💻 computer science

Seldom: An Anonymity Network with Selective Deanonymization

The paper presents Seldom, a Tor-based anonymity network that balances user privacy with law enforcement needs by enabling selective, consortium-approved deanonymization of misbehaving users while maintaining minimal performance overhead and ensuring public transparency.

Original authors: Eric Wagner, Roman Matzutt, Martin Henze

Published 2026-01-30

📖 5 min read🧠 Deep dive

CC BY 4.0

Original authors: Eric Wagner, Roman Matzutt, Martin Henze

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

Imagine the internet as a massive, bustling city. In this city, there is a special neighborhood called Tor. Tor is like a giant, invisible cloak that lets people walk around without anyone knowing who they are or where they came from. This is incredibly useful for journalists, whistleblowers, and people living under oppressive regimes who need to speak freely.

However, there's a problem: because the cloak is so good at hiding people, some criminals use it to do bad things, like selling illegal drugs or sharing harmful content. Because of this, many regular, law-abiding citizens are afraid to wear the cloak. They worry that just by walking through the neighborhood, they might get blamed for the crimes happening there, or that the police will treat them with suspicion.

The authors of this paper, Eric Wagner, Roman Matzutt, and Martin Henze, propose a new neighborhood called Seldom. Think of Seldom as a "Glass House" version of the invisible cloak. It still hides your identity from the public and the police most of the time, but it has a special, locked emergency exit that can only be opened under very strict, public rules if someone is caught doing something illegal.

Here is how Seldom works, broken down into simple concepts:

1. The "Magic ID Card" (Temporal IP Certificates)

When you enter Seldom, you don't just walk in anonymously. You first get a temporary, digital ID card based on your current internet address (like your home address). This card is like a receipt.

In Tor: You have no receipt.
In Seldom: You have a receipt, but it's wrapped in a special, unbreakable glass box. Only a specific group of people can open this box, and only if they have a very good reason.

2. The "Glass Vault" (Threshold Encryption)

This is the core magic trick. When you send a message, your identity is locked inside a digital safe. This safe requires many different keys to open, not just one.

Imagine a bank vault that needs 5 different people to turn 5 different keys at the same time to open it.
In Seldom, these keys are held by a Consortium. This is a group of trusted, impartial people (like judges, privacy advocates, and tech companies) who don't trust each other completely but trust the system.
No single person, not even the police, can open the safe alone. They need the whole group to agree.

3. The "Public Ledger with a Delay" (Translucent Ledger)

How do we stop the police from abusing this power? Seldom uses a public notebook called a Translucent Ledger.

The "Peek": The public can see a live counter on the notebook that says, "Hey, the police asked to open a safe today." They can see that a request happened, but they can't see who it is or why yet.
The "Delay": The actual details (who was caught and why) are locked away for a while (like a delayed news report). This gives the police time to finish their investigation without the criminal knowing they've been caught.
The "Reveal": After the investigation is over, the notebook automatically opens up and shows everyone exactly what happened. If the police tried to open a safe for a bad reason, the public sees it immediately and can get angry, forcing the system to change.

4. The "De-anonymization" Process (Opening the Safe)

If the police catch someone doing something bad on the network, they can't just unmask them. They have to:

Ask: They file a formal request with the Consortium (the group of key-holders).
Vote: The Consortium members vote. If enough of them agree that the request is valid (e.g., "This person is selling drugs"), they unlock the safe.
Reveal: The safe opens, and the police get the name. But here's the kicker: The Consortium members themselves don't see the name. Only the police get the result. This ensures the group of judges doesn't get tempted to snoop on people they don't like.

5. Why is this better than just "No Privacy"?

The paper argues that Seldom is a "Goldilocks" solution.

Too much privacy (Tor): Criminals hide, and regular people are scared to use it.
Too little privacy (No anonymity): Everyone is watched, and free speech dies.
Seldom: Regular people feel safe using it because they know criminals can be caught. Criminals are scared to use it because they know they can be caught.

The Results: Is it fast?

The researchers built a working version of Seldom based on the existing Tor network. They tested it and found:

Speed: It is almost as fast as Tor. The extra steps to lock and unlock the digital safes add only a tiny fraction of a second to your internet speed. You wouldn't even notice it.
Storage: The system needs to store a lot of data (like the "receipts" and "safe keys") for a couple of years. They calculated that for a network the size of Tor, this would take about 636 Terabytes of storage. That sounds huge, but for governments or large organizations, that is a manageable amount of space (like a few large server rooms).

The Bottom Line

The paper concludes that Seldom offers a practical way to have both privacy and safety. It tries to solve the "Safety vs. Privacy" argument by saying: "We can have privacy for everyone, but we can also catch the bad guys if we all agree on the rules and watch the watchers."

It's not a perfect magic wand, but it's a new tool that might convince more regular people to use anonymity networks without fear, while making it much harder for criminals to hide.

Technical Summary: Seldom – An Anonymity Network with Selective Deanonymization

1. Problem Statement

Anonymity networks like Tor provide essential privacy services for journalists, whistleblowers, and militaries but are frequently associated with criminal activities (e.g., CSAM distribution, illegal drug markets). This association creates a "safety-privacy dilemma": many privacy-conscious citizens avoid using Tor due to fear of being associated with criminals, while law enforcement agencies (LEAs) struggle to investigate crimes without compromising the anonymity of innocent users. Existing solutions for "exceptional access" (e.g., key escrow, client-side scanning) often suffer from trust issues, lack of transparency, or technical impracticality. The authors argue that a new approach is needed to disincentivize criminal activity while maintaining strong anonymity for legitimate users, potentially unlocking a large, untapped user base currently avoiding anonymity networks.

2. Methodology and System Design

The authors propose Seldom, an anonymity network based on onion routing (extended from Tor) that integrates selective deanonymization capabilities. The system is designed to allow LEAs to investigate suspicious traffic only under strict public oversight and cryptographic guarantees.

Core Architecture

Seldom operates on a model where client identities are threshold-encrypted and stored in a centralized database managed by a trustworthy consortium of impartial entities. The system relies on three main pillars:

Oblivious Authentication: A protocol linking outbound traffic to a unique, threshold-encrypted identity without revealing the client's identity to the relays.
Translucent Ledger: A blockchain-based system (using Ethereum with Proof of Authority) that manages deanonymization requests. It ensures transparency through delayed disclosure and real-time statistics without compromising ongoing investigations.
Consortium Oversight: A group comprising government representatives, privacy advocates, and privacy-focused corporations that votes on deanonymization requests.

Key Technical Components

A. Oblivious Authentication Protocol

Seldom introduces a novel authentication flow integrated into the circuit establishment:

Temporal IP Certificates: Clients obtain a certificate from a trusted Certificate Authority (CA) linking an ephemeral public key to their current IP address. This replaces standard CA certificates to avoid sharing excessive personal data with entry relays.
Hop Keys and Threshold Encryption: As the circuit is built, each relay validates the previous hop's signature and generates a new hop key. The client's identity (IP certificate and subsequent keys) is recursively threshold-encrypted at each hop.
Encrypted Identity ( $ID_n$ ): The final exit relay holds a threshold-encrypted identity ( $ID_3$ for a 3-hop circuit). This identity can only be decrypted if the consortium members collaborate.
Flow Records: When a client initiates a connection, they sign a flow record (destination IP, port, timestamp) with a client identification key. The exit relay stores this record and the encrypted identity in a database. The link between the flow and the identity is encrypted by the exit relay to prevent matching multiple flows to the same circuit without cooperation.

B. The Deanonymization Process

When an LEA identifies suspicious traffic:

Request: The LEA queries the database for the flow record and submits a request to the consortium via the translucent ledger, providing justification (e.g., a warrant).
Voting: Consortium members vote on the request. The vote is recorded on the ledger.
Verification: If approved, the consortium requests the exit relay to provide the encrypted identity linked to the flow. The exit relay decrypts the link between the flow and the identity and sends the encrypted identity to the consortium.
Decryption: The consortium members collaboratively decrypt the threshold-encrypted layers. Crucially, the consortium members do not learn the final plaintext identity; they only share decryption shares with the requesting LEA.
Result: The LEA receives the client's identity (IP address via the certificate). The consortium verifies the integrity of the relays involved during this process.

C. Translucent Ledger

To balance transparency and secrecy, Seldom uses a translucent ledger with three features:

Delayed Disclosure: All requests and decisions are eventually published to the public, but with a fixed delay (e.g., to allow investigations to conclude).
Real-time Peeks: Authorized entities (like exit relays) can verify specific states (e.g., approval of a request) via Merkle proofs without seeing the full ledger state.
Real-time Statistics: The ledger publishes aggregate statistics (e.g., number of requests) immediately to maintain public trust without revealing sensitive details.

D. Probing and Integrity

To prevent relays from colluding or failing to cooperate, the consortium can perform probing. Directory authorities generate cryptographic commitments for specific traffic patterns and initiate circuits. They then request a "deanonymization" of this probe traffic. If the exit relay fails to cooperate or provides incorrect data, it is flagged as malicious and removed from the network.

3. Key Contributions

The paper makes the following specific contributions:

Protocol Design: An oblivious authentication protocol that links outbound traffic to threshold-encrypted identities, integrated into an onion routing network.
Translucent Deanonymization: A process where identities are revealed only to the requesting LEA, with the consortium acting as a gatekeeper that does not learn the final identity.
Translucent Ledger: A mechanism for public oversight that allows for delayed full disclosure while providing real-time statistics and verification capabilities.
Performance Evaluation: A proof-of-concept implementation based on Tor (v0.4.1.5) demonstrating that the system is feasible.

4. Results and Evaluation

The authors evaluated Seldom in a local deployment, comparing it against vanilla Tor.

Latency and Processing:
- Circuit Establishment: Seldom adds a negligible latency overhead of 3.2 ms to 4.3 ms compared to Tor, depending on circuit length. This is attributed to signature processing and threshold encryption.
- Connection Establishment: The time to first byte increases by an average of 1.5 ms.
- Conclusion: The overhead is imperceptible to users and overshadowed by global network latency.
Bandwidth and Storage:
- Bandwidth Overhead: Storing and transmitting flow records and encrypted identities increases exit relay bandwidth usage by approximately 0.11%.
- Storage Requirements: For a network the size of Tor (approx. 2.1 billion exit streams/day), retaining data for two years requires approximately 636 TB of storage. The authors note this is manageable for government-sponsored databases.
- Scalability: The authors suggest that if Seldom grows significantly larger than Tor, strategies like whitelisting benign websites or probabilistic deanonymization could further reduce overhead.
Decryption Performance:
- Even with a large consortium (75 members), the processing time to decrypt an identity is under 33 seconds on a single CPU core per participant. The data exchange remains under 100 MB.

5. Significance and Claims

The paper claims that Seldom offers a practical and deployable technical solution to the problem of criminal activity in anonymity networks. Its significance lies in:

Disincentivizing Crime: By enabling selective deanonymization, Seldom aims to deter criminal misuse, potentially encouraging a larger, law-abiding user base to adopt anonymity networks.
Balancing Privacy and Safety: It demonstrates that selective deanonymization can be implemented with strong cryptographic guarantees (threshold encryption) and public oversight (translucent ledger) without the "backdoor" vulnerabilities often associated with exceptional access proposals.
Minimal Performance Impact: The system proves that adding these security and oversight layers does not significantly degrade the user experience compared to Tor.
New Perspective: The authors argue that Seldom shifts the debate from "total anonymity vs. total surveillance" to a model where anonymity is revocable under strict, transparent, and ethical conditions, potentially increasing the overall adoption of privacy tools.

The authors remain modest, acknowledging that Seldom relies on a trusted consortium and that its success depends on societal acceptance and the ability to migrate users from Tor. They also note that Seldom is not a replacement for Tor but an alternative for users currently deterred by Tor's association with crime.