Mix Network

Anna sends Peter a private message. Nobody along the way can read it, yet an observer may see data leave Anna and arrive at Peter shortly afterwards. Repeated patterns can suggest who communicates with whom. These clues are metadata: information surrounding a message, such as time, size or network addresses. Chaum’s 1981 paper addressed this problem in electronic mail. It asked not only how to lock a letter, but how to make its journey harder to trace. A mix network therefore offers a different kind of protection from encrypting contents alone. [1] [2] [9]

Imagine a simplified route through nodes A, B and C. Anna first encrypts the message itself for Peter. She then wraps it for the last node C, wraps that packet for B and finally wraps it for the first node A. She uses their public keys: information that lets her create an encrypted wrapper opened by the corresponding private key. Keys are numerical data used by the encryption software. The public key can be shared, while each node keeps its private key secret. After opening its layer, A learns where to send the inner packet next; it does not acquire all the other keys. Layers are prepared backwards so nodes can remove them in travel order. This is a teaching model, not a claim that every mix network has exactly three nodes. [1] [4] [5]

If only Anna’s message entered A and a single message immediately left, an observer would have little difficulty. A classical batch mix therefore collects several messages before forwarding them. Processing a group widens the possible matches between incoming and outgoing messages. Making packets the same size matters too: an unusually large item could otherwise remain easy to recognise. Adding data to reach a specified length is called padding. The number of people or messages is not, by itself, an exact measure of privacy; what the observer already knows about them matters as well. [1] [3]

A mix removes its encryption layer, checks the message according to its protocol and does not simply forward a copy of the same outer packet. An observer therefore cannot just look for identical data entering and leaving. Order changes too: Chaum’s original proposal sorted batch outputs by their data; other constructions use different methods. What matters is that output order does not reveal arrival order. A mix also checks for messages submitted again. The next node performs a similar process, and the last passes the packet towards the recipient. The message itself remains protected by the separate encryption Anna prepared for Peter. [1] [3] [5]

Messages can also flow continuously with different random delays instead of waiting for one shared batch. This weakens the timing connection between a packet’s arrival and departure. A packet is simply a bundle of data. Cover traffic adds another protection: the network also carries messages without a user’s communication, designed to resemble genuine messages to an observer. Movement of data alone then reveals less about when Anna actually wrote something. The Loopix design works this way, and Nym draws on its ideas. Protection has costs: more data transmitted, device work and waiting. The settings governing those costs also affect the privacy achieved. [3] [5]

In the classical model, at least one honest mix on the route can conceal the internal mapping if it follows the protocol and does not reveal its input-output relationships to the adversary. Honest means that specific behaviour, not a general judgement of the operator. The condition does not say that one honest server solves every situation. If an attacker recognises all the other messages in a group, Anna’s may be identifiable by elimination. Observation at network edges, long-term user activity and interference with traffic matter too. Research papers therefore state a threat model: precisely what an adversary can observe and control. [1] [3]

An attacker can resend a captured packet and look for matching repetitions at the other end. It may try to tag a message by altering data, deliberately delay traffic or discard some messages. Defences therefore include integrity checks and records of repeated packets. The Sphinx format, used by Loopix and Nym, gives nodes the information needed for these checks. In some designs, cover messages also help detect traffic loss. These are specific defences with specific assumptions, not a promise that the network cannot be disrupted. An encrypted message can still fail to arrive. [3] [5]

Anna can give Peter encrypted instructions for a return journey. Peter uses them to send a reply without needing to know her ordinary network address. Chaum already described such return addresses. Some modern systems use single-use reply blocks, abbreviated as SURBs; using them once is part of their protection, not an arbitrary inconvenience. A pseudonym can then help identify several messages as belonging to the same author without revealing a legal name. But it also links those messages together. If Anna identifies herself in the text or sends personal details, hiding the route does not take that disclosure back. [1] [10]

Tor also sends communication through several intermediaries, but prioritises short response times so people can browse the web comfortably. An observer positioned at both ends may compare traffic timing and volume. Tor also has padding mechanisms, so saying it uses no cover traffic would be inaccurate. Classical mixnets accept longer delays, for example when delivering messages. Loopix explores a compromise with delays on the order of seconds. Nym distinguishes its mixnet mode from its faster dVPN mode. In dVPN mode, data travels through encrypted tunnels instead of undergoing the message mixing described here. Names and route length are therefore insufficient: the actual transport behaviour and the threat we want to address matter. [4] [9] [8] [3] [5] [11]

A Bitcoin wallet is an application that helps you receive and send payments. If a wallet or other application supports an appropriate network path, a mixnet can make linking its traffic to a particular Internet connection harder. This is neither an automatic Bitcoin protocol feature nor the same thing as a coin-mixing service. It does not erase links between Bitcoin transactions in the blockchain, their shared public record; hiding the journey leaves the blockchain history in place. BIP 324 likewise encrypts connections between nodes rather than mixing messages to hide their senders. We must distinguish privacy during transmission from privacy of payment history. A Mix Network helps explain the first layer; it does not turn every payment into anonymous cash. [6] [7]