules out of their threat model. And a global passive adversary can't break encryption but can watch the entire network which is pretty spooky. So they can see everything that you're doing and use AI to deanonymize you. So they just capture all network traffic, write it and run algorithms against it. So a question is how can you measure being anonymous in general on the internet? So there's an answer I recommend reading it. It's actually quite readable called anonymity unlinkability undetectability, and unobservability uh by Merritt Hansen and the famous

unfortunately departed Andreas Fitzman. But what they say is that being anonymous is simply being unidentifiable within a set of subjects. So if you all packets look the same and they're all encrypted and they're all doing the same thing like these wonderful V for vendetta mask then you are that's the anonymity set. So let's say there's I don't know it's a pretty common concept. Let's say there's 200 people using privacy pools. Uh that's your anonymity set is 200 people. And but then the the problem is that that's not a particularly great way to like measure being anonymous, right? So for example, um if you're using tour,

it's pretty well known, and this is what Vitalik pointed out yesterday, your circuits move every 10 minutes. So tour is not a mixet. Neither is these other weird designs like I2P or Loki or whatever. Um what tour is is an onion routing system and you can kind of monitor the packets coming in and the packets coming out because remember a global passive adversary can monitor the whole network and you use statistical correlation to deanonymize traffic like we can do that on a laptop. Um now the solution which is all the way from 1981 was invented by David Cham. It's called a mixnet. A mixnet kind of does what you think it does. Unlike tour onion routing

systems, it takes traffic and it mixes the traffic up together. So it shuffles it like a deck of cards. And so the bits of the messages are unlinkable using packet formats like Sphinx and it prevents uh traffic analysis based on message order and timing. Now the important thing is anonymity sets are not a good way to measure how anonymous you are because an adversary can watch packets and learn information. So for example, if two people are online at the same time, that's a kind of a bit some information that may be relevant to figuring out if they're sending messages to each other, right? So you can

basically look at all the kinds of side channel information uh that you could have and then you basically take model the enemy's knowledge using what's called entropy. So entropy you might have heard of it uh but essentially like if all four users are equally likely to send a message um then everyone has equal entropy equal probability of being the sender. But if some user was online, another user was, and all the three of were off, it's more likely that that user sent their data through the mixet. And I we have some illustrations of it. I really won't go into it in in detail, but again, it's an open debate between uh between essentially us if entropy is a good way

to measure anonymity. What you need to know is the more entropy you have in a system, the more all the packets and users kind of look the same, the more anonymous you are. The max anonymity is the maximum entropy. And there are currently no other good metrics to measure anonymity. So we're going to go through some illustrations of these metrics. So the simplest met mixet design is what's called a threshold mix. This is what Cmix does. You take you say if we have let's say five messages we mix them up and we send them all out at the same time. Now what's the problem here is you have to wait for five messages or 10 messages or 100 messages

whatever your threshold is to arrive. So that's the oldest mixet design actually deployed cipher punk mixets like mix minion and mixmaster um which were built in like the early 2000s and late 90s. They do they basically wait till traffic is delivered uh and then they say we're going to wait 10 minutes and then randomly send some packets out. That's called a pool mix. But what's the problem here? Uh the problem with threshold mixing is they have to wait for all these packets to arrive. So the latency is unknown. With pool mixing, the anonymity is based on the amount of traffic. So less messages, let's say only three messages arrive,

only one messages arrive, you're kind of screwed. So what we do at NIM is we do what's called a pan mix. We take advantage of the memoryless property of exponential distributions and as each message goes to a mix, it basically waits an unknown amount of time randomly selected from the exponential distribution and then sends it out. And based on the properties of a pan process, the user can know the average time it takes uh a mixed a mixed packet to arrive. And if it doesn't arrive, they can just resend it again. So the cool thing about this, the bad thing is that with a pan process mix or continuous time mix, you never know if a

message actually ever going to get out the mixet. But the good thing is if it does, great. uh because your entropy sets the max. So that's basically there's a tradeoff between anonymity, latency and bandwidth. That's the anatomy trilmma. I recommend reading that paper by Deodas. Uh but it basically explains some of the differences between the mixnet designs. Now another thing you can do is you probably don't want just one big mix node. You want a decentralized mixet. So maybe you want a peer-to-peer mixet.

Maybe you want layers. Maybe you want cascades. So what we did at NIM is we actually and this is the paper by our Ana Petroski who also co-invented the Lupix design is we measure the entropy using simulations of different designs. And so the short version is a multicascade chamom always has the same entropy. It's the number of mixes in the uh the number of messages in the threshold. A mixed network that's like peer-to-peer like Hopper generally has a pretty low anonymity and we can explain why in a second but effectively multiple different variations in the peer-to-peer mixing and the fact that the same mix node can mix multiple uh the same uh the

same node can mix packets multiple times is is pretty dangerous. Um so if you read the paper we basically come out with the solution that a layered topology is generally the best and the more users you have the entropy goes up. That's very important. And then if you don't have enough traffic in your system you can add fake traffic but fake traffic is expensive. So what you want to do is you want to have as many users using the system that makes your anonyomy set bigger and then you can have less mixing delays and less cover traffic with the same entropy. So we at NIM have been looking at uh cover traffic and you can see if you look at the Fcore um if you look at like tour

versus NIM NIM and tour without any cover traffic are actually pretty easy to deanonymize right like source 70 80%. However, uh if you put cover traffic to the max, so each time you're using cover traffic with this exponential distribution, your chances of being identified using deep learning go to about zero. Now, that's a lot of cover traffic. So, we're currently looking at even easier ways such as bursty cover traffic. Uh and then we could measure how much cover traffic is necessary to get entropy. So again, this is all from the paper from 2021. The volume of cover traffic needed by something like a

peer-to-peer mixnet uh has to increase with the increasing user base. So the more users you have, the more cover traffic you need. Uh with them, what you can see is that the anonyomy goes up, but the amount of cover traffic can go down as users go up. So that's a quite nice somewhat not intuitive result. Um, so I'll hand over the mic to Max and Max can talk about what NIM is and how to build on it. But just to repeat the three decisions you need to make with a mixet is what's your mixing strategy? Do you use cover traffic? And what's your network topology?

Thank you. Okay. So now Harry's gone over all of these various different attributes of different mixnet designs. I'm going to talk about NIM. So I'm going to talk about our design very briefly and then I'm going to talk about how you can actually integrate with NIM as well because we have lots of different SDKs built for lots of different environments for all the different types of applications that you want to be sending traffic through the mixnet. So what actually is NIM? We're a continuous time layered mixnet. So traffic is always moving through. You have these as a you have cover traffic going through with a pson distribution.

Harry's talked about the advantages of that. It is a layered mixnet as well which means that this helps in terms of defending against the potential for malicious nodes to try and dean anonymize people and it works today and it has been working for several years right we have over 700 nodes all run by a dis like a decentralized network of independent operators so we as NIM do not run any of this infrastructure right to make that very very clear um and it's free to use so you can plug in various different applications into the mixet and start getting some of these the advantages of these privacy properties today. You can read more um at goenim.com. We have all of our design papers, blog posts, and start off with

the white paper. And I know we're at an Ethereum conference, but as Harry has also said, you need to have a plurality. You need to have lots and lots of traffic moving through. But what you also importantly need, right, aside from just measuring, okay, tracking a packet that might come from you to a particular service, that's kind of um a certain point is defeated, right? If you know that for instance all of the traffic that's moving through a network is just Ethereum traffic or just a particular kind of traffic, what you also need is a plurality of different types of application traffic to kind of hide within. Right? It's pointless to be hiding within a group of people who are

all doing the same thing because even if you can tell, okay, maybe you're send not sending a packet right now, they know you're a particular type of user, right? So we have to actually get get to a situation and build a network that can support lots of different types of applications that you can hide your own traffic within. Right? A smaller user base and a less diverse user base is le equals less anonymity. Right? Um the kind of classic by line that's trotted around a lot at privacy conferences but is always worth repeating. Anonymity loves company. Okay. And so this is why we as well as the SDKs which is kind of the main focus of the rest of the talk.

We also have um the NIMVPN which is a an application for all desktop environments or mobile environments that basically is aiming to increase the usage of the network to outside crypto as well. So people can use it for messaging, they can use the DVPMO for web browsing. And so you can kind of all of your traffic, all of your cryptocurrency transactions or your smart contract interactions or whatever that you want to hide within is now going to be able to be hidden in this kind of larger mass of applications. Right? So that's briefly what NIM was. The main kind of focus of the rest of it, um I run the DevOp team.

Um so I'm going to talk about building on top of Nim. And if you have any questions about any of this, come and ask me afterwards or come to our workshop later. But basically now we have this network. Um you obviously need to give people a way to access the network. And we have a bunch of different SDKs, crates, libraries for both Typescript and Rust. Uh we also have FFI bindings for C++ and Go. And um any kind of requests for any other language interfaces as well, we can quite easily deal with. Right? So, all of this is detailed on our docs, nim.com/doccks developers. Um, and there's two ways that people can access it. Now, all of the stuff that we've been talking about, how kind of traffic

moves through this decentralized overlay network is very different from the way that like traffic usually moves through the internet or how even as a developer, you're not really necessarily used to thinking about networking, right? you might not even necessarily be thinking about which internet protocol you actually want to be using. Right? This is usually abstracted away from you. Um you don't necessarily have to think about whether you're using HTTPS or gpc. Right? Now developers we've given people access. So if they want to write kind of they want to write their own mixet networking interfaces they can do that.

They can access the raw kind of mixet client both in typescript and rust. Um and I will also note the typescript stuff can pass to web assembly. So all of this can be run in the browser as well right [snorts] or any web view app any mobile kind of environment. So we support everything everything from uh browser down to kind of like command line stuff. But I think the main focus that a lot of developers will like to use is these kind of these abstraction um these abstraction crates for various for basically like tunnel all of these [snorts] existing protocols through.

Yeah. Uh, so you can tunnel TCP, UDP, HTTPS, websockets, gRPC, whatever you want. You can tunnel it through the mixet. You have drop-in replacements for a bunch of networking code. So I'll show you some code, right? All of this sounds very complicated. All of this is dealt, all the kind of complicated privacy mixnet stuff is dealt with under the hood. This is a bunch of code for a crate, which is a drop-in replacement for fetch, which is your browser API. This is how you send HTTP traffic through the mixet. Um, we have working examples of this in our docs. You can load the web page in the docs. The MixNet client is embedded in the browser page. So you don't have to download anything. There's no config. And you can send you can interact with the with rail gun on Sapoleia or you can interact with

ENS through the mixet on in our documentation right in a web page and it's all there. Um we have a RS SDK with loads of crates. Okay, we've got to go to questions. We have a Rust SDK. We have a TypeScript SDK. We're also in the anon RPC uh which is alongside tour. [sighs and gasps] I'm doing a workshop on all of this. If any of this is interesting, come along at 2 o'clock in the afternoon and we can go through all of this together um with a little bit more time. Uh go to nim.com/doccks developers. And thanks and I would I would just like to thank Anespurat who helped out with some of

the slides. She's a researcher in mixn nets at university lee brousell. That's our emails. So we have a bunch of Q&A. I saw one question that got the most votes was not surprisingly what's the layered mixlet like nim and a free routing mixnet like hopper. Um so I'll just answer that question real quick. So it's not anonymous, right? Um the problem with that whole design is that is neither anonymous nor particularly fast. We looked at it basically pay by hop unless you're using NIM uses anonymous credentials unless you're using something like shielded transactions that will naturally deanonymize users.

Um and we already covered that peer-to-peer free routing offers very very little entropy compared to layered mixets and does not scale with users. So layered mixnetss the more users you have the more entropy you have. In general, that's uh not the case. Also, like Hopper lets you do weird stuff like or any peer-to-p peer mix that lets you only do like one hop is kind of not going to provide you as much anonymity as three hops. It may be a bit faster, but the cost of being less anonymous. Uh there's all these like technical points I won't want to go into, but essentially the problem uh we saw is that if like I mean I know NosisVPN is like in beta,

but effectively like we didn't even release our test net when we never had a point where we controlled all the exit nodes, but currently that is the case with NosisVPN. So you might as well just use a centralized VPN because all the exit nodes can dox you, right? Um, it's pretty uh not a great uh hopefully uh Hopper and NosisVPN fix that. And it's also very easy to censor a very small number of nodes. You only have 10 nodes, three exit nodes, you're easy to censor. The same mistakes are repeated but in a slightly different way by Hsoka's Knox mixet. So, you know, there is this problem where people really want to do to be honest kind of absurd things. One very absurd thing to do is to make a

mixet just for Ethereum traffic. That's like, hey, I want to make a tour but that's only used by criminals or like I want to make a mixnet but that's only used by I don't know pedophiles. That makes no sense because by using it you're [laughter] kind of like doxying yourself. Uh and you know or I want to make uh anomi network that's only used by the CIA or whatever. It's terrible. You want different This is again Roger Dingle's point. We want different kinds of user groups to work together. That's what gives you anonymity. So we looked at Nox. It claimed to be built like on Lupix, but it was also not built on Lupix. It's a free routing mixnet.

Again, all the nodes are ran by the same people. and then they say, "Oh, well, we're faster on the response, but essentially like I didn't go into single use reply blocks, but if you're sending anonymous reply back and it goes through the same hops, it's trivial to deanonymize." So, essentially the issue is uh these kinds of networks like building a mixet is not just about the crypto. It's about thinking through the design. I went through all different kinds of designs. There are new kinds of designs that people could build. I don't think NIM is necessarily the best. We have lots of problems. Here's a bunch of them here. We're slow. We could use fixed multiers. We're not postquantum

decentralized measurements. We're working all this stuff now. There's a lot of issues. But what we would like to see is not everyone try to reinvent their own mixnet because that's hurts everyone because everyone has less anonymity, less entropy. What we'd like to see is Ethereum researchers work on things which currently don't work on Ethereum very well like PIR new kinds of enemy networks like the fossil stuff DC nets all the stuff isn't built thank you so much we will be at the workshop we can answer any other questions there >> thank you Harry and Max I think we still have some time for I'll read out the most popular questions >> we have okay well maybe we could switch

to okay so I covered the first question The second question is yes, you can get uh you can get rewarded by uh the NIM token which is convertible to other tokens on both Ethereum and Cosmos. If you run a NIM node or server uh so yes, we have a whole paper on this called reward sharing on mixets that shows how you're rewarded. You're welcome to run one. 700 people already do. uh what's the fundamental security trade-offs and latency and size and batching versus continuous time mixing. I did cover this but to repeat continuous time mixing means that the number of total messages is the size of your anonyomy set and the reason that is because some messages are

have a chance even if it's quite small of never being released right that's not the case with something like charming and mixets that do batching and reordering as the number of users and traffic increases how do you maintain a sufficiently large an enemy set without introducing excessive latency that's the cool thing about the NIM design and also the Lupix design is that the more users you have uh the less mix time you need to get the same entropy. We did we did an integration against Zcash. We calculated the entropy. The entropy is about 16 or 17 bits depending on how generous you are with Zcash numbers. Um so that's good. If you just use Zcash like you just build a mixet for Ethereum

your entropy is like four bits, right? Right. So four versus 16 is is a huge entropy difference. You want more entropy. That means more anonymity. Uh is there a point where increasing network traffic actually improves anonymity? Yes. Increasing network traffic always improves anonymity for mixnets. Now for other designs it's kind of less clear like you can't really apply entropy to onion routing and tour. Um, and you know, but I think that is indeed the case for mixnets and probably other things like DC nets I haven't thought as much about. Um, what are the fundamental secure? Oh, I think I already did that question. Um, how does Nim fit in with tail scale? I think I

heard people can use it with tail scale. I don't use tail scale. I just use SSH. I'm sorry. I'm old school. But, uh, we probably should make sure it works well with tail scale. And will Nimvpn replace NordVPN in my phone? Dear God, yes. Like, come on, guys. Like, if you're running MolvadVPN, a co-founded by a freaking Nazi. Second, like [laughter] like it's a centralized VPN. Even if they're really nice people, they can anyone monitoring that VPN can discover all your your data. Nord is the same. It's pretty bad. Please don't use centralized VPNs. To our knowledge, Nimvpn is the only decentralized VPN because I gave a version of Sebastian's talk because a lightning talk last year

and we launched in 2025 that actually works today and actually has independent operators running nodes. So, for example, Obscura is just two groups operators uh working together. So, it's a bit pointless in my opinion. Um, wouldn't governments be against anonymity? Of course, they're not super happy with anonymity. They like being anonymous, right? That's why the US government funds tour because they want their people overseas to be anonymous. Reasonable for government to do possibly governments also use NIM. We don't know. Um but um however uh we have received two data requests and we because we don't run the nodes we can't give any data and we just don't answer them. Um and uh yeah so government we haven't

faced uh too much repression yet but one of the reasons why you want to build a actually decentralized network is you don't want to be the guy at the other end getting data requests and being you know having your children threaten to be kidnapped so forth so on the nice thing about NIM is you don't even need us you need us only to pay with a credit card but if you can pay with crypto you can pay the smart contract get zero knowledge proof back and use the system. There's something called pay as you go NIM which we have a blog post about and coders like Sashin have shown that you can actually build uh VP your own VPN on top of Nim if you you're so inclined and we've offered for other projects to do

that. Okay, I think that's it. Thanks. >> Thank you so much Harry and Max for this wonderful presentation. >> [music]