Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

With all the NSA stuff in the news, I've been thinking about how to ensure the "who's talking to who" is just as private as the contents of the messages. I had an idea on the subject, about which I've got two questions: the first, does this concept work (i.e. meet its stated objectives); and if so, what services employ this technique.

The problem: how to ensure that the "who" is just as private as the "what" of communication

The idea:

  • There exists a voluntary network of nodes that all have public key encryption systems, and published public keys.
  • The sender sends a message to the first intermediate node, encrypted with that intermediate node's public key.
  • The first intermediate node decrypts the message, which contains the second intermediate node's address and a payload that's encrypted with the second intermediate node's public key. The first intermediate note sends the payload to the second intermediate node.
  • The second intermediate node decrypts the message, which contains the third intermediate node's address and a payload that's encrypted with the third intermediate node's public key. The second intermediate note sends the payload to the third intermediate node.
  • The third intermediate node decrypts the message, which contains the final recipients node's address and a payload that's encrypted with the final recipients's public key. The third intermediate note sends the payload to the final recipient.
  • The final recipient decrypts the message.

Key points about this system:

  • the sender needs the public keys of all intermediate nodes (a published database would be needed of addresses and public keys)
  • I was originally thinking of this in respect of email, but it should work with any communication, e.g. snail mail, IP packets, etc
  • on a computer it should be fairly easy to automate the multiple layers of encryption
  • the number of nodes can be manually selected, or selected at random
  • the nodes themselves should be selected at random
  • the communication could contain multiple next-hop nodes with a priority order, in case nodes fail. The nodes could provide an acknowledgement message back to the node they received communication from
  • the messages could potentially be randomly padded to ensure that the reducing size of the message over time (as address headers are removed) does not give a clue to the communication direction
  • random communication could be added to the network to further confuse snoopers
  • to prove the source of the correspondence to the sender, the sender and recipient would need to pre-agree a secret that the sender would include in the message. Alternatively, the entire system could be set up such that each node gives a unique secret to each other node encrypted using that node's public key. This would establish encrypted relationships by default, without the need for pre-agreeing, and wouldn't allow anyone to infer relationships from the establishment of the original secret


  • as the network scales, the database of addresses and public keys becomes potentially too large
  • if the secret sharing mentioned in the key points is employed, the number of secrets each node would need to hold could get prohibitively large if the network gets large
share|improve this question
You appear to be reinventing the concept of onion routing. – Stephen Touset Sep 30 '13 at 21:03
"The idea: ..." $\:=\:$ "use a mixnet" $\;\;$. $\;\;\;\;$ My first other key point: a time interval should be included in the plaintext of each encrypted layer, to allow for defending against replay attacks. $\;\;$ My second other key point: authenticity could be established by having the innermost plaintext indicate the identities of the sender and receiver, the sender's signature verification key, and the signed message. $\hspace{1.18 in}$ – Ricky Demer Sep 30 '13 at 21:20
Yep, thanks. Have now read up on onion routing and mix networks. I've not really studied cryptography, but perhaps am suffering from cryptomnesia nonetheless. – user8676 Sep 30 '13 at 21:27
Like @StephenTouset said - what you are describing smells like onion routing. For a practical example, check Anonymity network TOR which enables online anonymity and directs internet traffic through a worldwide network consisting of thousands of relays to conceal a user's location… which would cover most of what you need. But there are other implementations out there too; most of them handling encrypted, anonymous data (voice, text, binary) transfers using random node allocations and bridging. Ricky Demer already commented — it is worth diving into mixnets too. – e-sushi Sep 30 '13 at 22:36

Yes, the above concept is broadly equivalent to onion routing and mix networks (although please refer to these links for a more accurate description).

share|improve this answer
To close the question correctly, please also accept your answer by clicking the checkmark underneath the up/down voting buttons (it will turn into a green checkmark). Thanks. – e-sushi Oct 7 '13 at 16:23

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.