How much anonymity does Nym add to Zcash transactions?
An entropy analysis of running private digital cash over the Nym Noise Generating Mixnet
Share
Nym's wallet integration with Zcash has reached a cypherpunk milestone: the first real-world use of an anonymous mixnet to carry private digital cash. The integration is live in production in Zcash wallets like Zingo and Zkool.
This is the second post in our series on bringing Nym to Zcash. Here we measure what that integration actually delivers: how much network-layer anonymity the Nym mixnet adds to a Zcash transaction, measured in entropy, and what that protection costs in speed. We then draw out the concrete lessons it teaches us about how to make the mixnet faster and stronger for Zcash, from growing the shared user base to resizing the Sphinx packet so a whole transaction fits in one.
Anonymity, entropy, and the mixing tradeoff
In our first post on bringing Nym to Zcash wallets, we announced the integration and provided links to the tools developers need to integrate Nym with Zcash. Now we turn to the anonymity Nym actually delivers at the network layer, starting with what "anonymity" even means for internet packets.
In decentralized networks like mixnets there is a tradeoff between anonymity and speed. All else being equal, the slower your packets travel over the network, the more they "mix" with other packets, thus increasing their anonymity. In a mixnet like Nym’s, each packet is delayed a certain amount of time at each Nym node – anywhere from milliseconds to minutes – to allow packets to be mixed together. The number of other users you could be confused with is your anonymity set: the larger it is, the better. Being hidden in a crowd of a hundred beats a crowd of a dozen, and both beat being by yourself. The entire point of a mixnet like Nym is to give you a crowd of other packets with which to mix.
However, an anonymity set is a simplistic way to think about privacy: A real-world adversary will watch you send many packets and use AI to statistically infer which packets you sent. So it's better to think of anonymity for internet packets in terms of entropy: how strongly a particular target packet entering a network (like Tor or Nym) can be statistically associated with the packets exiting that network as an adversary sees them. You can do a rough conversion of average-case entropy to a uniform anonymity set by raising two to the power of the entropy, though this is idealized.
Zcash's Achilles' heel is the network layer
Zcash hides ("shields") the receiver and the amount of a $ZEC transaction because the Zcash blockchain doesn't store that data. But a powerful adversary can much more easily attack the underlying Zcash network by observing the nodes that carry and broadcast the $ZEC transactions. There are only a few dozen gRPC-enabled lightwallet servers that almost every Zcash transaction from a wallet passes through, and this is the Achilles' heel of Zcash.
To de-anonymize a Zcash transaction at the network layer, an adversary learns the IP address of the sender and can correlate it with their other online activity to reveal the identity of the sender (at least to their neighborhood, but possibly also to their real name and address). Shielding the transaction data does nothing to stop this: the attack happens one layer down, on the network itself.
Why Tor isn't enough against a powerful global adversary
Consider yourself a single user sending a Zcash transaction over Tor. Tor hides your originating IP address from the lightwallet service’s server, but it does not actually "mix" your packets with any other packets. Instead, Tor uses a first-in, first-out (FIFO) stream that rotates every ten minutes or so. So a large-scale adversary watching even a sizable portion of the Tor network can try to de-anonymize your Zcash transaction at the network level by correlating packets sent to a lightwallet server with those sent into Tor. In effect, Tor does not add entropy to packets, though Tor can certainly confuse a weaker, local adversary. Using Zcash with Tor is still much better than not using Tor: without it, anyone watching the lightwallet server, or the device that runs your Zcash wallet, can harvest your real IP.
Historically, Tor founders like Paul Syverson of the U.S. Naval Research Laboratory have argued that entropy is not an accurate way to measure anonymity, in his paper "Why I Am Not an Entropist". Nym CEO Harry Halpin argues in his response, "Unifying AI and Privacy: Why I Am an Entropist", that entropy is the only tool we have for measuring anonymity against adversaries, and that these kinds of powerful AI-enabled adversaries that can watch an entire network are realistic.
This is especially true for Zcash. There are only about 1,500 Zcash full nodes to monitor, and fewer than two dozen public gRPC lightwallet servers. These critical parts of Zcash infrastructure are trivial to put under surveillance in order to de-anonymize Zcash transactions at the network layer.
How much anonymity does the Nym mixnet add?
So how much anonymity, in terms of entropy, does the Nym mixnet actually add? Thanks to the work of Iness Ben Guirat, Debajyoti Das, and Nym Chief Scientist Claudia Diaz on mixnet simulation, "Blending Different Latency Traffic With Beta Mixing", we can use open-source code to find out. This means simulating both Zcash traffic and whatever other traffic is using Nym on the same mixnet.
First, we parameterize the simulator so it matches Nym's configuration. Currently, Nym runs three sets of twenty mix nodes per layer, with a 15ms default delay per mix node (so a total of 45ms additional latency being added to each packet as it travels through the network), and a Sphinx packet in Nym carries about a 2kb payload. The amount of traffic sent through Nym is highly variable, and because it's a mixnet, it cannot distinguish cover traffic (or the "measurement" traffic used to gauge network quality). Averaged over the last week, Nym shipped about 46,000 Sphinx packets per second throughout the mixnet. This provides a baseline entropy that can be mixed with Zcash transactions.
A Zcash transaction for Ironwood is usually a set of actions (spending with an output and an associated zero-knowledge proof), so it's usually about 10kb, though Ironwood migration transactions can run up to 15kb. To be conservative, we can guess the Zcash send transaction takes about 7 Sphinx packets on average. Nym is currently activated only for Zingo and Zkool wallets, but looking at download numbers from Zodl and other wallets, we can estimate there are around 80,000 active Zcash wallets. There's no data on how many transactions each user sends, so let's assume each sends one transaction per day.
Let's also assume each of these roughly 80,000 Zcash users is watched continuously, so that all their Zcash transactions are under total surveillance. The adversary's goal is to match each packet to each user. Likewise, assume a global passive adversary with the entire Nym network under surveillance.
We ran the Nym mixnet simulator on Zcash transactions to test various per-mix node delays of Zcash packets ranging from the default to 2.5 seconds (so an additional 7.5 second maximum delay added to every Zcash transaction, across three hops). We are assuming the Zcash wallet users are using Nym, sending background traffic, and online all the time, which is a charitable assumption.
So even if only Zcash users are using the mixnet, their entropy goes from 4 bits (an anonymity set of approximately 16 other users) at half a second of delay to 11 bits (an anonymity set of approximately 2,000 other users). That’s a significant gain.
Yet just using the Nym mixnet – even with its delay – can give about 17 bits of entropy to Zcash packets. The entropy provided just by sending a Zcash packet with a very small delay over Nym is larger than the entropy gained by delaying Zcash packets more, even by a considerable amount. Of course, delaying Zcash packets adds to the entropy of the Zcash packets being mixed with the rest of Nym’s traffic, going up to about 19 bits of entropy, which makes the anonymity set roughly larger than that of all Zcash users (so the anonymity set goes from over 100k to 1 million in size).
In this way, Zcash users can – just by using the Nym mixnet – blend their traffic into that of the rest of Nym network users. This means that Nym can provide a large maximum amount of protection to Zcash users by just sending Zcash transactions through the Nym mixnet, although of course parameters can always be tweaked to optimize the anonymity.
Testing the speed cost
As anonymity researchers have noted for years, there is a fundamental tradeoff between bandwidth, latency, and anonymity. Because Nym breaks Zcash transactions into multiple packets and independently routes them through the network, with each packet held for a standard delay (currently 15ms), there is a considerable slowdown in the time needed to deliver a Zcash transaction compared with sending the packets in cleartext or over Tor.
So let's test the speed. Testing the speed of Zcash with or without Nym is simple, since Zingo's command line supports both. Zingo doesn't support Tor, so to test Tor we use zcash-devtool, which includes proof-generation time in the send. We then subtract the proof-generation time.
The lesson is clear. Using Tor to protect the IP address anonymity of a Zcash transaction takes 3x–4x the time of sending a Zcash transaction normally. Adding the Nym mixnet takes another 3x–4x speed loss on top of Tor, so using Nym is more than an order of magnitude slower than sending a Zcash transaction in cleartext. This makes sense: Splitting a packet into parts, adding the mixing delays, and layering on the extra cryptographic processing all add up.
What you get in return is network-level privacy against increasingly powerful adversaries: Nym defends against a global passive adversary watching the whole network, where Tor only defends against a local adversary that can watch just part of the network, such as the user’s own internet connection.
Still, the cost of additional latency to already fairly slow cryptocurrency transactions can be discouraging for ordinary users, so we need to bring that cost in latency down by speeding up the mixnet. There are several straightforward ways to do this, such as increasing the Sphinx packet size to match the size of a Zcash transaction.
Take-home lessons for Nym
Nym helps Zcash today by default
Nym’s users provide a large amount of background traffic that raises the entropy of Zcash packets right now, making it harder to identify Zcash users that just plug their wallet into the Nym network even if they don’t use any special parameters.
Get more wallets to integrate Nym
The easiest way to increase anonymity for Zcash transactions over Nym is simply to grow the shared user base. Each additional user of Zcash using a Nym-enabled wallet helps dramatically, because each user’s traffic raises the maximum anonymity set and protection for all Zcash users and their traffic.
More traffic through Nym means we can ship packets faster
The main lesson is that the real-world Nym mixnet provides anonymity by default to Zcash users, as it already has a lot of traffic for Zcash transactions to hide in. In comparison to Nym, a custom mixnet for Zcash or other network-layer privacy solution will provide a lot less anonymity even if Zcash transactions are delivered very slowly.
This is good news: It means we can keep background Nym traffic and Zcash traffic using very small delays. Rather than slow the mixnet down with longer delays, it's better to grow the number of Nym users in general, not just Zcash users, since Zcash users benefit from everyone else using Nym.
The 2kb Sphinx packet is likely too small for Zcash
Splitting a single Zcash transaction across many Sphinx packets almost certainly causes delays from packet loss and retransmission. To bring Nym closer to Tor on speed and reliability, the Sphinx packet size should be increased so a Zcash transaction fits into a single packet. This would be a small decrease in anonymity, as it means fewer packets overall per transmission, with a more significant gain in speed.
Longer delays give diminishing returns
Increasing delays for Zcash transactions does raise entropy, but with diminishing returns that are dwarfed by the entropy from the sheer amount of non-Zcash transactions going through Nym. Growing the volume of Zcash and general traffic over the mixnet gives more anonymity per unit of cost than adding delay, for most users.
Zcash wallets should add their own cover traffic
This would help, especially if the delays either match the rest of the cover traffic or match the longer delays needed to push anonymity beyond that of regular Nym traffic. It may not seem feasible for mostly-mobile wallets, but even minimal cover traffic – say a single "fake" Zcash transaction every few minutes – will likely help.
New tooling is needed to help users understand anonymity
Most Zcash users will just want a very large anonymity set for their transactions, and sending Zcash transactions through the Nym mixnet with default parameters should help provide this. However, we need to provide ways for expert Zcash users to set delays and other parameters to get the anonymity set they want. Future simulation work could give Nym users a rough, live estimate of how much anonymity and entropy they actually have.
However, it is important to remember that entropy is an average-case metric, not a worst-case metric, for measuring anonymity, so we would want to do additional research to give users better metrics and interfaces to measure how anonymous they actually are.
A first measurement, with more to come
This is only a preliminary analysis. We are preparing a full analysis for a peer-reviewed academic publication, as we did earlier with our initial study of Zcash wallet usability and end-users' understanding of network privacy, "Holistic Privacy and Usability of a Cryptocurrency Wallet".
Nym should be as fast and reliable as the internet itself
And of course, the primary need for Zcash is for the Nym mixnet to be faster and more reliable, reaching the speed of at least Tor. Ideally, Nym should be just as fast as the normal internet, without censorship and much more private. This is hard to achieve because Nym, like Tor, has to create a virtual overlay network over the existing internet. Nonetheless, many improvements are possible that can move us closer to this goal.
We also need to expand our work at Nym to defend other Zcash wallet transaction types such as block synchronization, and take into account even more sophisticated adversaries.
More news on how we at Nym plan to do that will be released soon, so stay tuned!
About the authors
Table of contents
Keep Reading...
Is Zcash anonymous? Shielded and transparent transactions explained
Zcash can be one of the most private ways to hold crypto, or barely private at all. The difference is how you use it, and what the network can still see.
Nym mixnet now live in Zcash wallets
Nym has completed its Zcash Community Grant, and network-level privacy is now shipping inside real Zcash wallets
Swap your Zcash (ZEC) for $NYM
New Nym swapper allows your to get native $NYM privately with your shielded ZEC for big discounts on NymVPN and more
Zcash <> Nym: One step closer to a full privacy payment network
Demo with Zingo wallet showcases first milestone reached in Nym and Zcash integration