Zcash × Nym

Fork of lightwalletd + service provider

The strongest variant. A lightwalletd fork embeds a Nym service provider and is deployed in a DMZ (no inbound connections). Resists a global passive adversary; requires server + client changes to Nym addressing.

Runtime: Server-side (lightwalletd fork with embedded Nym service provider, in a DMZ) + per-app clientsdVPN (WireGuard)Mixnet (5-hop)Speed: Fast sync / slow broadcast
dVPN (WireGuard)Mixnet (5-hop)SURB reply
Mix L1+50 msMix L2+50 msMix L3+50 msClientUser-space IP stack (smoltcp)2-hop WireGuard (boringtun)Nym mixnet clientEntry GWExit GW (mixnet)Exit GW (dVPN)Forked lightwalletd + Nym SP

Sync over dVPN and broadcast over the mixnet both reach one forked lightwalletd that embeds a Nym service provider (in a DMZ). Broadcast replies return via SURBs, so the server never learns the client address.

ClientEntry GWMixExit GWlightwalletd
dVPN (WireGuard) (no mixing)Mixnet (5-hop) (mixing delays)

Latency model

Regional (40)Continental (120)Intercontinental (300)
Block sync · dVPN (WireGuard)360 ms (3 hops)
Tx broadcast · Mixnet (5-hop)1.6 s (6 hops, 3 mix layers)
Geographic propagation (speed-of-light)Per-hop mixing delayReliable-channel ACK (return, geographic only)

What to send over it

  • Mixnet: broadcasts and sensitive small queries to the service provider (SURB replies)
  • dVPN: block syncs

Notes

  • Build a Nym service provider into a lightwalletd fork; deploy in a DMZ (no inbound public connections)
  • Broadcasts go to the service provider over the mixnet with SURB replies; sync over dVPN
  • Strongest variant — resists a global passive adversary

Per-actor assessment (inherited)

The same four threat actors apply. This architecture inherits the assessment of the configuration it implements: Mixnet · SP-integrated. Layer-2 baseline hygiene remains the wallet’s responsibility.

L2Compromised lightwalletd✅P1✅P2

Sees

  • Block requests from many users, with timing delays

Can't see

  • Client IP or location (packets arrive from all last-layer mix nodes; replies via SURBs)

Residual / countermeasure

  • Application-layer session state is not automatically eliminated today: the fix is a fresh sender tag per request, each provisioned with its own SURBs. With that fix, P2 holds at the transport level by construction rather than through client-side rotation.
  • All users of the provider share one anonymity set (perfect crowding and splitting); low usage shrinks it.
L3LLocal network observer✅P1

Sees

  • Constant-size packets at a Poisson rate with cover traffic

Can't see

  • Reliable destination, volume or activity
L3GGlobal network observer✅P1

Sees

  • Nothing reliable — the actual packet flow is never seen

Can't see

  • The client↔lightwalletd link

Residual / countermeasure

  • Strongest option against a global observer: cover traffic and multiplexing on all mixnet links, including traffic arriving at the integrated lightwalletd, hide the flow.
Baseline hygiene applies here tooWhatever the transport, the wallet still owes the same Layer-2 discipline: randomize request times, obfuscate the start height, and never broadcast on reaching the tip.Full detail →