Zcash × Nym

Entire machine traffic via the NymVPN app

Zero-integration fallback: all device traffic goes over Nym in the user's chosen mode. Cannot split sync from broadcast until 3-way app tunnelling ships.

Runtime: Any — no wallet integrationdVPN (WireGuard)Mixnet (5-hop)Speed: Depends on chosen mode
dVPN (WireGuard)Mixnet (5-hop)
Mix L1+50 msMix L2+50 msMix L3+50 msClientEntry GWExit GW (mixnet)Exit GW (dVPN)lightwalletd

The user selects ONE mode for the whole device (dVPN OR mixnet) — the unavailable path is disabled. Traffic is not split per request until app tunnelling ships (see below).

ClientEntry GWMixExit GWlightwalletd
Mixnet (5-hop) (mixing delays)

Whole-device mode: only the selected transport is active — the other path is disabled. Switch modes with the toggle above.

App tunnelling (outside / mixnet / dVPN traffic split)

dVPN (WireGuard)Mixnet (5-hop)
Mix L1+50 msMix L2+50 msMix L3+50 msClientEntry GWExit GW (mixnet)Exit GW (dVPN)lightwalletd

The user selects ONE mode for the whole device (dVPN OR mixnet) — the unavailable path is disabled. Traffic is not split per request until app tunnelling ships (see below).

Planned app tunnelling directs traffic three ways — outside the tunnel, over dVPN, or over the mixnet — per app rather than one mode for the whole device. Both paths run at once: fast dVPN for block sync and the mixnet for timing-sensitive broadcast.

Latency model

Regional (40)Continental (120)Intercontinental (300)
Whole device · Mixnet (5-hop)1.6 s (6 hops, 3 mix layers)
Geographic propagation (speed-of-light)Per-hop mixing delayReliable-channel ACK (return, geographic only)

What to send over it

  • Everything, undifferentiated (one mode for the whole device)

Notes

  • User must choose a mode: dVPN (fast) or mixnet (anonymous) for the whole device
  • Current split tunnelling only includes/excludes traffic from the tunnel
  • Planned 3-way app tunnelling: outside tunnel / over dVPN / over mixnet

Per-actor assessment (inherited)

The same four threat actors apply. This architecture inherits the assessment of the configurations it implements — one per transport mode (the mode toggle above selects which applies): dVPN · single exit · Mixnet · single IPR. Layer-2 baseline hygiene remains the wallet’s responsibility.

dVPN · single exit

L2Compromised lightwalletd✅P1❌P2

Sees

  • Exit gateway IP
  • All requests and contents

Can't see

  • Client IP

Residual / countermeasure

  • P2 fails within a session: the tunnel delivers one NATed flow and, with gRPC, the whole sync typically uses one long-lived HTTP/2 connection. Across sessions, linkage depends on crowding at the exit IP.
  • Rotate the exit per request to restore P2 — see the multiple-exits scenario.
L3LLocal network observer

Sees

  • Sync fingerprint — WireGuard adds no cover and preserves packet timing
L3GGlobal network observer

Sees

  • End-to-end flow correlation

Residual / countermeasure

  • The 2-hop route only prevents a single gateway from linking client to destination (entry knows the client IP but not the destination; exit knows the destination but not the client IP). Both gateways colluding, or a global observer, can still correlate — the extra hop does not add protection over Tor's guard+exit.

Mixnet · single IPR

L2Compromised lightwalletd✅P1❌P2

Sees

  • Exit gateway / IPR IP
  • All requests and contents

Can't see

  • Client IP

Residual / countermeasure

  • The wallet's TCP connection to lightwalletd is an ordinary end-to-end connection arriving from the exit's IP. Per-packet unlinkability in transit does not translate into request unlinkability at the destination.
  • With a fixed IPR, P2 behaves exactly like the dVPN single-exit case — rotate the IPR per request to restore it (see the rotating-IPR scenario).
L3LLocal network observer✅P1

Sees

  • Constant-size packets at a Poisson rate with cover traffic
  • That the client uses the Nym mixnet

Can't see

  • Reliable destination, volume or activity
L3GGlobal network observer◐P1

Sees

  • Per-packet timing (hampered by mixing delays and cover traffic)

Residual / countermeasure

  • The extent to which bulk transfers of many packets can be correlated over time is an open question. The mixnet is strongest for small, independent messages and weakest for bulk sync — one reason bulk sync does not belong on the mixnet (the other is throughput).
Baseline hygiene applies here tooWhatever the transport, the wallet still owes the same Layer-2 discipline: randomize request times, obfuscate the start height, and never broadcast on reaching the tip.Full detail →