Hi ScrambNet team, Information-theoretic content protection via Shamir secret sharing (n=4, k=3) is an lovely conceptual model. However, you explicitly asked for a hostile read on OP-1 (verifying that n circuits are genuinely disjoint across node, AS, and jurisdiction using only a client's gossip sample). Here is the attack showing why PS-2 ("AS-disjointness") fails as an operational proxy for disjointness, and how an adversary trivially breaks the k=3 threshold at the ingress boundary without breaking any crypto: ============================================================================== 1. THE MULTI-ASN SYBIL FUNNEL: BREAKING k=3 AT INGRESS ============================================================================== In PS-2 and PS-6, you require that guards and circuits be AS-disjoint. The fatal flaw is assuming that distinct Autonomous System Numbers (ASNs) imply distinct operational entities. In our active empirical audits of ingress relay infrastructure across the live consensus (using our open-source scanner 'entrymap'), we continuously observe single operators running dense clusters across completely disparate ASNs without declaring family relationships. Real-World Case Study: • Operator 'admin[]prsv.ch' concurrently operates high-bandwidth ingress nodes across three completely distinct ASNs: - Node 1: AS20860 (IOMART CLOUD SERVICES, UK) - Node 2: AS216405 (Metric Systems, UK) - Node 3: AS16276 (OVH SAS, France) • Because ScrambNet clients only verify AS-disjointness (PS-2) and refuse self-declared metadata (PS-4), a client building n=4 circuits selects: - Path 1: Guard in AS20860 - Path 2: Guard in AS216405 - Path 3: Guard in AS16276 - Path 4: Guard in AS24940 (Hetzner) • Result: The client believes it has 4 independent, AS-disjoint paths. In reality, Paths 1, 2, and 3 terminate at ingress nodes controlled by the EXACT SAME entity. • Mathematical Failure: The adversary captures k=3 shares (s1, s2, s3) on the very first hop. The Shamir secret is immediately reconstructed in plaintext. The information-theoretic floor collapses to zero. ============================================================================== 2. GOSSIP-BASED BANDWIDTH GAMING (THE GHOST-BW ATTACK ON PS-7) ============================================================================== You said in PS-7 that guard selection is weighted by "verified bandwidth", but in Refusal 3 you reject Directory Authorities in favor of decentralized gossip. How does a client verify bandwidth without authorities....well In Tor, even WITH 9 trusted Directory Authorities running active measurement scripts, operators setting 32-bit integer boundaries in torrc (BandwidthRate 1,073,741,824 B/s = 2^30 B/s / 8.58 Gbps) create consensus weight inflation factors up to 44,000x over real throughput before authorities catch up. In a decentralized gossip protocol, an adversary can spin up Sybil clusters that mutually cross-endorse each other's bandwidth claims. By artificially inflating their advertised capacity across multiple cheap VPS ASNs, the adversary captures the overwhelming majority of path selection probability, ensuring that clients draw >= k hostile guards. ============================================================================== 3. PHYSICAL LAYER 1 & OPTICAL DISTRIBUTION COLLISION ============================================================================== AS-disjointness does not equate to physical path disjointness. • High-capacity ingress nodes deployed across disparate altnets or residential FTTP pools frequently share the exact same physical street cabinet, CBT, or optical distribution loop (GPON TDMA splitters). • Furthermore, upstream BGP routes for disparate regional ASNs converge at common Tier 1 transit providers (Arelion, Lumen, Cogent) and Internet Exchange Points (LINX, DE-CIX, AMS-IX). • A passive wiretap or state adversary situated at a common transit exchange observes the ingress flows of multiple "disjoint" ASNs simultaneously, intercepting k shares in transit. ============================================================================== 4. CONSTRUCTIVE MITIGATIONS FOR OP-1 ============================================================================== If you want to make OP-1 resilient against these attacks: 1. Multi-Metric Clustering (Beyond ASNs): Do not rely solely on ASNs. Ingress path selection must incorporate BGP upstream AS-PATH intersection checks (rejecting paths that share upstream Tier 1 transit providers within 2 BGP hops). 2. Triangular Latency / Jitter Probing: Require clients to measure round-trip time (RTT) variances between candidate guards. Relays claiming distinct ASNs that exhibit near-zero mutual delta and identical clock skew should be treated as co-located Sybils. 3. Subnet Concentration Penalties: Apply severe path selection penalties to relays residing in /24 or /22 CIDR allocations operated by budget hosting providers with loose KYC (Alexhost, NForce, Private Layer). The premise of Shamir secret sharing is mathematically sound, but an adversary will never attack the math—they will attack the path selection topology to ensure k shares land in their lap. Best regards, Adam Keeves FrogSec Research keevesadam98@gmail.com