preliminary series

research

protecting content is the easy part. what this work measures is how much an observer who sees only timings and volumes can still learn, and what it costs to take that away.

flows: 10
relays: 3
suite: c25519
runs per configuration: 5 x 30 s
statistic: median

each client starts its schedule at a random phase. with five runs per point no difference is claimed as significant; the full series of thirty runs per point is still to come.

the observer only sees when frames cross.

it watches the entry link and the last link between relays, counts frames per time window for every flow, and correlates every entry flow with every exit flow. the window is its choice, so both 10 ms and 100 ms are scored. chance is auc 0.5 and top-1 10%.

attack auc against bandwidth between relays and against round-trip latency, for cover on top, a constant rate at the client and relays on their own clocks

protection	bandwidth between relays	median round trip	auc, 10 ms	auc, 100 ms	top-1, 10 ms
none	x1.00	0.15 ms	1.000	1.000	100%
cover on top, +2x	x2.99	0.13 ms	1.000	1.000	100%
constant rate at the client, 70 ms	x2.85	47 ms	0.948	0.952	60%
constant rate at the client, 35 ms	x5.69	21 ms	0.951	0.942	70%
relays on their own clocks, 66.5 ms	x3.00	182 ms	0.485	0.483	0%
relays on their own clocks, 33.25 ms	x5.99	89 ms	0.528	0.550	10%
both, client 70 ms, relays 66.5 ms	x2.99	216 ms	0.506	0.526	15%
both, client 35 ms, relays 33.25 ms	x5.99	108 ms	0.596	0.486	10%

what the series shows.

cover on top does not help.

cover traffic added on top of real messages does not help at all: even at three times the bandwidth every flow is linked.

a constant rate at the client does not hide a flow.

each client ticks with its own phase, and the phase crosses a chain of relays that forward at once. with a 10 ms window the attack links flows at every rate. a 100 ms window looks safe only where the period divides it: nearly all scores then tie, which says nothing about protection.

relays on their own clocks bring it to chance.

the price is a constant stream on every link a relay sends on and about 2.5 to 2.7 node periods added to a round trip: 182 ms at 66.5 ms, 89 ms at 33.25 ms. the relay period is 5% shorter than the client's, so a missed tick is caught up.

the client's rate still matters.

with relay clocks on, the client's constant rate hides the conversation from the entry node itself, which the observer here does not model.

attack auc against the client's cell period for a 10 ms and a 100 ms window

five experiment blocks.

key material: memory dumps of a live relay are searched for known key bytes, with and without memory locking and dump prevention. the same search runs against the container image and volumes.
forward secrecy: recorded traffic is attacked with the node's long-term key in hand.
metadata: a traffic correlation attack links senders to receivers from timings and volumes alone. roc and auc are reported against cover traffic rate, cell size policy and delays.
partial compromise: one and two nodes of three are compromised, including a node holding a valid certificate from a compromised ca. residual leakage is measured.
cost: latency per hop, throughput, cpu, padding overhead, gost versus x25519.

series run on an idle host; every report row records the host load, the seeds and the code revision.

method and adversary models