jimichi
messages that don't say
who talks to whom.
confidential messaging with metadata protection, and the measurements that show what that protection is worth.
content is the easy part.
encryption hides what you say. it does not hide when you speak, how much, or to whom. jimichi is built around that second question, and measures how much an observer who sees only timings and volumes can still learn.
three hops
every message crosses a chain of three relays under nested encryption. each hop strips one layer and learns only its neighbours.
one size
every cell on the wire is the same size, with the same header. real messages, cover traffic and control cells look alike.
memory only
session keys are ephemeral and live in locked memory that is zeroed after use. relays write nothing to disk.
measured
the repository ships the attack too: a traffic correlation observer that scores how much timing and volume still give away.
we built the attack ourselves.
sound onquiet by design.
keys load only after you unlock and are wiped when you lock. contacts are checked by comparing safety numbers.
locked
keys load into memory only after you unlock, and are wiped when you lock.
safety number
compare these numbers in person or on a call. if they match, nobody is in between.
cover traffic alone does not help.
a passive observer correlates every entry flow with every exit flow. chance is auc 0.5.
- 1.000
- attack auc with cover traffic on top, even at x2.99 the bandwidth between relays. every flow is linked.
- 0.948
- attack auc with a constant rate at the client only, 70 ms. the client's phase still crosses the chain.
- 0.485
- attack auc when relays send on their own clocks, 66.5 ms period. the price is a 182 ms median round trip.
read the code. check the numbers.
everything is open: the system, the attack against it, and the harness that produced every figure on this site.