Can a Consent-Gated Onion Relay Actually Hide Who Talks to Whom?

Onion routing systems like Tor let anyone run a relay. But what if relays could consent to each circuit they carry — an in-band, cryptographically signed accept-or-reject handshake? Would that help privacy, hurt it, or make no difference? We built one, measured it, and committed to reporting whatever the data showed — including the nulls.

What We Built (and What It Isn't)

We designed a consent-gated, federated, nested-SSH onion relay — not as a product or an anonymity service, but as a measurement instrument for defensive security research. The purpose was to have a controlled data plane whose knobs (bridge on/off, cover padding, federation topology) let us precisely measure how a consent gate reshapes an adversary's view of network traffic.

Every relay hop must explicitly accept or reject each circuit through an Ed25519-signed in-band handshake. Per-hop credentials are X25519-sealed to the host's public key. Relays are organized into houses — a "house" is one independent Hack House instance (a self-contained chat-relay deployment with its own pool of relay nodes and its own keys), not a physical building. Federating houses links two or more of these separate instances so their relay pools combine into one larger shared crowd, with each circuit spanning ≥2 houses so no single house sees a whole path — either through a shared bridge node (it blind-forwards encrypted bytes and holds no chat key for either house) or a signed directory of node identities. The entire data plane is built into an existing zero-knowledge chat relay (Hack House), running in an isolated worktree. In this lab study the houses were logical groupings on our grid — house-A, house-B, and house-C were each a pool of relay containers on the one laptop, and every forwarding hop was a laptop container.

Containment and provenance

Every forwarder ran as an isolated Docker container on a single engine host (the laptop); node distinctness is container-level. All stochastic behavior derives from a single --sor-seed; the seed, git SHA, and node-role-to-device mapping are echoed into an immutable manifest.json, and every relay event is appended to a SHA-256-sealed events.jsonl.

The Method: Pre-Registered, Frozen, Audited

This wasn't exploratory data mining. The study was a confirmatory factorial controlled comparison: the design, variables, seeds, detectors, and analysis were frozen and hashed before any confirmatory cell ran. Every detector was calibrated only on synthetic fixtures — known-linked/known-unlinked control pairs and equiprobable-sender sets — before touching real data.

This staged discipline isn't ad hoc — the whole study was designed, pre-registered, and executed under the Interpretable Context Methodology (ICM), a framework in which each phase (literature → hypothesis → design/pre-registration → build → execution → analysis → write-up) is a numbered stage whose frozen output is the sole input to the next. ICM is the structural reason the pre-registration could be SHA-256-sealed in the design stage before the build and execution stages were allowed to consume it: the provenance chain is auditable by construction rather than by convention.

Scale: 30 independent seeded runs per cell, 50 circuits per run, yielding 9,000 confirmatory circuits, 27,000 per-hop packet captures, and 36,361 SHA-256-sealed artifacts — fully seed-reproducible.

Stopping rule: All cells ran to completion. No optional stopping, no interim looks. An uninformative cell is reported inconclusive, never extended to chase significance.

The Two Questions We Asked

RQ1: Does the shared bridge leak who's talking to whom?

When federated houses route through one shared bridge node, that node observes both the entry and exit segments of circuits crossing it. Modern flow-correlation attacks can link such segments from timing and volume alone. We asked: does our bridge exhibit a measurable entry-to-exit correlation leak? And if so, does cover padding close it?

RQ2: Does federation grow or shrink the anonymity set?

Intuitively, federating relay houses should enlarge the candidate-sender set an adversary faces. But a consent gate means only willing relays carry traffic. If willingness concentrates, circuits funnel through fewer paths and the effective anonymity set could shrink. We treated the sign of the federation effect as unknown and committed to reporting a shrink with equal prominence.

The funnelling mechanism test (RQ2-P3, Spearman correlation between bridge concentration and per-circuit entropy) was inconclusive: the instrument assigns a fresh willing bridge per circuit seed, so the concentration covariate has no variance and Spearman is undefined. The mechanism is not testable on this instrument as built — an honest limitation, not evidence against funnelling.

RQ3: Can a Local AI Agent Beat Random Selection?

We also tested whether a $0 local qwen2.5:3b model could act as a churn-resilient relay selector — picking smarter paths when relays drop in and out. The answer was no: a double-null result with no throughput gain over static/random baselines, and a rebuild fingerprint not excluded at AUC 0.59. We report it plainly.

The Full Scorecard

Seven pre-registered tests, Holm-Bonferroni-corrected across the full confirmatory family. Three survived correction:

* RQ1-P1 rejects H₀: AUC = 0.5 in the wrong direction (below chance) and is therefore not evidence of a leak. It survives Holm as a statistical rejection but carries the opposite substantive meaning.

What This Means

The headline is a double null/negative, and that's fine. The two motivating hypotheses — that a shared bridge leaks linkability and that federation grows anonymity — are both unsupported on this instrument. The one significant directional effect (RQ2-P1) points against the design's motivation: federation shrinks the anonymity set.

Honest scope

All hops ran as isolated Docker containers on a single engine host (a laptop); node distinctness is container-level. This is not internet-scale, not a global-passive-adversary result. The claims are deliberately scoped to the tested lab topology and scale. Cross-machine effects, stronger adversaries, larger federations — and real multi-device distribution — are out of scope and named as future work. (For completeness: the grid inventory also lists two phones pinned as non-forwarding consenting-node labels; they hosted no engine and carried no measured traffic, so they are not part of any result.)

Reproducibility

The entire battery is seed-reproducible. One base seed (S0 = 20260719), per-cell seeds derived via SHA-256, 10,000 BCa bootstrap resamples, all sealed and checksummed. The frozen pre-registration hash is f22331a..., unedited. Any researcher can re-derive the results from the same seed.

Why We Publish This

Defensive security research often stays behind closed doors, especially when the results don't confirm the hypothesis. We're publishing because:

• Nulls are results. Knowing that a shared bridge doesn't measurably leak at lab scale is useful. Knowing that federation can shrink anonymity is important.
• Pre-registration works. Committing to the analysis before seeing the data prevented us from p-hacking our way to a more flattering story.
• Transparency builds trust. We seal artifacts, hash pre-registrations, and report the numbers as they came out. This is how OptinAmpOut does research.