Zcash × Nym

Fork of lightwalletd + service provider

A lightwalletd fork embeds a Nym service provider and is deployed in a DMZ (no inbound connections). Requires server + client changes to Nym addressing.

Runtime: Server-side (lightwalletd fork with embedded Nym service provider, in a DMZ) + per-app clientsdVPN (WireGuard)Mixnet (5-hop)Speed: Fast sync / slow broadcast
dVPN (WireGuard)Mixnet (5-hop)SURB reply
Mix L1+50 msMix L2+50 msMix L3+50 msClientUser-space IP stack (smoltcp)2-hop WireGuard (boringtun)Nym mixnet clientEntry GWExit GW (mixnet)Exit GW (dVPN)Forked lightwalletd + Nym SP

Sync over dVPN and broadcast over the mixnet both reach one forked lightwalletd that embeds a Nym service provider (in a DMZ). Broadcast replies return via SURBs, so the server never learns the client address.

ClientEntry GWMixExit GWlightwalletd
dVPN (WireGuard) (no mixing)Mixnet (5-hop) (mixing delays)

Latency model

Regional (40)Continental (120)Intercontinental (300)
Block sync · dVPN (WireGuard)360 ms (3 hops)
Tx broadcast · Mixnet (5-hop)1.6 s (6 hops, 3 mix layers)
Geographic propagation (speed-of-light)Per-hop mixing delayReliable-channel ACK (return, geographic only)

What to send over it

  • Mixnet: broadcasts and sensitive small queries to the service provider (SURB replies)
  • dVPN: block syncs

Notes

  • Build a Nym service provider into a lightwalletd fork; deploy in a DMZ (no inbound public connections)
  • Broadcasts go to the service provider over the mixnet with SURB replies; sync over dVPN

Per-actor assessment (inherited)

The same four threat actors apply. This architecture inherits the assessment of the configuration it implements: Mixnet · SP-integrated. Layer-2 baseline hygiene remains the wallet’s responsibility.

L2Compromised lightwalletd✅P1✅P2

Sees

  • Block requests from many users, with timing delays

Can't see

  • Client IP

Residual / countermeasure

  • Application-layer session state is not automatically eliminated today: the fix is a fresh sender tag per request, each provisioned with its own SURBs. No exit rotation required, since the exit gateway is chosen by the lightwalletd client and the same for all clients.
  • Traffic correlation attacks over long-running syncs remain; anonymity set proportional to the number of users accessing lightwalletd via the Nym mixnet
L3LLocal network observer✅P1

Sees

  • Constant-size packets at a Poisson rate with cover traffic

Can't see

  • Reliable destination, volume or activity
L3GGlobal network observer◐P1

Sees

  • Per-packet timing (hampered by mixing and cover)

Residual / countermeasure

  • Long bulk flows weaken per-packet correlation resistance (open question).
Baseline hygiene applies here tooWhatever the transport, the wallet still owes the same Layer-2 discipline: randomize request times, obfuscate the start height, and never broadcast on reaching the tip.Full detail →
Above this transport: query shapeThis transport carries the bytes; what goes on the wire and when is decided above it. nym-swizzle-zcash shapes the query pattern itself — grid-aligned sync ranges and decoupled, restart-safe broadcasts — so the server can't chain sessions or attribute sends.The duty →The library →