Mix Networks Friday — October 09 2026 Weekly Update

TL;DR — This Week

1. Nym Binaries v2026.19-fuqing (Oct 1, pre-window) ships lock-free topology + HTTP rate-limit rotation + LP-DATA clock-skew propagation + BandwidthController prune command + sdk feature gating; first post-essaouira binary cut since v2026.18 on Sep 16, 14 days. Fourteen new commits in CHANGELOG v2026.19-fuqing cluster around LP-DATA / Directory Contract hardening rather than NMv3 (which landed separately as a long Oct 7–8 PR chain).

2. NymVPN v2026.13.0 ships three betas in seven days (Oct 2 / Oct 7 / Oct 8) — the credential-issuer key rotation window opens. All three betas advertise identical Core Added/Changed sections (diagnostics gate, persist-gateway-list-to-disk, Linux UNIX-group nym-vpn auth, configuration profiles — Safest/Most Private/Fastest/Random via #6073, six_months subscription kind, dynamic DNS fallbacks from Discovery, macOS CLI net.nymtech.vpn.cli signing, rpc-uniffi crate merged into lib-uniffi, fallback-to-random on missing location data, re-ordered authentication flow, detach slow diagnostics from blocking commands); beta.2 adds only-metadata-refreshed gateway list cached across reconnects; beta.3 reverses both the #5762 metadata-teardown deferral and the #6091 connect-on-healthy-metadata fallback (only-both-passes-connect). The Sep 24 blog pre-announcement ("Upgrade to v2026.12.4 or newer") is now actionable: NymVPN v2026.12.4 → v2026.12.6 → v2026.13.0-beta.N is the migration path. Exact rotation date still TBA on nymvpn-network-upgrade.

3. Nym NMv3 (Network Monitor v3) build-out converges on Oct 7–8 — eighteen PRs merged in two days, all by Jędrzej Stuczyński. The Oct 7 cluster ships: gateway liveness probes #7128, mixnode liveness sending #7115, per-kind submission #7100, per-kind scheduling #7095, store different test results #7086, ed25519 NM identity announced on the Directory Contract #7080, client unmetered ephemeral sessions #7078, forwarding of final-hop Network Monitor packets #7063, ed25519 NM identity in announced data #7059, and NMv3 liveness checks #7058. Oct 8 clusters Geolocation / NM API integration #7168 / #7156 / #7181 (attested geolocation retrieval, node-score aggregation, "performance contract: multiple kinds"). The Directory Contract → Geolocator service stack first landed in djibouti v2026.17 (Sep 2); NMv3 is the third leg that lets the Directory Contract measurably rank mixnodes without trusting company-operated reputation. The Oct 7 libcrux upgrade + nonce re-enable #7214 is a separate crypto-stack hardening (post-quantum signature library refresh).

4. Nym SDK release channel: Max/ts sdk — the TypeScript SDK gets a new "always-latest" release pipeline (#7218, mfahampshire, Oct 8). Separately: cargo feature flags documented in the Rust SDK (#7122, mfahampshire, Oct 5) — the SDK is becoming a product surface on its own rather than just an internal monorepo.

5. Katzenpost ships a security hardening cluster of unprecedented size — three merged PRs, 100+ commits, on Oct 7–8, after ioerror's Sep 27 CI hardening sweep and #1182 (Oct 1) client/thin race fix. The cluster:

• #1206 (Oct 7, Jacob Appelbaum) — authority/voting: dirauth fixes and consensus reliability — 44 branches merged in order, each a "failing test → fix" pair; wire/consensus/on-disk formats are unchanged; behaviour changes: PeerRetryMaxAttempts no longer defaults to 20 (unset = retry until phase deadline); IdentityPublicKeyPem renamed → IdentityPublicKeyFile with old-name compat. This is the biggest single PR the katzenpost repo has ever shipped.
• #1213 (Oct 7, Jacob Appelbaum) — security: wipe dropped secrets, bound the thin-client listener, keep identifiers out of logs — eight sub-fixes including wire cipher states on Close, envelope private-key wipe on drop, thin-client listener read/allocation/connection bounds, ephemeral MKEM key wipe at last use, SURB key wipe wherever dropped, blinding-factor removal from one log line.
• #1214 (Oct 8, Jacob Appelbaum) — dirauth: reject late votes past reveal, bound topology layers, and guard mix slots — three consensus/networking fixes: late-vote SRV grinding prevention (commands.VoteTooLate once authority has transitioned past reveal), bounded topology layers against prior consensus (prevents unbounded growth), pinned-authority-only peer slot identity binding (prevents slot sales).

Plus #1215 (Oct 8, closed/merged) — courier, server, client: nil guards on reply dispatch, session credentials error handling, #1216 (Oct 7, merged) — go.mod: update golang.org/x/text to v0.41.0, #1218 (Oct 8, merged) — server/internal/scheduler: take the epoch length from epochtime.Period. Eight further PRs queued (#1208 kaetzchen + courier re-dispatch pacing, #1209 client socks5 panic + ARQ jitter + bandwidth estimate + ping per-epoch + retryable-pigeonhole-not-ready, #1210 optional descriptor fields + client notice + service delay, #1211 cborplugin host-chosen socket + drain + geometry + parameters, #1217 docker/quic transport pick + QUIC keepalives + cached read success, #1220 descriptor uploads bound to session link key + per-identity slots for pinned nodes, #1221 kpclientd systemd socket activation).

6. HOPR ships the GNO-805 channel-balance incident-fix trilogy on Oct 6–7 (5 merged PRs). #8485 (Lukas) — fix(chain): update the channel graph balance on ticket redemption (TicketRedeemed was falling through process_chain_events's catch-all and the routing graph kept each channel's funded balance); #8487 (Tibor) — fix(path): fund-check the extended search against the finished path length (GNO-805); #8486 (Lukas) — fix(transport): keep a cold 1-hop burst from losing its route at a counter flush (#8484) — score only settled packets, a burst starting just before flush was reported unacknowledged, edge fell below min_ack_r. Plus #8478 (Oct 6) — fix(session)!: decouple the PIX recovery floor and quota from the HOPR payload size (closes #8469: Sep 29 #8313 payload change 1038 → 3246 B silently tripled max_recovery_time; ASSUMED_SESSION_PACKET_RATE → MAX_ASSUMED_SESSION_PACKET_RATE, fixed 5000 packets/s upper bound ≈ 58 Mbps). And #8472 (Oct 5) — share-bearing SURBs first in the Exit SURB store, #8473 (Oct 5) — feat(protocol)!: count lost PIX shares exactly and drop the LIFO SURB pop order (the Gnosis VPN tunnel-down investigatory work continues). Net: HOPR is shipping real bug fixes fast ahead of the 4.x stable cut.

7. Tor network at 10,560 relays (Onionoo relays_published: 2026-10-09 01:00:00) — up from the Sep 8 post-0.4.8-EOL trough. Onionoo summary confirms 10,560 in consensus; bridge publishing ok at 2026-10-09 00:55:17. Onionoo is the right primary source because the metrics.torproject.org relayflags.csv lags (latest data in CSV is 2026-10-05 = 9,194 running relays; the Oniooo summary is the authoritative fresh count). The +1,073 from metrics.csv Oct 5 to onionoo Oct 9 is partly CSV lag, partly real growth.

8. I2P i2psnark + i2ptunnel cluster (Sep 27 → Oct 5): V-50 loopback (Oct 1 PR #178 + Oct 5 merge) + V-33/49/54/55/66/67 (merged Sep 21–27) closes the V-series security cluster. zzz bumped -8-rc Oct 5 (one revision past -7 Sep 28) — I2P 2.13.0 → 2.14.0-rc is being staged for the I2P-roadmap-target "late October 2026" cut (I2P roadmap last updated 2026-07 lists: build fix for gettext 1.0, izpack 5.2.6, gradle build fixes, addressbook conflicts, SAM datagram 2/3 subsessions, i2psnark v2 prep, streaming speedups, performance improvements). No new i2p.i2p full release tag yet; i2pd still at 2.61.0 (Jul 20).

9. Arti 2.7.0 (Oct 1, pre-window) ships with low- to high-severity security fixes and explicit upgrade guidance for arti, arti-client, and arti-ureq users, "especially those running onion services". The Tor blog notes Arti "continues our ongoing development towards using Arti as a relay and as a directory authority, with much of the work focusing on document parsing, directory mirror support, and DNS stream handling." Arti now has RPC support for modifying and inspecting its configuration. That's the dirauth-path prerequisite from last week's standing-watch note still landing.

10. ePrint sweep (Oct 2 → Oct 9): four in-window mixnet/PIR/anonymity papers — first NymHS-relevance + PIR + OMR cluster in weeks.

Banner story: three independent hardening waves ship in the same 7-day window — Katzenpost #1206+#1213+#1214 dirauth/security dirauth (Oct 7–8), NymVPN v2026.13.0-beta.1/.2/.3 credential-issuer key-rotation pipeline (Oct 2/7/8), HOPR GNO-805 channel-balance incident trilogy (Oct 6–7). Plus the I2P 2.14.0-rc staging opens the late-October target on schedule. Mix networks are converging — not on a single protocol, but on a hardening posture in which weekly cadence can absorb an entire July-of-2025 amount of hardening in a single Tuesday.

The Week in Detail

Nym — Binaries v2026.19-fuqing (Oct 1) + NymVPN v2026.13.0-beta.1/.2/.3 Cluster + NMv3 Build-Out + SDK Update

Nym CHANGELOG v2026.19-fuqing ships these items, dated 2026-09-29 in the source (release-tag date Oct 1):

Then a separate Oct 7–8 PR cluster (NMv3 build-out) by Jędrzej Stuczyński launches NMv3 against the Directory Contract: gateway liveness probes #7128, mixnode liveness sending #7115, per-kind submission #7100, per-kind scheduling #7095, different test results #7086, NM ed25519 identity announced on Directory Contract #7080, unmetered ephemeral client sessions #7078, forwarding of final-hop Network Monitor packets #7063, ed25519 NM identity in announced data #7059, NMv3 liveness checks #7058, NM Nym API integration #7136, NM review nits + docs #7176. Oct 8's stack adds attested geolocation retrieval #7156, node score aggregation #7181, Geolocation contract within NS API #7168, and performance contract: multiple kinds #7213 — the integration story is that Geolocator + Directory Contract + NMv3 liveness form one observation pipeline.

#7214 (Oct 7) — chore: upgrade libcrux libraries and re-enable nonce control is a separate crypto-stack hardening: libcrux is Nym's audited post-quantum signature library; the nonce control re-enable closes a small protocol-side escape.

The Max/ts sdk always latest PR #7218 (mfahampshire, Oct 8) is parallel — the TypeScript SDK gets a release pipeline where new commits trigger automated npm publishes without manual intervention, while #7122 (Oct 5) docs(rust-sdk): document cargo feature flags makes the Rust SDK's compile-time options discoverable. Two SDKs, two different ergonomics bets: always-latest for JS users, feature-gated for Rust users.

NymVPN v2026.13.0-beta.1/.2/.3 — the Credential-Issuer Key Rotation Window Opens

The most consequential story in Nym-land this week is the v2026.13.0 beta train running three releases in seven days — beta.1 (Oct 2 12:32:05 UTC), beta.2 (Oct 7 12:20:21 UTC), beta.3 (Oct 8 10:55:36 UTC), each authored with Nym's "Release Please" pattern (so the body is identical across betas except for the Fixed-section refinement). The core added/Changed surface is identical across all three betas:

• Detect when the diagnostics check should be run (#5993)
• Persist gateway list to disk, seeded from a built-in list (#6015)
• [Linux] Authenticate also via UNIX group "nym-vpn" membership, or root (#6100)
• Configuration profiles: Safest, Most Private, Fastest and Random (#6073)
• Add 'six_months' subscription kind to the vpn-api models and gRPC proto (#6320)
• Add end-to-end plumbing for dynamically applying DNS fallbacks from Discovery (#6126)
• [Desktop] Detect conflicting software and report it to the user (#6122) — disabled in beta.2/beta.3 because it "falsely reports DNS interception on systemd-resolved systems"
• [macOS] Sign cli with net.nymtech.vpn.cli bundle identifier. Add it to client signing requirement (#5998)
• Merge rpc-uniffi crate into lib-uniffi (#6010)
• Fallback to random when no location data available (#6382)
• Re-order authentication flow and do checks as soon as possible (#6406)

The fixed-section differences between betas track the rotation pipeline itself:

• beta.1 only fixed Remove failed pending requests before creating new ones (#6295) and the macOS file-permissions fix (#6456).
• beta.2 replaced both with the credential-rotation-aware batch: only-both-in-tunnel-ping-and-metadata-pass for "connected"; keep cached gateway list across reconnects; keep in-flight location lookup across reconnect/setting-update so automatic gateway selection is less likely to fall back to random; treat built-in or unknown-age gateway differently (an implicit "the rotation may repopulate this from a baked-in copy").
• beta.3 adds explicit "remove a gateway from the blacklist once a tunnel through it connects" plus reverses both the metadata-teardown deferral (#5762) and the connect-on-healthy-metadata fallback (#6091) — the "only-both-passes-connect" rule is now strict in both directions; Run diagnostics in the background so a slow one no longer blocks disconnect.

The Sep 24 Nym blog (nym.com/blog/nymvpn-network-upgrade) pre-announced: "Nym is refreshing the decentralized system that issues NymVPN's anonymous credentials ... rotating that system's signing keys and refreshing the operators who run it." The exact date is still TBA in the active blog post. The v2026.13.0-beta train is the shipping surface for the rotation: clients need to have the v2026.12.4-or-newer credential fetcher to keep working through the rotation.

Katzenpost — The Largest Single-PR Week in Project History (#1206, #1213, #1214 Landed Oct 7–8)

The Katzenpost server has been hardening continuously since the Sep 27 #1133 NoOp gateway heartbeat. The week of Oct 7–8 lands three merged security-hardening PRs at once, with Jacob Appelbaum as the dominant author:

#1206 (Oct 7, merged) — authority/voting: dirauth fixes and consensus reliability merges forty-four branches in order, each a "failing test → fix" pair. Wire/consensus/on-disk formats are unchanged (so existing nodes don't need to upgrade in lockstep). Two behaviour changes:

• PeerRetryMaxAttempts no longer defaults to 20 — unset = retry until phase deadline (closer to the spec intent of "best-effort until phase close")
• IdentityPublicKeyPem renamed IdentityPublicKeyFile (old name still works)

This is the dirauth layer getting the same "test-first, fix-second" treatment the relay layer got in #1182 — exactly the pattern ioerror asked for in Sep 27's CI hardening sweep.

#1213 (Oct 7, merged) — security: wipe dropped secrets, bound the thin-client listener, keep identifiers out of logs ships eight sub-fixes, each a branch, all "failing test first":

• core/wire: wipe the session cipher states on Close
• replica: wipe envelope private keys when they are dropped
• client: bound thin-client reads, allocations, and connections
• client, courier/server, replica: wipe ephemeral MKEM keys at their last use
• client: wipe a SURB key wherever it is dropped
• client: drop the blinding factor from a log line

#1214 (Oct 8, merged) — dirauth: reject late votes past reveal, bound topology layers, and guard mix slots is the "Byzantine-proofing" PR — three fixes:

1. Late-vote SRV grinding prevention — once the authority has transitioned to stateAcceptReveal/stateAcceptCert/stateAcceptSignature, reject subsequent votes with commands.VoteTooLate; a vote carries the voter's SharedRandom commit, and accepting commits after honest authorities have already revealed their secrets lets Byzantine authorities grind the resulting SharedRandom.
2. Bounded topology layers against prior consensus — generateTopology bounds layers against the prior consensus, preventing unbounded growth between epochs.
3. Pinned-authority-only peer slot identity binding — mix peer slots are not keyed to an unpinned (outside-the-pinned-set) identity; peer-slot identity binding is restricted to pinned authorities; red-team-tested with a regression test.

#1215 (Oct 8, merged) closes the cluster — courier, server, client: nil guards on reply dispatch, session credentials error handling, .... Eight further PRs remain open (#1208 kaetzchen + courier re-dispatch pacing, #1209 client socks5 panic + ARQ jitter + bandwidth estimate + ping per-epoch + retryable-pigeonhole-not-ready, #1210 optional descriptor fields + client notice + service delay, #1211 cborplugin host-chosen socket + drain + geometry + parameters, #1217 docker/quic transport pick + QUIC keepalives + cached read success, #1220 descriptor uploads bound to session link key + per-identity slots for pinned nodes, #1221 kpclientd systemd socket activation, #1219 in flight). The shape is "plumb + harden + plumb + harden" — every PR is small, but the cluster ships a measurable hardening step.

HOPR — GNO-805 Channel-Balance Incident Trilogy (Oct 6–7) Closes

The GNO-805 ticket tracks a single incident where a payment channel drains below one-ticket face value, the path still gets selected, and the first-hop ticket fails in hopr-ticket-manager with balance of channel is too low, stalling traffic while the node still reads healthy. The fix is sequenced: #8485 chain/ticket-redemption → #8487 path/fund-check → #8486 transport/cold-1-hop-burst — the chain event is the upstream cause, the path selection is the surfaced-but-still-wrong layer above it, and the transport edge-fall is a sibling symptom.

#8485 (Oct 6–7) fix(chain): update the channel graph balance on ticket redemption (GNO-805) — ChainEvent::TicketRedeemed (post-redemption ChannelEntry) was falling through process_chain_events's catch-all (which only records the graph edge balance for ChannelOpened/Closed/BalanceIncreased/BalanceDecreased). The routing graph kept each channel's funded balance on ticket redemption events — that funded balance didn't reflect drained ticket value, so paths selected routes that would fail at ticket-manager.

#8487 (Oct 7) fix(path): fund-check the extended search against the finished path length (GNO-805) — Phase 1 of path selection (EdgeValueFn::forward) rejects the drained first hop correctly; Phase 2, the extended forward search (compute_extended_forward_paths), used the traversal depth (shorter_length) instead — so a path that finishes with a drained first hop was passed through.

#8486 (Oct 7) fix(transport): keep a cold 1-hop burst from losing its route at a counter flush — Score only settled packets. A cold burst on a fresh 1-hop Session lost its route for 5 seconds when its first packets were still in flight at a counter flush (master counterpart of release/4.0 backport #8488).

Plus ##8478 (Oct 6) fix(session)!: decouple the PIX recovery floor and quota from the HOPR payload size (closes #8469): the PIX max_recovery_time floor was 1.5 Mbps / HoprPacket::PAYLOAD_SIZE, so Sep 29 #8313's payload change (1038 → 3246 B) silently tripled it and hoprd refused valid profiles at load. ASSUMED_SESSION_PACKET_RATE → MAX_ASSUMED_SESSION_PACKET_RATE (fixed 5000 packets/s upper bound ≈ 58 Mbps of Session data); deadline judged by fill.max_rate counted up to that bound.

#8472 (Oct 5, closed/merged) — share-bearing SURBs first in the Exit SURB store (LIFO is wrong because SURBs are produced with share-bearing first); #8473 (Oct 5, closed/merged) — feat(protocol)!: count lost PIX shares exactly and drop the LIFO SURB pop order. Companion diagnostic #8490 (Oct 8, merged) test(session): reproduce the balancer estimate-pin and output collapse under return-path loss.

HOPR is shipping real bug fixes fast ahead of the 4.x stable cut. The Sep 23 surface-area code (PIX supervision #8237, parameterized admission #8377, 1956609/9766 SURB-buffer gauge #8440) plus the Oct 1 stalled-sink (#8463) + return-path visibility (#8464) + breaking-field-extensions (#8313/#8460) + Oct 5–8 GNO-805 incident trilogy is a coherent hardening arc: separate the diagnostic, the protocol change, and the incident repair into distinct PRs that each close one ticket.

I2P — V-Cluster Security Close + 2.14.0-RC Staging

The Nick2k4L/eyedeekay V-series security cluster finishes closing in the Sep 27 → Oct 5 window:

• V-66 (escaping), V-33 (security headers, JSON response headers, Sep 25), V-54/55 (XSS, Sep 21), V-49 (log only scheme, not whole basic auth string, Sep 21), V-07 (CSRF, Sep 21), V-13 (nonce cleanup, Sep 21) — all closed by Sep 27.
• V-50 (loopback) landed as PR #178 (Nicholas Lopez, "Refactor: changed hardcoded values within isBlockedIPv4 method to use String method"), with [Linux] Authenticate also via UNIX group "nym-vpn"-equivalent style fix i2ptunnel: Block private and local IPv4 destinations (Oct 1); merged Oct 5.
• i2psnark DHT tracker (Sep 28: "Increase max torrents for DHT tracker" + "Strict sorting of dictionaries in DHT messages"), then Sep 27 (Remove oldest kbucket entry in trimmer / Reduce DHT announce interval).
• GeoIP 2026-10-01 + bump build time + bump -8-rc (Oct 5 — one revision past -7 Sep 28; -8-rc is the canonical tag for I2P 2.14.0 release-candidate when the ant bump lands).

No full i2p.i2p release yet — 2.13.0 (Jul 24) is still the latest stable, i2pd 2.61.0 (Jul 20) is the latest C++. The I2P roadmap (last updated 2026-07) names 2.14.0 target: late October 2026 with: build fix for gettext 1.0, izpack 5.2.6, gradle build fixes, addressbook conflicts, fix SAM datagram 2/3 subsessions, i2psnark bug fixes / speedups / security fixes / memory reduction, i2psnark JS audio player, i2psnark prep for v2 support, performance improvements, streaming speedups and synch fixes.

Tor Network — Onionoo 10,560 Running Relays (Oct 9, Fresh)

The canonical Oct 9 snapshot: GET https://onionoo.torproject.org/summary?type=relays → relays_published: 2026-10-09 01:00:00, bridges_published: 2026-10-09 00:55:17, total relays (running) = 10,560.

For historical comparison, https://metrics.torproject.org/relayflags.csv shows (Running only):

The CSV ends at 2026-10-05 — that's the relayflags-graphing lag; the Onionoo summary is the authoritative fresh count. The Oct 4 → Oct 5 -234 drop is the second-largest week-over-week drop this quarter (only Sep 1's post-0.4.8-EOL drain was bigger); the recovery pattern post-Sep-19 low (9,330) had been gradual; the Oct 5 datapoint may reflect a small transient outage or a server family rotating. The Oct 9 Onionoo 10,560 means the actual network is bigger than the graph.

Stable bridges (bridges_published: 2026-10-09 00:55:17) are reported via Onionoo but bridge count is not in the public summary endpoint.

Tor Browser / Tails — No New Releases in Window; Watch-List Below

• Tor Browser blog feed (Atom) — entries from Oct 1 (16.0a13 + Arti 2.7.0) backwards; no new Tor Browser 15.x or 16.x stable release this week.
• Tails (tails.net/news/index.en.rss) — Tails 7.14 (Sep 30) is the latest; Tails 7.15 expected Oct 14 per Tails' 2-week release-cadence pledge. Bundle: Tor Browser 15.0.24 + Tor 0.4.9.13 + Linux 6.12.111.

Arti 2.7.0 (Oct 1) — Security Release

The Tor blog post (by opara, Oct 1) announces Arti 2.7.0:

"Arti 2.7.0 ... continues our ongoing development towards using Arti as a relay and as a directory authority, with much of the work focusing on document parsing, directory mirror support, and DNS stream handling. Additionally, arti now has RPC support for modifying and inspecting its configuration. This release has a number of fixes for low- to high-severity security issues. We encourage arti, arti-client, and arti-ureq users, especially those running onion services, to upgrade as soon as possible."

Release tag: arti-v2.7.0, created 2026-10-01, after arti-v2.6.0 (Sep 1) and arti-v2.5.1 (Aug 3). Arti now has RPC support — the dirauth-path prerequisite from last week's standing-watch note.

Research / EPrint Sweep (Oct 2 → Oct 9)

The IACR ePrint listing for /2026/ was parsed; keyword filter (anon|mix|onion|traffic|oblivious|censor|stegan|relay|dissent|sybil|fragment|pir) returned four in-window mixnet/PIR/anonymity papers:

ePrint 2026/2334 (Oct 4) — Trapdoor Projective Sampling and Identity-Based Anonymous Broadcast

"In anonymous broadcast encryption, a ciphertext hides both the message and the set of recipients. ... Kiayias–Samari lower bound forces the ciphertext to grow linearly with the number of recipients. ... The bounded universe is the setting where anonymous broadcast becomes concise, even asymptotically optimal ... Far from a mere restriction, it is the building block for anamorphic communication against a dictator ... DPPY is, however, secret-key anamorphic encryption ... a public-key variant does not suffice against a strong adversary, since a per-recipient public key lets a dictator ask for the matching secret key. This motivates hiding identities directly, with no recipient public key published, leading to identity-based anonymous broadcast in the bounded model ... projective sampling (Ling, Phan, Stehlé and Steinfeld, LPSS, CRYPTO '14), the tool underlying concise anonymous broadcast encryption, offers no key extraction: private keys cannot be produced from a projected key fixed in advance. We introduce trapdoor projective sampling that reverses ..."

Why this matters for Nym / Katzenpost / Sphinx Packet Format: bounded-universe anonymous broadcast is the cryptographic primitive that turns loopix's "send SURB to a node, get reply" into "send to N rotating receivers, the dictator learns nothing about which subset". The same machinery would let a Nym-style mixnet offer bounded-anonymity-set ephemeral channels.

ePrint 2026/2369 (Oct 6) — StOMR: Stateful Oblivious Message Retrieval

"Oblivious Message Retrieval (OMR) enables recipients to retrieve messages from an untrusted server without revealing which messages correspond to them ... Existing constructions are inherently built in the public-key setting and use Fully Homomorphic Encryption (FHE) to allow a detector to scan a public bulletin board and produce a compact encrypted digest ... sender-published signals are large (hundreds of kilobytes), leading to significant bandwidth, storage, and on-chain costs. In this work, we explore the efficiency gains achievable by moving to a private, stateful setting, and introduce stateful OMR, a new model in which senders and receivers maintain lightweight private state to enable more efficient anonymous communication. Based on this model, we design StOMR, a protocol that significantly reduces the size of sender signals compared to prior approaches. To support the required shared state, we further introduce an OMR Key Encapsulation Mechanism (OMR-KEM), which allows users to privately establish shared state and instantiate stateful OMR without out-of-band channels. We implement StOMR in C++ and evaluate it against the state-of-the-art systems PerfOMR (USENIX Security '24), SophOMR (USENIX Security '25) ..."

The OMR-KEM primitive is independent of the mixnet framing; what's interesting here is the stateful shift: senders and receivers carry state, sender signals drop to compact. For Nym's SURB reply chain, the stateful OMR pattern would be a layer below the SURB — a noise floor below which the reply becomes a pull, not a push.

ePrint 2026/2385 (Oct 6) — SkrrtPIR: Doubly-Stateless Batch PIR from Single-Key RLWE Unpacking

"Batch Private Information Retrieval (Batch PIR) allows a client to privately retrieve multiple entries from a public database while amortizing query costs. However, concretely efficient schemes typically rely on per-client server state, such as client-specific evaluation keys ... we initiate the study of doubly-stateless Batch PIR, where the server stores no per-client state and the client maintains no database-dependent hint. ... The core technical ingredient is a single-key RLWE unpacking procedure that replaces the traditional tree-based approach, which requires logarithmically many Galois keys, with a linear walk over a cyclic Galois subgroup requiring only a single Galois key."

The doubly-stateless requirement is exactly what NymHS would want for a mixnet-resident PIR layer — the PIR server has no incentive to keep per-client state, and the client can roam across Nym exit gateways without re-issuing evaluation keys.

ePrint 2026/2397 (Oct 7) — Hashing Beats Trees: Practical Oblivious Dictionaries in SGX

"Oblivious RAM (ORAM) is a powerful cryptographic primitive that hides both the contents of outsourced data and the access pattern ... we show this trade-off [over Path ORAM tree traversal at Θ(log n)] to be suboptimal ... With low position map cost, probabilistic hash tables prevail as dictionary data structures due to their small, constant number of accesses compared to Θ(log n) path traversal ... We implement and analyze oblivious, probabilistic hash tables over Path ORAM, including several different strategies: chaining, power-of-two-choices, stash-less cuckoo, and de-amortized cuckoo hashing. Execution of these algorithms within a secure enclave requires 'double obliviousness', which in turn needs strict concrete maximum cost limits for each access ..."

The mixnet angle: this is the ORAM dictionary that an SGX-backed Sphinx routing-table lookup needs — and Nym's sphinx 0.8.0 + sphinx 0.8.0 V2 repliable messages (Oct 1) use a much smaller per-packet routing table on the gateway than the older Sphinx chain. ORAM dictionaries inside the SGX enclave let the routing table be credential-isolated from the mixnet operator's view of which key just looked up which destination.

Standing-Watch Items — Tickled / Closed / Still Open

From Mix Networks Friday — October 02 2026 Weekly Update's "Open Questions" section:

Plus three prior-cycle standing watches:

• Nym Directory Contract rollout — now augmented by NMv3 (Network Monitor v3) build-out Oct 7–8: the "Directory Contract → Geolocator → NMv3" triple is the third leg; the corporate directory HTTP service still operates in parallel.
• Nym integration wave — no new Zcash/Peach/Edge-tier integrations announced in window; v2026.13.0 configuration profiles (Safest/Most Private/Fastest/Random) become the user-facing knob that any integration will inherit.
• Cao & Green reputation-framing attacks — not addressed by NMv3 liveness, but the per-kind scheduling (#7095) is the exact lever that makes per-kind reputation isolation possible. Cao & Green attacked the MEASUREMENT layer, not the directory.

The Banner Story (in One Paragraph)

Three independent hardening waves land in the same 7-day window, plus the I2P 2.14.0-rc staging opens the late-October release window. Katzenpost ships the largest single PR in project history (#1206, 44 branches, dirauth fixes and consensus reliability) on Oct 7, plus two adjacent security PRs (#1213 and #1214) in the next 24 hours; the cluster wipes dropped secrets, bounds topology layers, prevents late-vote SRV grinding, and pins peer slots to pinned authorities. NymVPN ships three betas in seven days (v2026.13.0-beta.1/.2/.3, Oct 2 / 7 / 8) pre-staging the credential-issuer key rotation blogged Sep 24, with each successive beta tightening the credential-rotation-aware code paths (only-both-passes-connect, cached-gateway-list-on-refetch, in-flight-location-lookup kept across reconnect). HOPR ships the GNO-805 channel-balance incident trilogy (##8485, ##8487, ##8486) merged Oct 6–7, closing a routing-graph-vs-chain-event consistency bug plus the transport edge fall-out, plus a PIX-decoupling breaking-change fix that makes the prior surface-area code merge-able. I2P pre-stages 2.14.0 via the -8-rc tag on Oct 5 — the roadmap's "late October 2026" target is on schedule. And the ePrint week brings four in-window papers spanning trapdoor-projective-sampling for bounded-universe anonymous broadcast, stateful OMR with OMR-KEM, doubly-stateless Batch PIR with single-key RLWE unpacking, and a hashing-beats-trees ORAM dictionary for SGX enclaves. The convergence vector is measurable hardening in weekly cadence, not a single protocol celebration.