Anonymous broadcast protocols have an inherent trilemma between strong anonymity, low latency and high bandwidth. Their chosen trade-off in this trilemma often plays a role in how they solve another intrinsic issue with anonymous broadcast: how to prevent malicious clients from disrupting the protocol by giving bad inputs, whilst maintaining anonymity.
In this post I’ll look at Panetière’s approach to preventing client disruption, and compare with the approaches of other protocols from the last 16 years. I found I could not really appreciate Panetière’s design without understanding the work that has come before, and I hope this will be useful to others.
In Panetière, strong anonymity and low latency are prioritized over bandwidth, and it has some interesting design details which makes it do this well. It is also robust to a minority of malicious servers, and can guarantee output even when a large proportion of the client set does not participate.
Panetière’s low latency design
In the shuffled secret share approach to anonymous broadcast, used in some of the protocols below, clients create secret shares of a large vector with their own contribution in one position and zeros everywhere else. The servers have to process every element of this vector for every client, which is expensive with a large client set. Also, a scheduling scheme is required to coordinate which client contribution belongs where whilst maintaining anonymity.
Panetière uses a multi-set encoding (MSE) which is additive and collision resistant. This is far more compact than a vector with slots for each client.
The protocol actually allows different types of encoding to be chosen, with different trade-offs. The current offerings are Invertible Bloom Lookup Tables (IBLTs) and an alternative based on Newton-Girard polynomial identities. I’ll focus just on IBLTs for now for simplicity, but I’ll come back to the other one in the discussion of Rabbit-Mix below.
IBLTs are probabilistic data structures that allow sets to be additively aggregated and their elements later recovered with high probability. So each client’s contribution is an IBLT with a single message inserted in it if they choose to send one.
The IBLT data structure is encrypted with Key Additive Homomorphic Encryption (KAHE). The servers add these encrypted IBLTs together to create a cyphertext containing the aggregated IBLT. Clients also distribute secret shares of their short KAHE encryption key to the severs. The recipient can reconstruct the aggregate key, and use it to decrypt the aggregate ciphertext, which is the plaintext aggregated IBLT.
The IBLT can then be decoded to retrieve the anonymous message set.
A big performance advantage comes from the fact that only the KAHE key is secret shared, not the whole data structure. Also, using MSE is not only more compact than a message vector, it removes the need for coordination of client positions to prevent collisions. But there is another thing which Panetière does differently to other protocols, which gives it a big performance advantage.
How to deal with disruptive clients
A core issue is how to prevent malicious clients from disrupting these protocols, meaning honest client’s messages are lost. Different protocols have various approaches to mitigating this, which often come with a significant performance cost.
Panetière’s approach is to run clients inside a Trusted Execution Environment (TEE), meaning the integrity guarantees are provided by client attestation and hardware rather than being part of the protocol itself. This makes it very performant, at the cost of requiring particular client infrastructure. The nice thing is that TEEs are only used to guarantee integrity of client messages, not to provide anonymity. So it does not lean too heavily on the promises in TEEs.
Let’s have a look at how other protocols solve this problem. I’ll start with the older papers and move forward, as the ideas build on each other.
A tour of anonymous broadcast protocols from the last 16 years
Dissent, 2010
Dissent (Dining cryptographers Shuffled Send Network) was originally published in 2010, and later grew into a research collaboration on private group communication making it more of a protocol framework based around the original idea, with a C++ implementation of the protocols which was archived in 2020.
Dissent’s core mechanism is a verifiable shuffle of cryptographic material used to construct the bulk transmission vector. This establishes an anonymous mapping between clients and positions in the vector.
To handle client disruption, the shuffled messages include a hash of the pseudorandom bit-stream used in the encryption which provides a way of checking integrity on protocol failure. A malicious client is able to disrupt the round, but afterwards they get caught.
So this doesn’t solve the issue of a malicious attacker on a particular round, but it makes it unsustainable. Sometimes this is called ‘reactive accountability’.
Verdict, 2013
Verdict is a protocol from the same research group as Dissent. Clients have a pseudonymous keypair, which are assigned to a particular transmission slot in the schedule via a Dissent-style verifiable shuffle. On each slot the assigned client can send a message and the others send cover traffic.
To avoid malicious clients being able to clobber a slot which they do not own, clients also provide a zero-knowledge proof which shows that either they are sending cover traffic or they have the assigned private key for this slot, without revealing which is the case. This allows servers to identify bad clients before running the protocol, unlike Dissent. The downside is that producing the proof is computationally expensive.
Could Panetière also use zero knowledge proofs? It’s more complicated, because proving that a message is well-formed involves showing that one entry has been made in the multi-set encoding. This is possible but would slow things down considerably. It is being considered as an ‘optimistic’ mitigation, meaning that clients are only asked to produce the proofs on protocol failure.
Riposte, 2017
Riposte is designed to scale to a large client set but not necessarily for low latency.
Riposte allows a client to anonymously write a message to a single location in a distributed database. The client creates a distributed point function (DPF) and sends different DPF keys to different servers. Individually, the servers cannot tell which database location the client is writing to, but together their contributions have the effect of writing the client’s message to one location.
The problem is that a malicious client could create malformed DPF keys that affect many database locations, corrupting other users’ messages. Because each server sees only its own private share of the request, it can’t inspect the request to determine whether it is valid.
The solution is for an extra server to perform a ‘private audit’ before applying the write. Importantly, the security assumption is that the audit server does not collude with the database servers. The audit involves checking algebraic properties of the client’s hidden request to establish that it represents a valid single-location write, which exposes whether the request is valid without disclosing which location the client is writing to or what the message is. Invalid requests are rejected before they can corrupt the database.
For Panetière, the equivalent approach would be for the servers to privately check that each client’s encrypted contribution represents one correctly constructed MSE insertion before including it in the aggregate. This would be costly both in terms of security and latency.
Blinder, 2020
Blinder is a protocol for ‘anonymous committed broadcast’ which is also designed to scale and claims to be significantly faster than Riposte.
In Blinder, clients secret-share their hidden message representation across servers, and servers use multi-party computation to verify that messages are well formed. Despite the performance gains compared to Riposte, this is expensive in terms of latency and becomes the bottleneck.
This technique isn’t suited to Panetière because the servers do not have secret shares of the plaintext MSE - they have the KAHE cyphertext and shares of the KAHE key.
Clarion, 2021
Clarion is more like a mixnet than a DC-net. Rather than aggregating client messages, the sender-message link is broken through a private shuffle. But unlike the traditional mixnet approach, the servers collaboratively shuffle a set of secret-shared messages through multi-party computation (MPC).
In Clarion clients secret-share their message and its Message Authentication Code (MAC) across the servers. Before the servers begin the MPC shuffle protocol, they perform a blind MAC verification on each client’s secret-shared input; this lets them check that the contribution is well formed without reconstructing the client’s message. A malformed client contribution is discarded before it can disrupt the batch.
Computing the MAC is cheap for clients, but the blind MAC verification by the servers is more expensive. Furthermore this couldn’t be used with Panetière because we don’t just need to check integrity of the submitted IBLT - we need to show that it has only a single entry.
Spectrum, 2022
Spectrum is an anonymous broadcast protocol specifically designed for high bandwidth, but not to scale to a large client set.
Spectrum’s approach to client disruption is a bit more clever than Clarion’s. It uses a MAC over an ‘access proof’. This proofs that either the client is authorized to broadcast because it knows its channel’s broadcast key, or that it is submitting all-zero to cover traffic, without revealing which of the two is the case.
This is a pretty clever technique but it cannot apply to Panetière because it is based on Spectrum’s client-channel based architecture which is only practical with a small client set.
Rabbit-Mix, 2024
Rabbit-Mix is based on a similar model to Blinder, with significant performance optimizations through its encoding system.
It is especially relevant because it uses Newton identities, which Panetière also supports as an alternative MSE. The Panetière draft states that these are more compact but more computationally expensive than IBLTs. Rabbit-Mix uses a variant based on an additive 2-basis, making them even more compact.
Client disruption is mitigated through proactive server-side verification. The additve 2-based encoding is designed to make this integrity check performant. Despite this, with a large client set Rabbit-Mix servers have considerably more computation and inter-server communication to do than Panetière servers.
ZIPNet, 2024
Zipnet is the protocol which Introduced the idea of using TEEs for ensuring that clients produce well-formed contributions. So the client disruption technique is the same as Panetière’s.
Like Panetière, it is designed for low latency with a large client set. This is achieved by outsourcing aggregation. With a large client set, there are many contributions to be aggregated. However, this work can be done without exposure to private data and can be parallelized such that aggregator servers combine the contributions for a particular portion of the client set, and send the aggregate on to a small set of protocol servers, reducing bandwidth demands. The Panetière draft also mentions this outsourcing as a possible optimization of the protocol.
Unilke Panetière, there is no MSE. Each client contributes a full vector with their own contribution in their designated position. This means that like many of these other protocols, a scheduling round is required to coordinate clients’ vector positions. This makes Zipnet less suited to a dynamically changing client set.
Willow, 2024
Willow is a 2024 protocol from Google. It is for secure aggregation, not anonymous broadcast, but I include it anyway here because it’s architecturally very relevant to Panetière, as it also uses KAHE for private aggregation of client contributions. The paper notes that many other aggregation protocols involve waiting for all clients’ contributions which means the protocol can be slow in practice even when the algorithm is efficient. Willow avoids this by dynamically adding contributions when they become available. Since Panetière does not require contributions from all clients, it does not suffer from this problem.
In Willow, preventing client disruption is critical because clients can potentially break the security of other clients’ inputs. This is possible by choosing KAHE key material which is a function of that of other clients. The mitigation is to have the clients include a zero-knowledge proof of knowledge of their secret key. It uses Bulletproofs with batched verification. But this is still expensive, and doesn’t really apply to Panetière as the client disruption problem is very different.
Tacita, 2025
Tacita is also a secure aggregation protocol which claims to improve upon Willow in terms of performance and mitigating attacks. It has similar goals to Willow but has quite a different design. It has a single aggregation server and a ‘threshold committee’ who collectively decrypt the aggregate output.
Clients sign their encrypted input with multi-key linearly homomorphic threshold signatures. This is really protection against malicious servers, not malicious clients, as it means other servers can check that the aggregate signature validates against the aggregate cyphertext. So the client disruption problem doesn’t really apply here.
Ring of Gyges, 2025
Ring of Gyges is different because it goes a big step further than preventing client disruption. It is designed to prevent clients from publishing disallowed content by allowing such messages to be linked back to the author. Quite an unusual property for an anonymity protocol. The name comes comes from Plato’s hypothetical magic ring which allows you to become invisible.
Ring of Gyges is not so relevant to Panetière because it is not designed for low latency with a large client set. But the technique against client disruption is anyway worth a mention. It uses ‘weak secret sharing’ which is a computationally cheaper version of verifiable secret sharing, with weaker guarantees that are sufficient for Ring of Gyges’ trust model.
Pepper, 2026
Pepper is designed for high bandwidth rather than low latency. Like Spectrum, it uses client channels, and like Reposte, it uses DPF to encode private writes. It also has proactive server-side verification to avoid client disruption. Pepper takes this further with verifiable DPFs and multi-point functions, allowing clients to efficiently write to multiple channels.
To prevent disruption, servers verify that each contribution contains only the permitted number of writes and use secret-shared access proofs to ensure that those writes target channels the client is authorized to use. There is an open source Go implementation.
Conclusion
When I first looked at Panetière it seemed strange that clients rely on attestation in order to guarantee that they abide by the rules. I knew there were other anonymous broadcast protocols that didn’t require this. After looking at these I can see what part of the design space Panetière occupies.
For strong anonymity we need to support a large client set. With a large client set, coordination becomes difficult and performance drops. Panetière’s design allows fast anonymous publishing at scale with very little client coordination. While it would be possible to add a cryptographic proof for well-formed client contributions, the additional computation, communication or server coordination would undermine Panetière’s other promises.
Others protocols which were not covered
- MCMix 2017
- Asynchromix 2019
- Express 2021
- Sabre 2022
- RPM 2022
Not a protocol but a primitive which would be relevant to shuffle-based protocols:
See also this older post written during development of Panetière: