~/junctus — an open-source, post-quantum anonymity layer
Junctus encrypts each flow, slices it into k-of-n shares, and sends every share down its own onion-wrapped, timing-mixed path. Any single relay — any group smaller than k — only ever sees a meaningless fragment.
A classic VPN asks you to trust one company. Onion routing asks you to trust that a handful of relays never collude. Junctus is built so there is nothing worth seizing: a flow is encrypted, sliced into n shares of which any k reconstruct it — and the shares never travel together.
Every request gets a fresh route and a fresh exit. Timing is mixed against a global observer. Handshakes and onion packets are post-quantum from day one — recorded traffic stays sealed even against a future quantum adversary. And this is no longer a diagram: the network runs end to end, from zero-config discovery to live multi-hop circuits whose responses no middle relay can read.
Where the overlay must touch the open web, responsibility is diffused — rotated per request, and split across a threshold committee so that no minority of members learns anything at all. The engine is neo, one open Rust core shared by every platform. The claims are tested, the limits are documented, and nothing here asks for your trust where a proof — or an honest caveat — will do.
This is the entire per-flow pipeline, exactly as it runs in the engine. Reassembly is the reverse: collect at least k authentic shares, decode, decrypt.
Discovery — a Kademlia DHT over libp2p, hardened with self-certifying signed records and witnessed snapshots, bootstrapped through signed DNS-over-HTTPS records — only ever finds peers. It never carries user data, and it always runs behind the obfuscating transport.
All ten have running, tested code — including the four that were research-grade a season ago. Where a hard boundary remains, the card says so, because a roadmap is not a feature.
The core mechanism. Flows are encrypted, then split k-of-n across mutually disjoint multi-hop paths. Colluding relays below the threshold learn nothing, and a corrupted share is detected, attributed, and routed around — properties asserted by tests, not prose.
Sphinx onions travel sockets between separate processes, and a circuit stays open to carry a real TCP byte stream both ways, onion-layered per cell. Only the exit sees the payload; tampering, replay, or reordering anywhere is caught at the endpoint; and no middle relay can read the response.
No two requests share a full path; concurrent routes share no hop — not even the exit; exits rotate and never immediately repeat. There is no stable circuit to watch.
Exponential per-packet delays and Poisson cover traffic, scaled by the privacy dial — and since the third review, cover and real frames travel as length-identical fixed-size cells, so an observer watching every link at once cannot split them apart.
Hybrid X25519 + ML-KEM-768 key-confirmed handshakes and Sphinx onion packets, Ed25519-signed identities. “Harvest now, decrypt later” harvests ciphertext that stays ciphertext.
Signed peer records whose id must equal the hash of their keys; witness-signed relay snapshots any untrusted mirror can serve; a DHT clients never appear in — bootstrapped over signed DNS-over-HTTPS records that rotate without a client rebuild.
A commit-then-VRF handshake: the client commits before seeing any randomness, and the beacon’s VRF has exactly one possible output — so neither side can bias the path, and anyone can verify the result. Aborting and retrying buys no bias either: commitments are bound to an epoch and a counter.
Privacy-Pass-style VOPRF tokens: the issuer blind-signs a serial it never sees, so earning and spending cannot be linked. Issuance is gated on proven, receipt-backed relay work; receipts are capped and expire; and double-spend logs are epoch-scoped so a key rotation cannot resurrect old serials.
The flagship, and it now runs: a real two-party MPC-TLS stack computes the whole ChaCha20-Poly1305 record and SHA-256 key schedule under 2PC — oblivious-transfer extension, garbled circuits verified against their KATs — so the record key, keystream, and plaintext are never assembled at any one party. Today’s gadgets are honest-but-curious by design; malicious-secure garbling and live wiring to a real socket are the remaining, scoped steps.
Two-server PIR fetches a relay by node id without either server learning which. A zero-knowledge shuffle argument lets a mix prove it permuted honestly without revealing the permutation — binding it into the live mix is the step ahead.
A threat model is a table, not a slogan. Every row names what an adversary can do, what Junctus does about it — and the limit we will not hide from you.
| Adversary | What they can do | What Junctus does | The honest limit |
|---|---|---|---|
| Your ISP | Sees your link, runs deep packet inspection | Everything encrypted; the transport mimics mainstream TLS/QUIC | Traffic volume is still observable |
| An on-path censor | Blocks by IP, SNI, or protocol; probes actively | Signed DoH rendezvous, an obfuscation ladder, and a REALITY-style authenticated flight — a prober only ever sees a decoy | Camouflage mimics QUIC/WebRTC shape, not yet their full protocol crypto |
| Colluding relays | Run several nodes on your path | k-of-n slicing — fewer than k shares reveal nothing — plus onion layering | Collusion ≥ k across one request’s paths degrades it |
| A global observer | Watches every link at once, correlates timing | Cover traffic and Poisson timing mixing | Costs latency and bandwidth; imperfect at small scale |
| A malicious exit | Inspects or tampers with clearnet traffic | Fresh per-request exits; a committee that computes the TLS session under two-party MPC, so no member holds the key or the plaintext | Plaintext to a clearnet site is inherently visible to some egress |
| A Sybil attacker | Floods fake nodes to map or deanonymize | Bandwidth credits make identities costly; VRF paths resist herding | An open problem; residual risk while the network is young |
| A quantum adversary | Records today, decrypts later | PQ-hybrid handshakes and onion packets from day one | Rests on the assumptions of the PQ primitives |
Several rows are asserted by adversary-simulation tests in CI today: colluding relays below the threshold learn nothing; a single relay learns only its next hop, and a tampered payload avalanches instead of carrying a signal; an on-path observer sees only ciphertext; forged discovery data is rejected outright; and no committee minority can open a request. Explicit non-goals for v1: censors who accept large collateral damage, hiding from the destination that a connection happened, compromised endpoints, and formal anonymity bounds. And the table is not just defended — it has been attacked directly, by us. That story is next.
Three rounds of adversarial review: first the handshake, the onion layer, the novel core, and the discovery plane — then everything that had grown since — and, most recently, the newest surface of all: the two-party MPC-TLS stack, the REALITY probe-resistant transport, persistent circuit tunnels, the credit economy, and the seed, mix, and camouflage layers around them. Findings cite file and line; the worst were proven with working exploits against the real code. Every finding from all three rounds is closed — fixed in code with a regression test standing guard, or, where the defect was an overclaimed doc, by correcting the claim itself.
The third round was the harshest by design: fifty-seven findings against code no review had ever touched, from a probe-resistance authenticator forgeable with a degenerate curve point to a credit mint wired to nothing. All fifty-seven are closed. Findings that looked severe but did not survive adversarial re-verification were downgraded and the reasoning recorded — a plausible-but-wrong finding is treated as a defect of the review, not a win. And the supply chain is now guarded too: any RustSec advisory in the dependency tree fails CI. An internal review is still not an audit: the external gate stands.
Strong anonymity, low latency, low overhead — pick two. That trilemma is mathematics, not marketing, so Junctus surfaces it as a control instead of pretending it away.
The anonymity trilemma: strong anonymity, low latency, low overhead — pick two. The dial decides which two. There is no fourth option, here or anywhere.
“A sane default: moderate mixing and cover traffic.”
Every privacy tool has limits. Most bury them. Ours are part of the specification, kept next to the features and versioned with the code.
Junctus deliberately pays a latency and bandwidth tax for anonymity. If a network promises you all three, it is lying about at least one.
Inside the overlay it holds fully — no relay ever reassembles a flow. Toward the open web it is diffused and rotated per request, and split across a threshold committee at the strongest setting: reduced, never zero, because some machine must speak to the destination.
Slicing and mixing hide you in a crowd. Until the crowd grows, the anonymity set is small — and we say so, rather than round it up.
Bandwidth credits make fake identities expensive, not impossible — and today’s proof-of-relay receipts are client-attested, not a trustless measurement. Bootstrap may require a seed set. This remains an open research problem everywhere.
Mobile devices throttle the dial on battery and cellular, and are never mandatory relays or committee members.
Three rounds of internal adversarial review found real breaks — five of them critical — and every finding is fixed. But that is not the external security and cryptography audit that gates real-world use. Until that audit: experiment, contribute, poke holes — do not bet your freedom on it.
Everything below with a filled marker has running, tested code — the core, the frontier that was research a season ago, and a hardening tier driven by our own attack on the system. What remains is listed just as plainly.
The protocol lives in a shared Rust core; the platforms are thin shells around it. Phones join the network on their own terms — never as mandatory relays.
NEPacketTunnelProvider) claims the default route and gives every intercepted TCP flow its own fresh multi-hop onion circuit to its destination — relay snapshots witness-verified before use, one identity shared with the CLI. Builds from source today; not yet notarized for distribution.xcframework, tunneling through NEPacketTunnelProvider.cargo-ndk, tunneling through VpnService.neo-crypto to neo-verify. AGPL-3.0. No forks of trust.# one Rust workspace, fifteen crates $ git clone https://github.com/junctus/neo $ cd neo && cargo build --release # a discovery seed — serves no user traffic $ neo seed --witness witness.key # relays that register and forward onions $ neo run --relay --listen 127.0.0.1:9001 $ neo run --relay --listen 127.0.0.1:9002 # only the exit can read it $ neo send --message "hello" --hops 2