Every message travels through three relays: an entry relay, a transit relay and the recipient’s mailbox relay. The sender’s client chooses the route and wraps the message in one layer of encryption for each relay, so that each relay can remove only its own layer and learn only where to send the message next.
Choosing a route
- A client keeps the same entry relay for sixty days, unless it becomes unreachable. Changing entry relays often would give a hostile relay more chances to be chosen.
- Transit relays are chosen afresh for every message, weighted by their measured capacity.
- The mailbox relay is the one that holds the recipient’s mailbox for the day.
- No two relays on a route may share an operator, a country or a /16 network block (a /32 block for IPv6). Relays on probation are chosen with one tenth of their normal weight.
Layered encryption
Routes use a fixed-size packet format derived from Sphinx. Each relay’s layer is encrypted to the relay’s current onion key, published in the directory and rotated every week. A relay that removes its layer sees only the address of the next hop and a packet of exactly the same size as the one it received, so it cannot tell how far along the route it is.
Mailbox addresses
A person’s mailbox address changes every day at midnight UTC. Each address is derived from a secret shared only with that person’s contacts, so a contact can work out today’s address but a relay cannot link one day’s address to the next.
mailbox = HMAC-SHA-256(mailbox_secret, "Glossia 4.0 mailbox" || utc_date)Cover traffic and delivery delay
Clients MAY send cover traffic: dummy messages, indistinguishable from real ones, sent at random intervals to random mailboxes that no one collects. Clients MAY also hold each message for a random delay of up to ninety seconds before sending it. Both are off by default because they cost battery and data. Both are recommended for people who believe they are being watched closely, and both can be turned on in any reference client.