Glossary

Authenticated Encryption with Associated Data. Modern symmetric mode (AES-GCM, ChaCha20-Poly1305) that combines confidentiality and integrity in one primitive.

Standard cryptographic example names. Alice and Bob are honest parties; Eve is a passive eavesdropper; Mallory is an active attacker.

The possible subjects an observer cannot distinguish as responsible for an action, such as sending a message. The set depends on the observer's information and can change over time; it is not automatically every user of a network. See Pfitzmann and Hansen's terminology paper.

Cryptographic proof of the identity, configuration, and code hash of a piece of software running inside a TEE. Anchored in the hardware vendor's signing keys (Intel DCAP, AMD KDS, NVIDIA NRAS). See Attestation-Architecture.

A TLS connection where the server's keypair is generated inside an enclave and the attestation report is bound to the TLS certificate (or pinned in a Channel Binding). Lets a client verify it is talking to specific code on specific hardware, not just any holder of the cert.

Pairing-based signature scheme that supports selective disclosure of attributes and zero-knowledge proofs of possession. Foundation of W3C Verifiable Credentials with privacy.

Phone-only Bluetooth-LE mesh messenger from Permissionlesstech, with a Nostr fallback for global reach. Up to seven hops over BLE, Noise-encrypted, no accounts. Geohash-based location channels on the Nostr side. See Bitchat.

Cryptographic technique where a signer signs a message it cannot read. Used by Chaumian eCash, Cashu, and parts of mixnet payment schemes.

A Tor relay omitted from the public relay directory, providing an alternative entry when known relays are blocked. See pluggable transports and bridges and Tor's relay guide.

Short, non-interactive zero-knowledge range proofs that need no trusted setup. Used in Monero (transaction amounts) and various confidential-transaction protocols.

A protocol for carrying application data across networks with intermittent connectivity. Version 7 is specified in RFC 9171; custody transfer is outside its base protocol. See delay-tolerant networking.

Pattern that lets ENS resolvers serve names from off-chain backends with cryptographic proofs.

Bearer token system using blind signatures (Chaum, 1983). Modern implementations: Cashu (Bitcoin/Lightning), GNU Taler.

CNCF project bringing confidential computing to Kubernetes via Kata plus TEE-backed VMs and a Trustee KBS. See Confidential-Containers.

Hardware-backed protection of data during computation, complementing at-rest and in-transit encryption.

Identifying data by an identifier derived from its contents rather than its server location. In IPFS, changing content changes its CID; the identifier does not itself keep a copy available. IPFS content addressing.

Dummy packets sent on a schedule to hide whether real traffic is flowing. Core to mixnet metadata defense.

Property of mix networks where each hop re-encrypts (or re-blinds) the packet so the bit pattern changes between links.

A maintained record of where systems depend on cryptography and which implementations, owners and suppliers must participate in a migration. See the inventory workflow and CISA, NSA and NIST guidance.

Intel's open attestation infrastructure for SGX/TDX, replacing the EPID-based Attestation Service for production use.

Storage architecture where integrity, persistence, or retrieval is distributed across independent operators rather than a single cloud account. Includes content-addressed systems (IPFS), paid storage markets (Filecoin, Sia), archival networks (Arweave), and app-specific blob layers (Blossom).

Inspection of network traffic to recognise protocols from packet contents or patterns, including when the carried data is encrypted. Censors can use it to identify and block tunnels. See WireGuard and Psiphon's protocol explanation.

Key-value store spread across many nodes (Kademlia, Mainline). Used for peer discovery, BitTorrent trackers, PKARR record storage.

W3C URI scheme did:method:id resolving to a DID Document with public keys and service endpoints. Methods: did:key, did:web, did:ion, did:plc, did:peer, did:ens.

Per-message key rotation algorithm in Signal/MLS that combines a Diffie-Hellman ratchet with a symmetric KDF chain to deliver forward secrecy and post-compromise security.

Networking architecture (RFC 4838) for intermittent or high-latency links. Uses store-carry-forward bundles. Used in mesh, satellite, and disconnected operation.

EdDSA signature scheme over Curve25519. Compact, fast, deterministic; widely used in Tor v3, SSH, age, Pubky/PKARR, Yggdrasil, MLS BasicCredentials. Note: Nostr uses Schnorr over secp256k1 (BIP-340), not Ed25519.

Ethereum account-abstraction proposals enabling smart-contract behavior on EOAs and bundled UserOps respectively.

Hardware-isolated region of memory and execution; the umbrella term for SGX enclaves, SEV-SNP VMs, TDX TDs, and similar.

Encoding data into N shares so that any k valid shares can reconstruct it. Tahoe-LAFS uses this to tolerate missing shares; availability still depends on share placement and retention. Architecture.

Encryption that supports arbitrary computation on ciphertexts. See Overview - Fully Homomorphic Encryption.

Ethereum-compatible EVM that operates on FHE ciphertexts. Zama's flagship.

Free Internetworking Peering System. Mesh routing protocol that uses Nostr secp256k1 keypairs as native node identities. Multi-transport (UDP, TCP, Ethernet, Tor, BLE), Noise-encrypted hop-to-hop and end-to-end. See FIPS.

Property where compromising long-term keys does not compromise past session keys. Achieved via ephemeral DH (TLS 1.3, Signal X3DH/PQXDH).

Flexible Round-Optimized Schnorr Threshold signatures (Komlo & Goldberg 2020; standardized as RFC 9591 in 2024). Used for threshold Bitcoin/Nostr key custody.

I2P's variant of onion routing where one packet ("garlic clove bundle") may contain multiple inner messages with different destinations.

Hierarchical encoding of geographic coordinates as a base32 string where shorter prefixes denote larger areas. Used by Bitchat location channels; precision selects neighborhood, city, or region scope.

Privacy-preserving petname-based hierarchical naming, RFC 9498.

Pairing-based zk-SNARK with constant-size proofs (~128-200 bytes depending on curve: 2×G1 + 1×G2 over BN254 / BLS12-381) and per-circuit trusted setup. Used by Zcash Sapling, Tornado Cash, Semaphore.

Quantum search algorithm giving a √N speedup over classical brute force. Effectively halves symmetric key strength. AES-256 retains a 128-bit security margin against it.

PLONK-family proof system from Electric Coin Co.; recursive composition without a fresh trusted setup per circuit. Used in Zcash Orchard.

Blockchain-based replacement for the DNS root zone, with permissionless TLD ownership.

Adversary records encrypted traffic today expecting to decrypt it once a quantum computer exists. The motivation for migrating long-secrecy traffic to post-quantum KEMs now.

Composition of a classical KEM (such as X25519) and a post-quantum KEM (such as ML-KEM-768) where the shared secret is the KDF of both halves. Currently deployed in TLS 1.3, SSH, Signal PQXDH, iMessage PQ3.

Anonymous overlay network using garlic routing and unidirectional tunnels.

Internet Engineering Task Force; the body that publishes RFCs.

DIF DID method anchored on Bitcoin via Sidetree (a Layer-2 ledger).

Content Identifier used by IPFS to name data by cryptographic hash plus codec metadata. A CID proves byte integrity, while availability depends on pinning or storage deals.

DHT algorithm using XOR distance for routing. The basis of Mainline DHT, IPFS, libp2p Kad-DHT.

Component in CoCo Trustee that releases secrets to enclaves only on a valid attestation.

AMD's attestation backend: serves VCEK / VLEK certificates that endorse SEV-SNP attestation reports.

Primitive that produces an encapsulated symmetric key for a recipient public key. Replaces Diffie-Hellman in post-quantum protocols.

Third-party holding of decryption keys. Contradicts sovereignty; historically pushed by states (Clipper chip).

Hardness assumptions based on lattice problems (LWE, Ring-LWE, Module-LWE, NTRU). Foundation of FHE and most NIST PQC KEM/signature standards (ML-KEM, ML-DSA, FN-DSA); SLH-DSA is the hash-based exception.

Layer 2 Bitcoin protocol of bidirectional payment channels with hash-time-locked routed payments. See Lightning Network Deep Dive.

Continuous-time mix network design (Piotrowska et al., 2017): Poisson-mixing with cover traffic. Foundation of Nym and Katzenpost.

Low-power long-range radio modulation (sub-GHz ISM bands) used by Meshtastic, MeshCore and other off-grid networks.

Lattice problem on which most modern lattice crypto rests.

The BitTorrent DHT, around 10 million nodes worldwide. Used by PKARR/Pubky for record publication.

Specification for using MLS (RFC 9420) over Nostr's identity and relay infrastructure for forward-secret, post-compromise-secure, scalable group messaging. KeyPackages (kind 30443), gift-wrapped Welcomes (kind 444 inside 1059), encrypted group events (kind 445). See Marmot Protocol.

Standard for mobile credentials with selective disclosure. Deployed in several US states and the EU Digital Wallet.

Value extracted from transaction ordering by validators, builders, and searchers. Originally "Miner Extractable Value"; renamed in 2022 to cover non-miner extractors.

Network that batches, reorders, and re-encrypts traffic across multiple hops to hide who-talks-to-whom from a global observer. See Overview - Mix Networks.

Module-LWE signature scheme based on Dilithium. Replaces ECDSA / RSA-PSS for post-quantum signatures.

Module-LWE key encapsulation based on Kyber. Replaces ECDH / RSA-KEM for post-quantum key exchange.

IETF standard for group E2EE with continuous group key agreement (TreeKEM). Used in Wire and Cisco Webex; Matrix MLS profile in development.

Cryptographic primitive where parties jointly compute a function over their private inputs without revealing them. Honest-majority and dishonest-majority variants exist.

SGX measurements: hash of the enclave's initial code/data (MRENCLAVE) and the signing identity (MRSIGNER). Used in attestation policies.

Earliest functional blockchain naming system (2011), merged-mined with Bitcoin. .bit TLD.

Nostr Implementation Possibilities. NIP-05: human-readable user@domain identifiers via .well-known/nostr.json; NIP-44: versioned DM payload format (ChaCha20 + HMAC-SHA256, conversation key from secp256k1 ECDH); NIP-17: gift-wrapped DMs with metadata protection (combines NIP-44 and NIP-59).

Notes and Other Stuff Transmitted by Relays. Pubkey-rooted social protocol; events signed by Schnorr signatures over secp256k1 (BIP-340), served by relays. See Nostr and Nostr Deep Dive.

Attestation backend for H100/H200/Blackwell confidential computing.

Adding restrictions to an authorization token without contacting its issuer. Biscuit uses signed blocks and scoped policy checks so an appended block can reduce authority. See Biscuit and its introduction.

Layered encryption such that each relay can peel one layer revealing only the next hop. Tor is the canonical implementation.

Two-party protocol where the client gets f_k(x) without learning k and the server does not learn x. Used in PIR, password-authenticated key exchange, and private set intersection.

Technique that hides memory access patterns from an observer who can see which addresses are touched.

Logical network running on top of an existing underlay (Yggdrasil, cjdns, Tor, I2P).

Two-party CoinJoin variant where the receiver contributes inputs, breaking the common-input-ownership heuristic.

Apple's confidential AI inference platform (announced 2024). Combines Secure Enclave, code transparency log, and stateless attested servers.

Local nickname for a globally-unique cryptographic identifier (Stiegler's petname system; Zooko's triangle resolution).

Protecting IPFS data from garbage collection on a node. A pin is a local retention choice, not a guarantee that another node will keep the data or stay online. IPFS persistence documentation.

Protocol that lets a client retrieve record i from a database while the server learns nothing about i. See Overview - Private Information Retrieval.

Public-Key-Addressable Resource Records over Mainline DHT. Names are Ed25519 keys; records are signed and stored under the keyhash.

A transport layer that changes how a connection looks on the network to make blocking harder. Tor documents obfs4, Snowflake, meek and WebTunnel in its circumvention guide. Compare them in pluggable transports and bridges.

Recovery of confidentiality for future messages after an attacker loses access and honest participants introduce fresh secret key material. It does not repair an ongoing endpoint compromise or erase previously exposed messages. See RFC 9420.

Proof of Work / Proof of Stake. Sybil-resistance mechanisms for permissionless consensus.

Cryptography secure against polynomial-time quantum adversaries. See Overview - Post-Quantum Cryptography.

Post-quantum extended X3DH; the hybrid (X25519 + ML-KEM-1024) key agreement used by Signal since 2023.

Being identified by a pseudonym. Reusing it can link activities even when a personal name is unknown; separate pseudonyms can reduce linkage across contexts. See RFC 6973 and identity and pseudonymity.

PKARR-based identity and naming system from Synonym. Adds a homeserver data plane (HTTP-fetched signed user data) and pkdns for DNS bridging. Reference social app: Pubky.app. See Pubky.

A keying scheme that derives new keys irreversibly forward, providing forward secrecy. Symmetric ratchet: KDF chain. DH ratchet: Diffie-Hellman re-key per round-trip.

IETF working group and architecture (RFC 9334) for remote attestation. Defines the Attester / Verifier / Relying-Party roles used across CC ecosystems.

Markqvist's encrypted-by-default mesh networking stack with cryptographic destinations. Runs over LoRa, packet radio, TCP, serial. See Reticulum.

Anonymous contact-establishment protocol over the Katzenpost mixnet. Lets two parties find each other without prior knowledge of network addresses.

Variant of LWE on polynomial rings. Smaller keys and faster ops than plain LWE.

Linear, aggregatable signature scheme. Bitcoin Taproot uses Schnorr/BIP340.

Selective Disclosure JWT. JWT-based credential format where each claim is committed via a salted hash; the holder discloses the claims they choose by revealing the corresponding hash preimages. Standardized as RFC 9901 in November 2025.

AMD Secure Encrypted Virtualization with Secure Nested Paging. VM-level TEE with integrity protection. See TEE-Technologies-Deep-Dive.

Intel's per-process TEE (2015–). Powerful but punctuated by side-channel breaks; legacy for new workloads.

Format for fixed-size, layered-encrypted mixnet packets that hide path length and per-hop processing.

Scalable Transparent Argument of Knowledge. Hash-based, no trusted setup, post-quantum candidate; large proofs but fast verifier.

Hiding data within other data (messages in images, traffic shaped to look like benign traffic).

One participant presents multiple identities to gain influence that a system intended to distribute among independent participants. See Douceur's original paper and proof of personhood.

Measures that limit the influence one participant can gain through multiple identities. The assumption matters: Douceur's analysis examines identity certification and the limits of resource-based tests. A membership proof alone does not establish one identity per person.

Bitcoin upgrade (2021) introducing Schnorr signatures and MAST script trees; basis for sub-second-cost cooperative-spend privacy.

The set of hardware/firmware/software a security claim relies on. Smaller TCB means smaller attack surface. TCB versions appear in attestation reports.

Intel's VM-level TEE (2022–).

Hardware mechanism for isolated execution. Umbrella term covering SGX, TDX, SEV-SNP, Arm CCA, IBM SE.

Signature where any t of n parties can sign; fewer than t cannot. FROST (Schnorr), GG20 (ECDSA), Pedersen DKG.

Low-latency onion-routing anonymity network. Three-hop default circuits; v3 hidden services.

CoCo's KBS implementation; gates secret release on attestation policy.

Signed JSON-LD or JWT structure asserting claims about a subject. Issuer, Holder, Verifier model.

AMD chip-bound (VCEK) and platform-bound (VLEK) endorsement keys signed by KDS, used to verify SEV-SNP attestation reports.

FHE composed with a SNARK over the homomorphic circuit so the decryptor can verify the server computed the function honestly.

Modern VPN protocol; minimal cryptographic core (Curve25519, ChaCha20-Poly1305, BLAKE2s). Influences Yggdrasil, Tailscale, Mullvad.

Peer-attestation trust model: OpenPGP and Nostr social-graph variants. See Overview - Web of Trust.

Diffie-Hellman over Curve25519. Default ECDH primitive in TLS 1.3, Signal, WireGuard.

Extended Triple Diffie-Hellman key agreement (Signal, 2016). Replaced by PQXDH in production.

Encrypted IPv6 mesh overlay; routing by cryptographic identity.

Commercial FHE company; ships Concrete (TFHE) and fhEVM.

Prove a statement true without revealing why.

Zero-Knowledge Succinct Non-interactive ARgument of Knowledge.

Zero-Knowledge Scalable Transparent ARgument of Knowledge.

Hypothesis that names cannot be simultaneously human-meaningful, decentralized, and globally unique. Petnames plus cryptographic IDs (for example Pubky, ENS) are partial resolutions.