The protocol that hides the metadata.
Zero Protocol is a hybrid VPN and selective Sphinx mixnet. A VPN encrypts what you send — Zero Protocol also erases the timing, size, and routing patterns that identify you.
- Active Nodes
- 0
- Circuits
- 0
- Packets / sec
- 0
- Hidden Services
- 0
Six defenses, layered.
Sphinx Routing
Multi-layer encrypted packet routing with per-hop re-randomized headers. Each relay peels one layer using X25519 ECDH + ChaCha20 keystream — knowing only the previous and next hop.
Selective Mixnet
At L3/L4, packets are Poisson-delayed (λ=40ms) and shuffled across two mix hops. Up to 3 parallel circuits per client; cover traffic fills idle gaps with RELAY_COVER=0x07 cells.
Hidden Services
Publish services without revealing IP addresses via a 10-step INTRODUCE1→RENDEZVOUS2 protocol. Vanguard nodes (L2=4, L3=8) prevent circuit-correlation attacks.
Post-Quantum Crypto
PQ Sphinx V2: ML-KEM-768 (FIPS 203) hybrid with X25519. Attacker must break both simultaneously. 1184 B encapsulation key, 1088 B ciphertext, per-hop trial decapsulation.
Cover Traffic
Continuous RELAY_COVER cells at L3/L4 keep volume constant. Loop cells (RELAY_LOOP=0x06) create realistic bidirectional patterns. Replay window: 65,536 entries, ~4 MB.
Decentralised DNS
The .zero TLD is backed by Kademlia DHT (K=8, α=3, REPLICATION_K=16). Records are Ed25519 self-certified — DHT storage nodes cannot forge them. No central directory.
Four privacy levels.
Choose the right tradeoff between speed and anonymity. L3 is the default — 4 hops, cover traffic, and TLS morphing.
| Level | Name | Route | Hops | Cover Traffic | Transport | Use Case |
|---|---|---|---|---|---|---|
| L1 | Direct Encrypted | Client → Exit | 1 | — | Raw | Max speed |
| L2 | Multi-hop VPN | Client → Guard → Relay → Exit | 3 | — | Obfs4-Lite XOR | ISP-resistant |
| L3 | Selective Mixnet | Client → Guard → Mix → Mix → Exit | 4 | Poisson 40 ms | TLS 1.3 morph | High privacy (default) |
| L4 | Full Mixnet | Client → Mix → Mix → Mix → Exit | 4 | Poisson 40 ms | TLS 1.3 morph | Maximum anonymity |
L3/L4 build 3 parallel circuits (multipath) and assign flows round-robin. Max mix delay: L3=50ms, L4=400ms.
Every primitive chosen for a reason.
Post-quantum KEM per hop (PQ Sphinx V2)
Sphinx ECDH, HS circuit sessions
Beta routing layer keystream (sphinx.rs)
Payload AEAD, key-at-rest, HS sessions
KDF tree: 5 labels, keyed header MAC
Node ads, DHT, HS identity, release signing
Node key wrapping at rest (m=64MiB, t=3)
IPC token + key wrapping on Windows
Anonymity is a network effect.
Be part of the noise.
Explore the live global topology, trace packet routes through the mix network, and see how privacy is preserved end-to-end across every hop.