~/junctus neo — an open-source, post-quantum anonymity layer
Junctus neo anonymises your data by encrypting each flow, slicing it into k-of-n shares, and sending every share down its own onion-wrapped, timing-mixed path. Any single relay — any group smaller than k — only ever sees a meaningless fragment.
A classic VPN asks you to trust one company. Onion routing asks you to trust that a handful of relays never collude. Junctus is built so there is nothing worth seizing: a flow is encrypted, sliced into n shares of which any k reconstruct it — and the shares never travel together.
Every request gets a fresh route and a fresh exit. Timing is mixed against a global observer. Handshakes and onion packets are post-quantum from day one — recorded traffic stays sealed even against a future quantum adversary. The network runs end to end, from zero-config discovery to live multi-hop circuits whose responses no middle relay can read.
Where the overlay must touch the open web, responsibility is diffused — rotated per request, and at the strongest setting handed to a committee whose joint key no member holds: the response returns threshold-encrypted, and each member can prove it cannot read it. The engine is neo, one open Rust core shared by every platform. The claims are tested, the limits are documented, and nothing here asks for your trust where a proof — or an honest caveat — will do.
Every comparison table you have ever read was written by the vendor who wins it. So was this one — which is why it keeps the rows we lose. If a cell is wrong, open an issue; the table is versioned with the code.
No one in particular — fewer than k colluding relays, and any committee minority, learn nothing
Your guard and exit must not collude
One company, completely
A majority of mix operators
A meaningless fragment of one flow’s ciphertext
Connection metadata; a guard–exit pair can correlate you
Your identity and your entire traffic, in one place
One hop’s queue
k-of-n slices over disjoint onion paths — the shares never travel together
One circuit carries the whole flow
One tunnel carries everything
Per-packet routes, but each packet travels whole
Hybrid X25519 + ML-KEM handshakes and onion packets from day one
In progress
Varies by provider
Not yet
Poisson mixing and cover traffic, scaled by a dial
Explicitly out of scope
No defense
The founding feature
Fresh per request; at the strongest setting, a committee that provably cannot read the response
Long-lived exits see plaintext
The provider is the exit
Gateways see egress traffic
Probe-resistant authenticated flights + QUIC/DTLS camouflage — young
Bridges and pluggable transports, battle-tested
Widely blocked; obfuscation varies
Limited today
Young, a small anonymity set, external audit not yet delivered — the row we lose, stated plainly
Twenty-five years, millions of users, deeply studied
Mature, audited businesses
Growing, token-incentivized
No one in particular — fewer than k colluding relays, and any committee minority, learn nothing
Your guard and exit must not collude
One company, completely
A majority of mix operators
Generalizations, honestly made: “Tor” means the stock Tor Browser circuit model, “commercial VPNs” the typical one-hop provider (several now offer post-quantum tunnels), “mixnets” the Nym-style continuous-mix design. Each column’s best deployment is better than its worst row here.
This is the entire per-flow pipeline, exactly as it runs in the engine. Reassembly is the reverse: collect at least k authentic shares, decode, decrypt.
Discovery — a Kademlia DHT over libp2p, hardened with self-certifying signed records and witnessed snapshots, bootstrapped through signed DNS-over-HTTPS records — only ever finds peers. It never carries user data, and it always runs behind the obfuscating transport.
Eleven have running, tested code; a twelfth is experimental and labeled so. Where a hard boundary remains, the card says so, because a roadmap is not a feature.
The core mechanism. Flows are encrypted, then split k-of-n across mutually disjoint multi-hop paths. Colluding relays below the threshold learn nothing, and a corrupted share is detected, attributed, and routed around — properties asserted by tests, not prose.
Sphinx onions travel sockets between separate processes, and a circuit stays open to carry real traffic both ways — a TCP byte stream, UDP datagrams so DNS rides along, and now many independent streams multiplexed over one circuit with per-stream flow control — onion-layered per cell. Only the exit sees the payload; tampering, replay, or reordering anywhere is caught at the endpoint; and no middle relay can read the response.
No two requests share a full path; concurrent routes share no hop — not even the exit; exits rotate subnet, not just node, and never immediately repeat. No two hops of a circuit share a subnet where the network can avoid it. There is no stable circuit to watch.
Exponential per-packet delays and Poisson cover traffic, scaled by the privacy dial — and since the third review, cover and real frames travel as length-identical fixed-size cells, so an observer watching every link at once cannot split them apart.
Hybrid X25519 + ML-KEM-768 key-confirmed handshakes and Sphinx onion packets, Ed25519-signed identities. “Harvest now, decrypt later” harvests ciphertext that stays ciphertext.
Signed peer records whose id must equal the hash of their keys; witness-signed relay snapshots any untrusted mirror can serve; a DHT clients never appear in — bootstrapped over signed DNS-over-HTTPS records that rotate without a client rebuild. Snapshots sync as compact, witness-verifiable deltas: a tampered diff rebuilds to a body no signature matches and collapses to a full refetch.
A commit-then-VRF handshake: the client commits before seeing any randomness, and the beacon’s VRF has exactly one possible output — so neither side can bias the path, and anyone can verify the result. Aborting and retrying buys no bias either: commitments are bound to an epoch and a counter.
Privacy-Pass-style VOPRF tokens: the issuer blind-signs a serial it never sees, so earning and spending cannot be linked. Issuance is gated on proven, receipt-backed relay work; receipts are capped and expire; and double-spend logs are epoch-scoped so a key rotation cannot resurrect old serials.
The committee’s joint key is born dealer-less by distributed key generation — no party, not even the client, ever holds it. The exit threshold-encrypts the clearnet response and discards the plaintext; each hop seals its partial decryption; only the client can combine them. Every member can publish a DLEQ non-custody proof: even the exit cannot read the response. The honest boundary: this covers the response the committee returns to you — the outbound request is still spoken to the destination by an egress member, and for HTTPS your own end-to-end TLS keeps that ciphertext to yourself.
Two-server PIR fetches a relay by node id without either server learning which. A zero-knowledge shuffle argument lets a mix prove it permuted honestly without revealing the permutation — binding it into the live mix is the step ahead.
Joining the relay set costs: a NodeId-bound proof-of-work, a dial-back attestation of an address you actually control, per-subnet and per-ASN caps on what one network can list, and an optional seed-measured uptime gate no relay can forge. Honest scope: this prices out the cheap same-box flood — it does not solve Sybil, because nothing does yet.
An experimental, opt-in exit for when trust matters more than speed. Two committee members jointly run a real TLS 1.3 session to the destination under two-party computation, so no single member ever holds the session key or sees the plaintext — the destination’s certificate chain verified to real trust anchors. It is wired end to end into the relay data plane and reachable from the client (neo committee2pc-onion). The honest boundary: a handshake takes tens of seconds — millions of gates computed obliviously — so this is a research-grade building block for TLS oracles and split-trust exits, not the way neo browses. Everyday traffic takes the fast path: the onion overlay plus your own end-to-end TLS.
The core mechanism. Flows are encrypted, then split k-of-n across mutually disjoint multi-hop paths. Colluding relays below the threshold learn nothing, and a corrupted share is detected, attributed, and routed around — properties asserted by tests, not prose.
A threat model is a list of adversaries, not a slogan. Pick one: it names what they can do, what Junctus does about it — and the limit we will not hide from you.
Several rows are asserted by adversary-simulation tests in CI today: colluding relays below the threshold learn nothing; a single relay learns only its next hop, and a tampered payload avalanches instead of carrying a signal; an on-path observer sees only ciphertext; forged discovery data is rejected outright; and no committee minority can open a request. Explicit non-goals for v1: censors who accept large collateral damage, hiding from the destination that a connection happened, compromised endpoints, and formal anonymity bounds. And the table is not just defended — it has been attacked directly, by us. That story is next.
Four rounds of adversarial review: first the handshake, the onion layer, the novel core, and the discovery plane — then everything that had grown since — then the newest surface of all: the REALITY transport, the committee, circuit tunnels, and the credit economy — and, most recently, a whole-codebase pass across all sixteen crates, run as a multi-agent workflow where every critical and high finding had to survive a second reviewer trying to refute it from the source. Findings cite file and line; the worst were proven with working exploits against the real code. Every finding from all four rounds is closed — fixed in code with a regression test standing guard, or, where the defect was an overclaimed doc, by correcting the claim itself.
The fourth round was the widest: a single multi-agent sweep of the whole codebase — roughly twenty-five thousand lines across sixteen crates, ten domains reviewed in parallel — where every critical and high finding was handed to a second reviewer tasked with refuting it from the source before it counted. Two high-severity claims were correctly refuted and are not bugs; a plausible-but-wrong finding is treated as a defect of the review, not a win. Of the eight that survived, two were critical — an IPv4-mapped-IPv6 address slipping past the SSRF guard, and a circuit counter whose overflow would have reused keystream — and all eight are fixed. The cryptographic core, the committee, the credit economy, and routing all came back clean. An internal review is still not an audit: the external gate stands.
Strong anonymity, low latency, low overhead — pick two. That trilemma is mathematics, not marketing, so Junctus surfaces it as a control instead of pretending it away.
The anonymity trilemma: strong anonymity, low latency, low overhead — pick two. The dial decides which two. There is no fourth option, here or anywhere.
“A sane default: moderate mixing and cover traffic.”
Every privacy tool has limits. Some bury them. Ours are part of the specification, kept next to the features and versioned with the code.
Junctus deliberately pays a latency and bandwidth tax for anonymity. If a network promises you all three, it is lying about at least one.
Inside the overlay it holds fully — no relay ever reassembles a flow. Toward the open web it is diffused and rotated per request, and split across a threshold committee at the strongest setting — one that can prove it cannot read the response: reduced, never zero, because some machine must still speak the request to the destination.
Slicing and mixing hide you in a crowd. Until the crowd grows, the anonymity set is small — and we say so, rather than round it up.
Flooding the relay set now costs real resources: a proof-of-work per registration, a dial-back per address, and per-subnet and per-ASN caps — plus an uptime gate the relay cannot forge. That turns “sign N records on one box” into “control N hosts across many networks.” It is still not full Sybil resistance: an adversary with a /16 or an IPv6 block defeats subnet diversity, and we deliberately refused to weight selection by bandwidth receipts, because they are client-attested and forgeable — security theater has no place in the anti-Sybil path.
Mobile devices throttle the dial on battery and cellular, and are never mandatory relays or committee members.
Four rounds of internal adversarial review found real breaks — seven of them critical — and every finding is fixed. But that is not the external security and cryptography audit that gates real-world use. Until that audit: experiment, contribute, poke holes — do not bet your freedom on it.
Everything below with a filled marker has running, tested code — the core, the frontier that was research a season ago, and a hardening tier driven by our own attack on the system. What remains is now engineering and an audit, not open research: it is listed just as plainly.
↕ 34 shipped milestones — scroll the ledger