Zcash × Nym

Mixnet to a service-provider-integrated lightwalletd

A forked lightwalletd embeds a Nym service provider and receives requests as Sphinx messages, replying through SURBs.

✅IP hidden · P1@L2✅Req-unlink · P2@L2✅Local net · P1@L3L◐Global net · P1@L3G❌Fast sync
Mixnet (5-hop)SURB reply
Mix L1+50 msMix L2+50 msMix L3+50 msClientEntry GWExit GWSP-integrated lightwalletd

Forward: client → entry → 3 mix layers → exit → the SP-integrated lightwalletd. It replies via SURBs (pre-computed return paths back through the mixnet), so it never learns the client address; packets arrive from all last-layer mix nodes to the gateway of the lightwalletd client.

ClientEntry GWMixExit GWService provider
Mixnet (5-hop) (mixing delays)

Per-actor assessment & trade-offs

L2Compromised lightwalletd✅P1✅P2

Sees

  • Block requests from many users, with timing delays

Can't see

  • Client IP

Residual / countermeasure

  • Application-layer session state is not automatically eliminated today: the fix is a fresh sender tag per request, each provisioned with its own SURBs. No exit rotation required, since the exit gateway is chosen by the lightwalletd client and the same for all clients.
  • Traffic correlation attacks over long-running syncs remain; anonymity set proportional to the number of users accessing lightwalletd via the Nym mixnet
L3LLocal network observer✅P1

Sees

  • Constant-size packets at a Poisson rate with cover traffic

Can't see

  • Reliable destination, volume or activity
L3GGlobal network observer◐P1

Sees

  • Per-packet timing (hampered by mixing and cover)

Residual / countermeasure

  • Long bulk flows weaken per-packet correlation resistance (open question).

Pros

  • lightwalletd cannot learn client identity or location (SURB replies)
  • Eliminates exit gateway choices by clients, enabling perfect crowding on the gateway chosen by the lightwalletd client

Cons / mitigations

  • Very slow (5-hop + mixing delays)
  • Needs many users for cover

Fit

  • Client identity + IP heavily hidden from lightwalletd
  • Block sync very slow

Latency model

Regional (40)Continental (120)Intercontinental (300)
Mixnet (5-hop)1.6 s (6 hops, 3 mix layers)
Geographic propagation (speed-of-light)Per-hop mixing delayReliable-channel ACK (return, geographic only)Fragmentation (bounded send rate)

Fragmentation latency shown for SendTransaction (2.1 KB): a larger message splits into more Sphinx packets, metered onto the mixnet at a bounded rate, adding latency.

Baseline hygiene applies here tooWhatever the transport, the wallet still owes the same Layer-2 discipline: randomize request times, obfuscate the start height, and never broadcast on reaching the tip.Full detail →

Content from the Nym × Zcash reference doc. Latency figures are an illustrative model (not measured).