In our final meeting of the semester, we explored anonymous communication systems — the networks and protocols designed to hide not just the contents of a message, but the fact that two parties are talking at all. The session moved from the theoretical foundations of anonymity, through the adversaries that threaten it and the defenses that counter them, to the two most important real-world systems: Tor and I2P.

What Anonymity Means

Anonymous communication is built on three distinct properties:

• •Sender anonymity: The receiver gets messages but cannot determine which node sent them.
• •Receiver anonymity: The sender cannot determine which node is the intended recipient.
• •Unlinkability: Messages flow between sender and receiver, but a third party cannot determine who is communicating with whom — a property distinct from sender or receiver anonymity individually.

At its core, anonymity is fundamentally a linking problem: an adversary wins by linking a human identity (Alice, Bob, Carol) to a network address (an IP like 192.168.1.5). Every system we discussed is ultimately a strategy for breaking that link — Tor uses 3-hop circuits, while I2P uses four unidirectional tunnels plus garlic encryption.

Building Blocks

Before any real system, we looked at the simplest mechanisms that buy anonymity. Broadcast provides receiver anonymity: a message is sent to many recipients at once, so observers cannot tell who the intended reader is. FM/AM radio is the classic example — the broadcaster is known, but the listeners are not. Laundering provides sender anonymity by routing messages through intermediate nodes: if node X receives a message from Y, X does not know what happened before Y, and therefore cannot identify the original sender.

We combined these ideas into a Naive Ring Protocol. All participants are arranged in a ring and each publishes a public key. Alice encrypts a message under Bob's key and forwards it around the ring; every node forwards the ciphertext, but only Bob can decrypt it. This provides sender anonymity — but only against a sufficiently weak adversary. It is not secure against a global active adversary, who can detect on which link a message first enters the ring. A natural defense is per-link encryption, which prevents an observer from correlating the same ciphertext across hops — though, as we discussed, it is not a complete solution.

Adversaries & Defenses

To reason about anonymity we need a precise adversary model. We classified adversaries along two axes — reach (local vs. global) and behavior (passive vs. active):

• •Local passive: Observes one or a few links and can perform timing or content correlation on those links only.
• •Local active: Ranges from honest-but-curious (follows the protocol but colludes with compromised nodes) to Byzantine (injects, drops, and modifies traffic).
• •Global passive (GPA): Observes every link in the network and correlates timing and content across all of it, without modifying traffic. This is the adversary that breaks most practical systems.
• •Global active: All passive capabilities plus arbitrary protocol deviation across the entire network — nation-state level.

Beyond the network, endpoint adversaries are simply a malicious sender or receiver trying to learn the other's address. Two structural attacks stood out: the Sybil attack, where an adversary floods the network with fake identities, and the cloaking attack, where every connection a victim makes is adversary-controlled. The worst case for any anonymity system is when every node except the victim is adversarial.

The main network-level defense is cover traffic, or chaff. By mixing real messages (R) with dummy messages (C), a node emits what looks like a constant stream, so an observer cannot distinguish real traffic from cover. A fixed emission interval is the easiest to defend; a randomized interval leaks information, because an adversary can mount long-run statistical analysis.

All of this is governed by what we called the Anonymity Trilemma: a system cannot simultaneously have high bandwidth efficiency, low latency, and strong anonymity against a global passive adversary — you get to pick at most two. The ordinary Internet chooses bandwidth and latency (no anonymity); chaff-based systems buy anonymity at terrible bandwidth cost; mix networks buy anonymity by accepting high latency; and both Tor and I2P deliberately choose bandwidth and latency, which is precisely why neither resists a GPA.

Mix Networks

The foundational answer to anonymous routing is David Chaum's Mix Network, published in 1981 — only four years after RSA (1977), making it one of the earliest applications of asymmetric cryptography to privacy. Its trust model is honest-but-curious: a mix follows the protocol correctly but may try to learn information from what passes through it.

In a single mix, Alice sends a layered ciphertext and the mix peels off the outer layer before forwarding:

The random value R1 randomizes the input ciphertext so that identical messages never look the same, and all messages are padded to a fixed size. Crucially, the mix must batch: if Alice sends two messages but only one emerges, the mix is implicated.

A single mix is a single point of trust, so real designs chain several mixes into a cascade. Alice wraps her message in nested layers, one per mix:

The message travels from Alice through Mix 1, Mix 2, and Mix 3 to Bob, with each mix peeling exactly one layer. The key guarantee is that anonymity holds as long as at least one mix in the cascade is honest.

Tor: Practical Anonymity and Its Limits

Tor is the most widely deployed anonymous communication system, and its design reflects a deliberate set of trade-offs. It provides sender anonymity only — not receiver anonymity — in exchange for being deployable, usable, and simple. Many TCP streams share a single circuit, and, by design, Tor does not attempt to defend against a global passive adversary. Its threat model instead assumes an adversary who can observe some fraction of traffic, can generate, modify, delay, or drop traffic, and can operate their own relays. The important caveat is that this partial anonymity is not adequate for safety-critical use by whistleblowers, dissidents, or journalists.

A Tor circuit runs through three relays — a Guard (OR1), a Middle (OR2), and an Exit (OR3) — before reaching the destination, with replies flowing back along the same circuit:

No single relay sees the whole picture: the guard knows Alice's IP and OR2 but not the destination, while the exit knows OR2 and the destination but not Alice's identity. The structural weakness is that because the circuit is bidirectional, the guard sees both directions of traffic, which makes timing correlation trivial for anyone watching both ends.

Tor also supports hidden services, which provide mutual anonymity through a rendezvous mechanism. Bob generates a long-term service public key, selects introduction points, builds circuits to each, and advertises a service descriptor in a directory. Alice retrieves the descriptor, picks a rendezvous point, and generates a random cookie; she sends that cookie and rendezvous information through an introduction point, Bob builds a fresh circuit to the rendezvous point, and once the cookies match a bidirectional anonymous channel is established. Neither side learns the other's IP, since both reach the rendezvous point through separate circuits. These .onion addresses are not in DNS — discovery is out-of-band, through websites and directories like ahmia.fi.

Finally, we looked at how Tor breaks in practice through de-anonymization attacks:

• •Traffic correlation: The adversary injects a known timing pattern and observes where it reappears on the network.
• •App-layer leaks: JavaScript or a WebSocket opens a clearnet connection that bypasses the SOCKS proxy, revealing the real IP. Only the hardened Tor Browser mitigates these.
• •Cookie replay: Cookies from non-Tor browsing are replayed while Tor is enabled, linking identities across sessions.
• •Induced congestion: The adversary sends bursts through a suspected relay; the resulting congestion modulates the timing of unrelated flows, confirming the relay is on the circuit.

The probability that all three hops are adversarial is X³, but bandwidth advertisement and geographic affinity skew relay selection and make it worse in practice.

I2P: A Different Architecture

I2P attacks the same problem with a different shape. Instead of one bidirectional circuit, it uses four unidirectional tunnels per round trip — Alice and Bob each maintain a separate inbound and outbound tunnel — so that no single router ever sees both directions of a conversation.

It also routes differently. Where Tor uses onion encryption (one message per layered envelope), I2P uses garlic encryption, bundling multiple "cloves" — an HTTP request, a delivery acknowledgement, a NetDB store, and padding or dummy traffic — into a single blob. The effect is that with Tor, one link carries one message, whereas with I2P, one blob carries an unknown amount of content.

Peer discovery differs too. Tor relies on directory authorities: nine hardcoded, centrally curated authorities (a PKI originally run by the U.S. Naval Research Laboratory) from which everyone downloads the full relay list. That makes Tor hard to Sybil but creates a chokepoint — block nine IPs and you disrupt the network. I2P instead uses NetDB, a Kademlia DHT where floodfill routers store Router Infos and Lease Sets, and nodes query the nearest floodfill by key hash. This has no single point of failure, but an open DHT is easier to Sybil.

Despite these differences, I2P fails against a global passive adversary for the same reason Tor does: like Tor, it does not use batching or constant-rate chaff at the network level. A GPA that observes every link can correlate timestamps end to end, and having four tunnels instead of one circuit does not help. The only thing that would truly resist a GPA is constant-rate emission — every node sending one message per second, real or dummy — at the cost of enormous bandwidth waste.

Tor vs. I2P

We closed the meeting — and the semester — by comparing the two systems across our adversary model. Against a global passive adversary, both are broken. Against a local passive adversary, I2P does slightly better thanks to its four tunnels and garlic routing. On guard or entry compromise, a Tor guard sees both directions while an I2P tunnel sees only one. Tor's exit nodes see plaintext and carry real legal risk, whereas I2P has no exit nodes — it is a closed network where both sides stay anonymous. Tor's nine directory authorities resist Sybil attacks well, while I2P's open DHT is harder to defend; and for traffic correlation, I2P is slightly better because garlic routing adds noise. The overarching lesson: there is no free anonymity — every design is a negotiated settlement with the trilemma, and the right choice depends entirely on who you are hiding from.