Linkage vectors

A vector is a channel through which an adversary attributes a request to a user, or links two requests to each other. There are three. Each vector lists what it consists of, which actors can observe it, and the countermeasures that close it. Every countermeasure belongs to one of the two layers: transport (Layer 1) or baseline hygiene (Layer 2).

V1Session state

The source IP the destination observes, the TCP/TLS connection state, the tunnel session, and any application-layer session identifiers.

Observable from

Countermeasures

Layer 1 · vs L2 Relaying: hides the client IP
Layer 1 · vs L2 Short-lived connections: a new connection per request
Layer 1 · vs L2 Exit rotation per connection (in dVPN and mixnet alike)

V2Timing

At the destination, the arrival times of requests. On network links, the timing, size and volume of packets.

Observable from

Countermeasures

Layer 2 · vs L2 Client-side: randomised request times and request scheduling, against the destination
Layer 1 · vs L3L/L3G In transit: mixing delays, Poisson sending, cover traffic, against network observers

V3Content

The endpoints and resources requested, the parameters and query values, the operation performed, and the payload bytes.

Observable from

Countermeasures

Layer 2 · vs L2 Request-shape discipline: padding, batching, and decoy or overlapping requests

A common category error credits in-transit mixing as protection against the destination (L2). Mixing delays and cover traffic change what a network observer can infer; the destination sees only what arrives, and when it arrives. No amount of mixing protects a user against the server they are talking to. What protects them is the absence of session state (V1), plus timing and content discipline (V2/V3) on the requests themselves.

The layer tags map each countermeasure to the two-layer model. Layer 1 is what the transport chooses; Layer 2 is client discipline you owe regardless of transport.

Threat Actors Unlinkability Properties