Security
Designed for a hostile network
Etoki assumes routers can be watched or compromised. Its guarantees come from the protocol, not from trusting the operator.
PQ-hybrid handshake
The NST handshake combines X25519 and ML-KEM-768. In-channel rekey re-exchanges fresh ephemerals so long sessions keep healing.
Self-healing ratchet
Every double-ratchet DH step mixes in a new ML-KEM encapsulation, giving post-compromise security against a future quantum adversary.
Onion routing
Entry and destination roles split knowledge of the endpoints; pooled inter-router links and jittered batching blunt timing correlation.
Traffic-analysis resistance
Fixed 16 KiB blocks, exponential cover-traffic schedules, and 0–400 ms send-jitter decouple real activity from what an observer sees.
Fingerprint-pinned trust
Addresses pin a public-key fingerprint, so forged DNS or TLS answers can never impersonate a router, relay, or peer.
Abuse resistance
Proof-of-work on queue creation, per-IP and per-sender rate limits, and a retention sweeper keep open relays from being weaponized.
Onion routing
No one sees the whole path
The entry router learns your IP but not your contact. The destination router learns the queue but not you. Content stays encrypted end to end.
Threat model
What a router can observe
Even a fully compromised router learns almost nothing beyond an opaque queue identifier.
| Data | Visible to a router? | Why |
|---|---|---|
| Message content | No | End-to-end encrypted |
| Who you're talking to | No | Split across 2 hops |
| Your real IP (destination side) | No | Hidden by entry |
| Message size / timing pattern | No | Fixed blocks + cover traffic |
| That a queue exists | Limited | Opaque queue id only |