Suppose to ensure anonymity, let's call a hypothetical anonymous, encrypted mixnet overlay service : Cone of Silence. CoS has two types of N nodes: relays R an

Suppose to ensure anonymity, let's call a hypothetical anonymous, encrypted mixnet overlay service : Cone of Silence. CoS has two types of N nodes: relays R and clients C (Csrc wants to send packets to Cdst). Every nodes, N, talks to each other at constant rate B. Directional asymmetric rates are allowed. If there is nothing to send, a packet containing the output of a CSPRNG must be sent to meet B, which will be dropped by the other node. Every link in each direction maintains B. C must use at least 1 node to talk to each other. Direct C-C traffic and network loops are expressly forbidden. C must agree to encrypt the contents of their opaque application payload, P, amongst themselves. R informs Csrc of the list keys (k0, k1, .. kn) to recursively encrypt P with, resulting in payload to send, M = E(kn,..E(k1,E(k0,P))). Keys must never be reused except given the same Csrc to Cdest, but only for a maximum time and number of bytes. M is decrypted by each node and forwarded on to the neighbor if it is a valid packet. N must never know the complete path a beyond the neighbor node with which to send a packet and the specified path nodes. N must be assumed to be hostile. -- The reason for russian dolls encryption per link is to prevent correlation analysis. Lots of unanswered Q's: - Node discovery / reachability - Node impersonation (remember tcp connection hijacking?) - Hostile nodes (relays and clients), especially hostile relays that prefer to connect to each other. Perhaps clients (Csrc and Cdest) each specify a small # of nodes that a path must traverse. Periodically check with each specified node with a challenge to verify path integrity? (There must be a better way to ensure path integrity using crypto without backchannels to specified nodes.) - (D|)DoS - limits for all operations. Exponential backoff. - Crypto specifics, key scheduling, rotation, minimum&maximum rekey rate. - Packet particulars (packet size tradeoff: overhead vs. latency), transport/s (TCP sounds easiest), reconnection. - Multipath? Just say no (at least initially). - How is this better than tor? (Statistical analysis may prove if a host belongs to CoS, but not to whom. Tor may not be sufficiently mixed under "capture everything".) - Node identifier? 384-bits is plenty.