P⁵: A Protocol for Scalable Anonymous Communication
📜 Abstract
We present a protocol for anonymous communication over the Internet. Our protocol, called P⁵ (Peer-to-Peer Personal Privacy Protocol) provides sender-, receiver-, and sender-receiver anonymity. P⁵ is designed to be implemented over the current Internet protocols, and does not require any special infrastructure support. A novel feature of P⁵ is that it allows individual participants to trade-off degree of anonymity for communication efficiency, and hence can be used to scalably implement large anonymous groups. We present a description of P⁵, an analysis of its anonymity and communication efficiency, and evaluate its performance using detailed packet-level simulations.
✨ Summary
Summary
P⁵ proposes a peer-to-peer anonymous communication protocol based on a hierarchy of logical broadcast channels. Users are mapped to channels using hashes of public keys and choose channel depths according to local security and efficiency requirements. Higher-level channels provide larger anonymity sets but impose greater bandwidth costs and reliability penalties; users may move toward smaller channels when they prefer greater communication efficiency.
The protocol combines fixed-size, per-hop encrypted packets with constant-rate signal and noise traffic. This is intended to prevent a passive adversary capable of monitoring all network links and correlating packets from distinguishing communication traffic from cover traffic. Routing keys and lateral channel connections are used to reduce the number of inter-channel crossings while preserving the separation between communication identities and routing identities. The paper also analyzes correlation, intersection, difference, denial-of-service, and colluding “mob” attacks, and identifies active adversaries able to inject traffic across large portions of the network as a limitation.
Packet-level simulations indicate that the design can support thousands of participants with short average paths. In the reported 8,192-user experiment, average inter-channel distance remained below one channel crossing, while the average end-to-end path was approximately 13 hops. The principal cost is bandwidth and packet loss: stronger anonymity requires larger broadcast groups and therefore more replicated traffic. The authors present P⁵ as a scalable design point between global broadcast anonymity and more bandwidth-efficient but weaker anonymity systems.
The work influenced subsequent anonymous-communication research primarily as an established broadcast-based peer-to-peer design point. Later surveys and systems, including Herbivore, classify P⁵ alongside other early anonymous overlay protocols and compare its tree-broadcast approach with multicast and DC-net alternatives. The Tor design literature specifically identifies P⁵ and Herbivore as broadcast-based peer-to-peer anonymity systems, contrasting them with circuit-based designs such as Tarzan and MorphMix. (cs.princeton.edu) The protocol was also cited as prior work in research on unreliable-overlay anonymity, including Information Slicing. (usenix.org) There is evidence of substantial academic uptake, including hundreds of indexed citations, but the sources reviewed do not establish deployment of P⁵ itself as a widely used industry system. (researchgate.net)