Mix Networks Friday — August 28 2026 Weekly Update

Weekly companion to the Mix Networks 2026 Research and Deployment Tracker and Overview - Mix Networks. This edition is about shipping: the Nym Directory Contract stack — all eight PRs — merged on August 21, converting last week's "architectural answer" from proposal to merged code; Katzenpost landed a seven-part replica-proxy congestion epic (self-tuning proxy sweep, undeliverable-request fail-fast, fatal-error-channel hardening); Tor's Rust rewrite Arti pushed a 40+-commit day on the dirauth plugin (compute-mds, flavored-consensus refactor) — the C-tor retirement path advancing in public; and the Tor Project published results of its first participatory quadratic-funding round ($174,536 distributed to 10 internet-freedom projects, with a quietly remarkable datum: Monero was 27% of donations and invisible to the public tracker). On research: DumboMix (ePrint 2026/1699) makes robust asynchronous anonymous broadcast practical, and two Sybil-resistant-identity papers (2026/1723, 2026/1725) land adjacent to this library's WoT thread. Tor's network grew again: 10,146 running relays.

TL;DR — This Week

• Nym Directory Contract — MERGED (Aug 21): The full stack documented as "open PRs" last week — #6933 (Directory Contract), #6936 (verifiable retrieval), #6948 (attested anchor), #7013 (node publishing) — plus companions #7004 (checkpoint bootstrapping), #6954 (Attestation Provider), #6941 (TM Light Client anchor), #6949 (nym-api public keys + proof-of-possession) — all merged the same day. On-chain, LtHash-verifiable node directory is now the shipped architecture, not the plan. The corporate-gating critique documented Aug 14 has its structural answer in main.
• Nym hardening week: Replay window raised to 8k following WireGuard and made configurable (PR #7103, merged Aug 27); HTTP domain rotation decoupled from domain fronting with recovery logic (PR #7105, open Aug 27 — censorship-resilience work); new nym-swizzle-zcash crate in the workspace (PR #7093, Aug 25) extending the Swizzle credential family to Zcash; integration documentation for per-endpoint routing of browsers/WebViews through the mixnet (PR #7089, merged Aug 25); Network Monitor v3 per-kind scheduling/submission PRs (#7095, #7100).
• NymVPN release train: v2026.12.1 (Aug 21) → v2026.12.2 (Aug 25, all platforms except macOS) → v2026.12.3 (Aug 27, restores macOS) — three client releases in seven days, with F-Droid APK signing-fingerprint verification documented in release notes.
• Katzenpost replica-proxy congestion epic: A 7-part series (umbrella #1091) reworking the replica proxy path: instrumentation (#1101), decoupled outgoing sends (#1098), fail-undeliverable-instead-of-retry-queue (#1100), gated read-repair + shutdown ordering (#1102), sweep sized to one ProxyRequestTimeout (#1103), and the proxy path documented as self-tuning (#1099). Plus: optionally persist mix keys on clean shutdown (#1081, merged), never-close-fatalErrCh (#1108), and a client-side proposal to agree on a PKI epoch instead of pinning one (#1105, open).
• Arti dirauth maturation: 40+ commits on Aug 27 alone — the dirauth plugin gains compute-mds (microdescriptor computation, with CTorAnnotated compatibility type), FlavoredConsensus* refactored to compile-time flavors with signature handling reworked, oneshot_broadcast promoted to tor-async-utils. Arti is building the authority side of the network, not just the client side.
• Tor participatory funding results (Aug 17): First quadratic-funding round closed — $201,481 total, $174,536 distributed to 10 projects (Onion Browser $111K top allocation; minimum $5K floor). 580 donors, 662 contributions, average $41. Donation split by value: 52% BTC, 27% XMR, 13% ETH, 8% ZEC — and the Monero quarter was invisible to the public tracker, which showed only transparent chains (~$19,620 of ~$27,000). A clean natural experiment in why the mixnet-adjacent funding stack needs privacy by default.
• Tor network: 10,146 running relays (Aug 25 metrics snapshot) — 3,276 Exit, 6,246 Guard, 9,230 Stable, 5,512 HSDir. Third consecutive weekly increase from the ~9,000 DEF CON 34 baseline.
• Research — DumboMix (ePrint 2026/1699, updated Aug 21): Asynchronous anonymous broadcast with guaranteed output delivery under ≤⌊(n−1)/3⌋ Byzantine servers — MPC-based mixing over Shamir shares with O(1) multiplicative depth online, uniformly-shuffled-reveal proof. The Dumbo-family async-BFT lineage finally meets mixnet semantics.
• Research — Sybil-resistant identity (adjacent): De-SyRIS (2026/1723, decentralized Sybil-resistant identity without trusted issuer) and Proof-of-Uniqueness (2026/1725, threshold-OPRF Sybil-resistant pseudonymous DIDs) — both feed the Sybil resistance thread that Cao & Green's Nym paper made central to mixnet security.
• Freedom-tech takeaway: All three production mixnets/anonymity networks shipped infrastructure trust work this week — Nym merged its decentralized directory, Katzenpost made its storage layer self-tuning and fail-safe, Arti built authority tooling in Rust. The pattern from the Aug 21 update (adoption + accountability) now has a third leg: boring, load-bearing maturity. The networks that survive are the ones that keep shipping.

The Week in Detail

Nym Directory Contract: From Open PRs to Merged Architecture

Last week's update documented the Directory Contract stack as four open PRs — an "architectural answer" to the corporate-centralization critique. As of August 21, the entire stack merged:

Two additions to last week's table deserve emphasis. #6941 (TM Light Client Anchor) means directory consumers don't need to trust a full node — a Tendermint light client verifies the chain's directory state with minimal trust assumptions, the same pattern Cosmos chains use for wallet light-client verification. #7004 (checkpoint bootstrapping) addresses the cold-start problem: new clients can bootstrap directory state from checkpoints instead of replaying history — operationally essential if the on-chain directory is to be usable on day one for new nodes.

What changes: The Aug 14 critique — "one corporation gates the network" via directory control — now has a shipped structural counter: node existence, configuration, and topology are on-chain, ed25519-signed, and LtHash-verifiable by any consumer with a light client. A coerced or compromised Nym Technologies SA can no longer silently rewrite who the network is.

What still doesn't change: The Cao & Green framing attack (ePrint 2026/101) lives in the performance-measurement layer, not the directory layer. Which nodes carry traffic — the active set — is still selected by the reputation machinery the paper showed is manipulable. The merged directory makes the roster verifiable; it does not make the ranking honest. That remains the open battleground, alongside credential issuance (coconut/Swizzle), which remains company-operated.

Primary sources: PR links above; merge dates from the nymtech/nym commit history (commits feat: Directory Contract through feat: Directory node publishing, all 2026-08-21).

Nym Hardening Week: Replay Windows, Domain Rotation, Swizzle-Zcash

Beyond the merge event, the Nym repo shows a cluster of transport-resilience work:

Replay window → 8k, configurable (PR #7103, merged Aug 27): The default replay-protection window for transport sessions was raised to 8,192 bits, explicitly "following wireguard", and made configurable for future changes. Replay windows are the anti-replay anchor for packet-counter-based schemes; sizing them matters for long-lived sessions with reordering. Following WireGuard's sizing is a sensible default-heritage choice — and the configurability means the constant is no longer baked in.

HTTP domain rotation decoupled from fronting (PR #7105, open Aug 27): Reworks http-api-client so that rate-limit errors trigger host rotation without forcing domain fronting on, fronting policy is more configurable, and — notably — recovery logic can transition back from fronting-enabled to fronting-disabled instead of latching. This is censorship-resilience engineering in the classic Tor-bridges tradition: rotate endpoints when throttled, escalate to fronting only when needed, de-escalate when the direct path recovers. The PR description reads like operational experience with the API endpoints being rate-limited in practice.

nym-swizzle-zcash (PR #7093, merged Aug 25): A new crate in the workspace — the Swizzle credential family (Nym's coconut-derived blind-credential system) gains a Zcash-specific instantiation, with workspace dependencies reordered for publication. Combined with the existing Zcash Ironwood free-tier integration (Jul 27) documented in Nym, the Zcash↔Nym relationship is deepening at the credential layer, not just the VPN-marketing layer. Watch this space: if Swizzle credentials become the issuance mechanism for ecosystem partners, the "credential issuance still company-operated" caveat gets its own architectural answer eventually.

Integration docs (PR #7089, merged Aug 25): New guides for planning per-endpoint integrations and routing browser/WebView applications through the mixnet, with redirects from retired "retrofitting" pages. The docs are catching up to the integration wave (Edge, Peach) — lowering the cost of the next Peach.

Network Monitor v3 (#7095, #7100, open): Per-kind scheduling and submission — the measurement infrastructure that feeds the reputation system is itself being reworked. Relevant given that measurement integrity is the open attack surface per Cao & Green.

Also merged: #7099 (future link-protocol compatibility path), #7106 (nym-node config migration fix), #7107 (nym-api fixes making future re-DKG smoother — the re-DKG robustness thread from PR #7082 continues).

NymVPN: Three Releases in Seven Days

The client release train accelerated: v2026.12.1 (Aug 21, full-platform including Windows installers and macOS pkg + iOS TestFlight), v2026.12.2 (Aug 25, all platforms except macOS), v2026.12.3 (Aug 27, restores macOS). The .3 release notes document the component set (nym-vpnd daemon, nym-vpnc CLI, nym-socks5-proxy for geo-exclusion routing, nym-diagnostic, nym-setup) and include the F-Droid APK signing-certificate SHA-256 fingerprint with apksigner verify instructions — release engineering hygiene consistent with a product that expects adversarial distribution-channel attacks.

The cadence itself is the signal: weekly-ish client releases with platform gaps closed within days. This is the operational tempo of a consumer VPN product, not a research prototype.

Primary sources: https://github.com/nymtech/nym-vpn-client/releases (tags nym-vpn-v2026.12.1/2/3).

Katzenpost: The Replica-Proxy Congestion Epic

Katzenpost shipped its most substantial engineering push since resuming commits (Aug 14, per the Aug 21 update): a seven-part series reworking the replica proxy path, under umbrella issue #1091 "Replica proxy congestion":

Read together: the replica proxy (which mediates client access to the message-store replicas used for asynchronous mailbox delivery) had a congestion failure mode — undeliverable requests were retry-queued (unbounded work), sends and replies were coupled (head-of-line blocking), and sweeps weren't sized to timeouts (overload cascades). The epic fixes all three and then documents the result as self-tuning — a claim about steady-state behavior, not just a bug fix.

Supporting hardening in the same window:

• #1108 (merged Aug 26): replica/server/dirauth never close fatalErrCh — closing a channel that multiple senders write to is a Go panic pattern; this removes a crash class from long-running federated deployments.
• #1081 (merged Aug 27): server optionally persists mix keys on clean shutdown — node operators can restart without re-keying, which matters for topology stability (re-keying on every restart churns the trust graph).
• #1105 (open Aug 26): client agrees on a PKI epoch instead of pinning one — clients that pin an epoch can desynchronize from consensus; agreeing on the current epoch is the robust pattern.
• #1107 (open Aug 26): docker port-architecture simplification — deployment ergonomics.

The pattern matches last week's read ("operational maturity, not features") but escalates it: this is a codebase being prepared for federated deployments where operators restart nodes, replicas congest, and nothing should fall over. Katzenpost remains the mixnet design most explicitly built for the post-quantum, federated-authority future (Katzenpost pillar note).

Arti: The Dirauth Plugin Grows Up

The Rust Tor implementation (Tor's successor path) had a 40+-commit day on August 27, dominated by arti-dirauth work:

• compute-mds implemented in the dirauth plugin — microdescriptor computation, the authority-side function that produces the mds consensus artifact clients consume. With the CTorAnnotated helper type for C-tor compatibility parsing, this is the plugin system (arti's mechanism for authority functionality to live outside the core) gaining the load-bearing consensus-generation path.
• FlavoredConsensus* refactor: FlavoredConsensus → FlavoredConsensusBody (compile-time flavor determination instead of runtime), new FlavoredConsensusUnverified::sigs() / FlavoredConsensusSignatures replacing the removed signatories(), ItemStream::with_inner_lines_mut in tor-netdoc. This is consensus signature handling — the authority-crypto surface — being rebuilt in safe Rust types.
• oneshot_broadcast promoted to tor-async-utils with doc tests and exhaustive SenderDropped — async infrastructure shared across the protocol stack.
• always-on-flowctl-cgo merged — flow control for always-on onion services (the arti-side service model), continuing the CGO (client-guard... circuit) work noted in the Aug 7 update (arti 2.5.1's experimental CGO).
• FilenameOrStdio reading support, Nickname accessors, MicrodescError error-kind integration — the long tail of a codebase being productionized.

No arti release this week (2.5.1 from Aug 3 remains current), but the direction is unmistakable: arti is building the directory-authority side of the network. The C-tor 0.4.8 sunset (announced June, deadline September) and the Rust relay rewrite mentioned at DEF CON 34 both presuppose that arti can eventually run the authority functions. This week's commits are that presupposition being made concrete. The dirauth plugin architecture notably keeps authority logic modular — consistent with a future where authorities run hardened, minimal Rust binaries.

Tor Participatory Funding: Quadratic Funding Works, and Monero Was Invisible

The Tor Project published results of its first participatory funding round (blog, Aug 17, "Funding internet freedom together"):

• Totals: $201,481 raised; $174,536 distributed via quadratic funding to 10 projects; 15% overhead for campaign infrastructure.
• Participation: 580 unique donors, 662 contributions, average donation $41 — the QF design (many small donors → more match) visibly worked as intended.
• Allocations: Onion Browser $111,119 (63.3% of the QF share — iOS Tor access, name recognition compounding), Unredacted $40,729, Osservatorio Nessuno $14,633, then a $5,000 floor each for Paskoocheh/ASL19, OpenArchive, SecureDrop, Ricochet Refresh, OONI, OnionShare, Miaan Group. The minimum-$5K threshold was an explicit design choice so every participant cleared meaningful support.
• The Monero datum: donations arrived in BTC, ETH, ZEC, XMR, and GLM. By value: 52% Bitcoin, 27% Monero, 13% Ethereum, 8% Zcash. But "Monero was invisible to the public tracker" — the public total showed only transparent chains (~$19,620 of ~$27,000 direct). A quarter of the community's support, invisible by design.

Two readings matter for this library. First, funding-model resilience: the round was explicitly an experiment in de-risking the single-funder fragility exposed by the 2025 US policy shift (grants rescinded mid-contract). $200K is small against Tor's budget, but the mechanism — QF allocation, crypto-native donation rails, minimum floors — is now proven and repeatable. Second, the Monero invisibility is a natural experiment in transparent-chain measurement bias: any public tracker of crypto-denominated support undercounts privacy-coin users by construction. (The blog itself makes the point gently by reporting both numbers.) For Nym's economics thread and for any future Daemon-network funding mechanics, the lesson is concrete: if you want honest public accounting of community support, you must design for the invisible donors, not just report them anecdotally.

Primary source: https://blog.torproject.org/funding-internet-freedom-together/ (Aug 17, 2026).

Tor Network Metrics

From the metrics relayflags snapshot (Aug 25): 10,146 running relays — up from 10,128 (Aug 18) and ~9,000 (DEF CON 34 baseline, early August). Exit 3,276, Guard 6,246, Stable 9,230, HSDir 5,512. The slow post-DEF CON growth continues; the Hetzner-concentration concern (Aug 14 update, ~20% of network) is unchanged pending fresh topology data.

Research: DumboMix and the Sybil-Resistance Pair

DumboMix: Robust Asynchronous Anonymous Broadcast Made Practical (ePrint 2026/1699, Wei Tang, Hanwen Feng, Jiliang Li, Yuan Lu, Qiang Tang; last updated Aug 21):

• What it is: A framework for asynchronous anonymous broadcast with guaranteed output delivery (robustness) — n servers privately solicit N client messages that remain secret until revealed in uniform random order, tolerating ≤⌊(n−1)/3⌋ Byzantine servers and unpredictable network delays (full asynchrony — no timing assumptions, the hardest setting).
• How: Two mixing methods (DumboMix1/2) built on Shamir-secret-shared MPC over ℤₚ: online phase needs only O(1) multiplicative depth, expected O(N²) public×shared scalar multiplications, ≤ O(N) shared×shared multiplications. With a robust underlying MPC, all revealed inputs are provably uniformly shuffled.
• Why it matters here: The Dumbo family (Dumbo-Ng, Dumbo-MVBA...) is the state of the art in asynchronous BFT; this paper grafts mixnet semantics (uniform random shuffle, secrecy until reveal) onto it. For this library's threads: it's the committee-based alternative to Katzenpost's dirauth-federated model — anonymous broadcast as an MPC service rather than a network layer. Relevant to anonymous messaging boards, whistleblowing drop boxes (the Ricochet Refresh / SecureDrop funding recipients above are the customer base for this primitive), and any federated system needing shuffled reveal without a trusted mixer. Successor to the Aug 21 update's Verifiable SelfMix (2026/1617) in the "anonymous publication" line.
• https://eprint.iacr.org/2026/1699

Adjacent — Sybil-resistant identity (cross-listed to the WoT and PoP threads):

• De-SyRIS (ePrint 2026/1723, Aug 18): decentralized Sybil-resistant identity system without a trusted credential issuer — directly relevant to both Nostr's key-based identity (no issuer at all) and Nym's coconut/Swizzle credentials (company issuer, decentralization open).
• Proof-of-Uniqueness (ePrint 2026/1725, Aug 18): Sybil-resistant privacy-preserving decentralized identity via threshold-OPRF — the same primitive family as World ID 4.0's OPRF design (covered in the Aug 16 Identity update) and Nym's coconut signatures (threshold blind signatures are dual to threshold ORFs).

Both papers are evidence that the Cao & Green "survivability dilemma" (open entry vs. attack resistance) is becoming a recognized field rather than a per-network headache — the prerequisite for mixnet reputation systems getting principled fixes.

Quick Hits

• I2P: Steady state, no release (2.13.0 from Jul 24 current; 2.14.0 targeted ~late October with SSU2-PQ). Week's commits: i2psnark KRPC DG1 message compression + UDP connect-request compression (Aug 26), close-all-RAFs file-handling fix (Aug 25), removal of ancient single-torrent/CLI code (Aug 24), and a new discardMessage() I2CP session API (Aug 26) — client-protocol hygiene.
• HOPR: Per-SSA deposit data in SsaRequest sourced from the deposit pool (Aug 27) — the PIX/payment-integration track continues; session teardown ERROR-spam fix (Aug 22).
• Tor Browser / Tails: No new releases this week (15.0.20 / Tails 7.11 from Aug 18–19 remain current; alpha line holds at 16.0a9).
• Snowflake Volunteer: No new version since 1.12 (Aug 10, 10 languages).

Evidence at a Glance