How much anonymity does Nym add to Zcash transactions?

Nym](https://nym.com)'s wallet integration with Zcash has reached a cypherpunk milestone: the first real-world use of an anonymous mixnet to carry private digital cash. The integration is live in production in Zcash wallets like Zingo and Zkool.

This is the second post in our series on bringing Nym to Zcash. Here we measure what that integration actually delivers: how much network-layer anonymity the Nym mixnet adds to a Zcash transaction, measured in entropy, and what that protection costs in speed. We then draw out the concrete lessons it teaches us about how to make the mixnet faster and stronger for Zcash, from growing the shared user base to resizing the Sphinx packet so a whole transaction fits in one.

Anonymity, entropy, and the mixing tradeoff

In our first post on bringing Nym to Zcash wallets, we announced the integration and provided links to the tools developers need to integrate Nym with Zcash. Now we turn to the anonymity Nym actually delivers at the network layer, starting with what "anonymity" even means for internet packets.

In decentralized networks like mixnets there is a tradeoff between anonymity and speed. All else being equal, the slower your packets travel over the network, the more they "mix" with other packets, thus increasing their anonymity. In a mixnet like Nym’s, each packet is delayed a certain amount of time at each Nym node – anywhere from milliseconds to minutes – to allow packets to be mixed together. The number of other users you could be confused with is your anonymity set: the larger it is, the better. Being hidden in a crowd of a hundred beats a crowd of a dozen, and both beat being by yourself. The entire point of a mixnet like Nym is to give you a crowd of other packets with which to mix.

However, an anonymity set is a simplistic way to think about privacy: A real-world adversary will watch you send many packets and use AI to statistically infer which packets you sent. So it's better to think of anonymity for internet packets in terms of entropy: how strongly a particular target packet entering a network (like Tor or Nym) can be statistically associated with the packets exiting that network as an adversary sees them. You can do a rough conversion of average-case entropy to a uniform anonymity set by raising two to the power of the entropy, though this is idealized.

Zcash's Achilles' heel is the network layer

Zcash hides ("shields") the receiver and the amount of a $ZEC transaction because the Zcash blockchain doesn't store that data. But a powerful adversary can much more easily attack the underlying Zcash network by observing the nodes that carry and broadcast the $ZEC transactions. There are only a few dozen gRPC-enabled lightwallet servers that almost every Zcash transaction from a wallet passes through, and this is the Achilles' heel of Zcash.

To de-anonymize a Zcash transaction at the network layer, an adversary learns the IP address of the sender and can correlate it with their other online activity to reveal the identity of the sender (at least to their neighborhood, but possibly also to their real name and address). Shielding the transaction data does nothing to stop this: the attack happens one layer down, on the network itself.

Why Tor isn't enough against a powerful global adversary

Consider yourself a single user sending a Zcash transaction over Tor. Tor hides your originating IP address from the lightwallet service’s server, but it does not actually "mix" your packets with any other packets. Instead, Tor uses a first-in, first-out (FIFO) stream that rotates every ten minutes or so. So a large-scale adversary watching even a sizable portion of the Tor network can try to de-anonymize your Zcash transaction at the network level by correlating packets sent to a lightwallet server with those sent into Tor. In effect, Tor does not add entropy to packets, though Tor can certainly confuse a weaker, local adversary. Using Zcash with Tor is still much better than not using Tor: without it, anyone watching the lightwallet server, or the device that runs your Zcash wallet, can harvest your real IP.

Historically, Tor founders like Paul Syverson of the U.S. Naval Research Laboratory have argued that entropy is not an accurate way to measure anonymity, in his paper "Why I Am Not an Entropist". Nym CEO Harry Halpin argues in his response, "Unifying AI and Privacy: Why I Am an Entropist", that entropy is the only tool we have for measuring anonymity against adversaries, and that these kinds of powerful AI-enabled adversaries that can watch an entire network are realistic.

This is especially true for Zcash. There are only about 1,500 Zcash full nodes to monitor, and fewer than two dozen public gRPC lightwallet servers. These critical parts of Zcash infrastructure are trivial to put under surveillance in order to de-anonymize Zcash transactions at the network layer.

How much anonymity does the Nym mixnet add?

So how much anonymity, in terms of entropy, does the Nym mixnet actually add? Thanks to the work of Iness Ben Guirat, Debajyoti Das, and Nym Chief Scientist Claudia Diaz on mixnet simulation, "Blending Different Latency Traffic With Beta Mixing", we can use open-source code to find out. This means simulating both Zcash traffic and whatever other traffic is using Nym on the same mixnet.

First, we parameterize the simulator so it matches Nym's configuration. Currently, Nym runs three sets of twenty mix nodes per layer, with a 15ms default delay per mix node (so a total of 45ms additional latency being added to each packet as it travels through the network), and a Sphinx packet in Nym carries about a 2kb payload. The amount of traffic sent through Nym is highly variable, and because it's a mixnet, it cannot distinguish cover traffic (or the "measurement" traffic used to gauge network quality). Averaged over the last week, Nym shipped about 46,000 Sphinx packets per second throughout the mixnet. This provides a baseline entropy that can be mixed with Zcash transactions.

A Zcash transaction for Ironwood is usually a set of actions (spending with an output and an associated zero-knowledge proof), so it's usually about 10kb, though Ironwood migration transactions can run up to 15kb. To be conservative, we can guess the Zcash send transaction takes about 7 Sphinx packets on average. Nym is currently activated only for Zingo and Zkool wallets, but looking at download numbers from Zodl and other wallets, we can estimate there are around 80,000 active Zcash wallets. There's no data on how many transactions each user sends, so let's assume each sends one transaction per day.

Let's also assume each of these roughly 80,000 Zcash users is watched continuously, so that all their Zcash transactions are under total surveillance. The adversary's goal is to match each packet to each user. Likewise, assume a global passive adversary with the entire Nym network under surveillance.