Zcash × Nym

Baseline hygiene

Layer 2: the transport-independent client discipline every wallet owes, on top of whatever scenario it picks. It’s §5 of the network privacy analysis.

Assume an ideal transport. The destination still receives, for every request, its content and its arrival time. These countermeasures are transport-independent: they work in every configuration and are the wallet's responsibility regardless of which scenario is chosen. A light wallet resumes each sync from the height where it last stopped, so consecutive sessions chain. Which endpoints are fingerprintable depends on the range. For the routine catch-up it is only the start: the end equals the chain tip, shared by every client syncing at that moment. Rescan ranges positioned by the wallet's own notes expose both endpoints. The countermeasure below therefore quantizes both edges of every requested range; for a catch-up, rounding the end up to the tip changes nothing.

You don’t have to build these duties yourself: the nym-swizzle-zcash library implements both, with parameters taken from ZIP 318: the quantization grid nests with its 144-block anchor grid, and the broadcast delays are its transfer-scheduling distribution. See implementing baseline hygiene, and how the policy layer composes with the transport crates.

Start-height quantization

V3 · vs L2

Since the linking key is the requested range (V3, content), above all its start height, the fix is to make ranges collide: quantize every requested range to a network-wide grid, so that every client resuming anywhere in the same grid cell emits exactly the same request.

  • Grid snapping: round the range start down, and its end up, to multiples of a standard grid spacing (absolute heights). The spacing scales with the range length on the ladder S_j = 144·2^j, never below one day of blocks (1152), so the collision window grows from one block interval to at least a day.
  • Deterministic emission: the quantized range goes on the wire as ascending, disjoint grid cells, with no random sizes, no overlap, no shuffling. Every wallet in the cell says exactly the same thing; per-wallet variation inside a collision set is a distinguishing dimension, not protection.

The cost is re-downloaded cover blocks only: for catch-ups above a day, typically 1.5x to 2x the blocks actually needed, never more than 3x; below a day the cost is bounded in absolute terms, at most one grid cell (~0.5 MB of compact blocks).

Implemented by nym-swizzle-zcash — use the library →

Broadcast hygiene and scheduling

V2 · vs L2

Broadcast timing is a V2 (timing) leak at the destination. In-transit mixing does not remove it (the destination still observes wall-clock arrival time), so the wallet must decorrelate broadcasts itself.

  • Never send a broadcast over the sync transport or session.
  • Decorrelate broadcast times from sync milestones; in particular, do not broadcast immediately upon reaching the tip.
  • Use a randomized timer for broadcasts.
  • Destination splitting: sync from one lightwalletd and broadcast through another.
  • Build the transaction when the timer fires, with expiry derived from a tip fetched at that moment: a transaction's expiry height is visible on-chain to everyone (V3), and an expiry derived from a stale tip reveals the wallet's last sync height.

Implemented by nym-swizzle-zcash — use the library →

Parameters

V3 + V2 · vs L2

The parameters are part of the protocol, not per-wallet tuning: the mechanism works by every wallet emitting the identical rule.

  • Defaults: the grid parameters (ladder S_j = 144·2^j, one-day floor of 1152 blocks) nest with ZIP 318's 144-block anchor grid, and the broadcast delays (exponential, mean 144 blocks, capped at 576 blocks) are ZIP 318's transfer-scheduling parameters, so wallet broadcasts pool with migration traffic. A wallet that customises its grid floor, split rule, or delay distribution becomes recognisably different from the rest of the crowd.
  • Anonymity sets: anonymity by collision is only as strong as the crowd that collides. The size of the collision sets grows with the number of wallets emitting the identical rule.

The library: implementing baseline hygiene → · How it composes with the transport crates →

These measures apply in every configuration of the site and are the wallet’s responsibility regardless of transport.