Astrea makes privacy
inspectable

One mechanism for every leak

A private action can leak through its computation, its receipt, its traffic, its broadcast origin, or a recording kept for a future quantum computer. Astrea assigns one mechanism to each. The sections below use their names constantly, so the definitions come first.

An observer trying to reconstruct a private action has to beat all five at once: read a zero-knowledge computation, widen a fixed schema, match shaped traffic, locate a diffused origin, and break both halves of the cryptography. Weaken one mechanism and the others still hold their own boundaries. The rest of the page takes the mechanisms one at a time, then looks at the crossings where contexts meet.

The route is also how Astrea extends privacy to economies that were never private. The bridge carries an agent's Zcash traffic and its Ethereum traffic through the same PRISM lanes, so a venue sees the bridge's proxy and a network observer sees a shaped mix. Section 10 follows a settlement crossing and names what each chain still shows.

One action has three privacy surfaces

Computation secrecy, deliberate disclosure, and network metadata answer different questions. Astrea keeps them separate so a strong guarantee in one layer never silently stands in for another. A cross-chain action adds a fourth surface, the settlement crossing, covered in section 10.

PRIVACY BOUNDARY MAP

one action · three distinct views

A private wallet action becomes certified state

Consider a registered wallet transfer whose note contents stay private. Before approval, the wallet can show the action's public contract: its program or action identity, declared bounds, authorization context, input and output commitments, versioned roots, and the padded access-shape summary required by its profile. The note openings and private memory contents form the witness and never become raw verifier input.

Now the mechanisms from the introduction take their turns. PixelVM executes the typed action and produces the zero-knowledge proof package tied to that contract — the first two mechanisms working together. The encrypted content travels the network through PRISM's protected route, so the transfer's traffic shape gives nothing away. If the action body is meant to become public, Dandelion# carries it down the narrow stem before the wide broadcast, hiding which node it came from. And at the end, validators still apply every normal rule — authentication, decoding, proof verification, consensus — before the effect enters authoritative state. Delivery never grants authority by itself.

Encrypted bodies can remain outside the consensus hot path under authenticated manifests, which bind the stored bytes to certified state. A storage host can carry ciphertext without receiving plaintext, while an authorized endpoint can decrypt it. Endpoint logging, copying, or disclosure remains an application and device boundary.

ONE PRIVATE ACTION

prepare → prove → route → verify → order

The public contract fixes the proof

A typed contract gives the verifier one stable question. It identifies the registered action, canonical public inputs, public context, declared result, commitments, and profile. The private witness supplies the secret facts needed to satisfy that contract. PixelVM uses it during proving without handing its raw bytes to the verifier. This is where the first two mechanisms of the introduction lock together: declared disclosure decides the question, and the zero-knowledge receipt answers it without the witness.

SIMULATOR AND VERIFIER

privacy evidence ≠ correctness acceptance

These are three different tools. Zero knowledge lets a verifier check a completed computation without receiving the declared witness. Transport encryption hides bytes while they move between endpoints. Fully homomorphic encryption computes on ciphertext; it is a separate technique and does not by itself make a proof transcript simulatable.

The receipt carries the action's declared public fields

Each registered action defines the fields that cross its privacy boundary. A wallet can display that contract before the user approves it.

What an Astrea action may reveal and why

Receipt surface	Why it may be public	What remains private
Action identity and bounds	The verifier must know which registered rules and resource envelope apply.	Witness-dependent values not declared by that action.
Authorization context	Validators need enough public context to decide whether the action is admissible.	Private credentials or note contents represented by commitments.
Commitments and digests	Later proofs and updates need stable references to hidden material.	The canonical bytes bound behind those references.
Declared result	Applications need the state effect or output they are authorized to observe.	Intermediate private trace values and undeclared outputs.
Roots, versions, and access shape	The proof must bind one state snapshot and its declared execution structure.	Private memory contents; the access pattern itself may remain visible.

The receipt is therefore compact and meaningful rather than blank. It exposes enough to authorize, verify, and bind the action to state while keeping the registered private witness out of public input. The boundary is set by the action’s published schema rather than by whoever happens to run the software.

Encrypted content still has a traffic shape

An authenticated encrypted session protects the payload on that connection. An observer can still measure the connection: which endpoints are active, when packets move, their size class, and how traffic changes after an event. Those signals require their own policy.

PROTECTED SESSION

payload hidden · traffic shape observable

These signals defeat real systems, not hypothetical ones. Tramèr, Boneh, and Paterson identified the recipients of shielded Zcash transactions from node response timing in "Remote Side-Channel Attacks on Anonymous Transactions" (USENIX Security 2020), a flaw fixed after disclosure. At the ledger level, Kappos, Yousaf, Maller, and Meiklejohn matched deposits into Zcash's shielded pool with later withdrawals of the same value in "An Empirical Analysis of Anonymity in Zcash" (USENIX Security 2018), shrinking the Sprout-era anonymity set by 69.1 percent without touching a shielded-to-shielded transaction. Möser et al. traced a large share of early Monero spends through decoy-selection patterns in "An Empirical Analysis of Traceability in the Monero Blockchain" (PoPETs 2018). Encrypting the ledger while leaving timing, size, and the crossing exposed is how careful users still get identified. PRISM is built for the first two; the bridge, on the Zcash page, removes the third by taking deposits as shielded transfers.

PRISM reduces distinctive network signals

Astrea's answer borrows the strongest defense family the field has: the mixnet playbook, applied inside the protocol instead of bolted on beside it. Astrea first chooses an ordered relay path with declared role, operator, and network diversity, then gives each relay a Sphinx-style onion envelope containing only the local handoff it needs — no relay learns both the origin and the destination. Real traffic shares the schedule with cover packets, so silence and activity look alike; messages enter declared size classes, so no packet is a fingerprint; release jitter loosens timing correlation; and routes rotate so one fixed neighbor set never accumulates a long-lived view.

This policy layer is called PRISM. It carries privacy-sensitive edge traffic on a route separate from the direct authenticated validator and core lanes. The separation matters: consensus traffic keeps its direct authority path, while PRISM reduces what an observer can link about an edge request. In the combination, this is the mechanism receipts cannot supply: a proof hides content, and only the route can hide traffic.

CORE LANE AND PRIVATE EDGE

authority path stays separate from privacy route

Dandelion# breaks the obvious origin link

Some actions are meant to become public. Encrypting their journey cannot make the eventual public body secret. The privacy problem is their origin: immediate broad broadcast makes the first broadcaster an obvious clue.

The countermeasure pattern comes from public research: Dandelion, refined into Dandelion++, the two-phase broadcast design Monero has run since 2020. A fresh transaction first travels a quiet stem, one relay at a time, and only the terminal relay fluffs it into normal gossip, so its first broad appearance lands far from its author. Astrea ships a hardened descendant of that design and calls it Dandelion#, read “Dandelion sharp”.

Dandelion++ leaves two gaps. The stem carries the transaction readable, so every stem relay can inspect what it forwards and knows it is holding pre-broadcast material. And the quiet phase is enforced only by good behavior: a dishonest stem relay can broadcast early, from a position near the author, which is exactly the leak the stem exists to close. The design’s own fail-safe leans the same way — a stalled stem fluffs on a timer, trading privacy for liveness.

Dandelion# closes both gaps with the tool PRISM already uses: onion layers. After PRISM carries a fresh action through the private edge to egress, the stem itself is wrapped hop by hop, each layer encrypted to one relay’s hybrid X25519 + ML-KEM keys. A stem relay peels its single layer and learns one fact: the next hop. It cannot read the action, and it cannot tell how far it sits from the origin. The same layering enforces the path, because the readable body exists only after the final layer is decrypted — no relay can cut the stem short and burst early, and the switch to fluff cannot be faked. And where Dandelion++ fluffs a stalled stem, a privacy-sensitive stem in Astrea holds and fails closed. With PRISM covering the journey and Dandelion# covering the entry point, the network stops being the easy way around the cryptography.

DANDELION# ORIGIN DIFFUSION

private edge → narrow stem → broad fluff

Duplicate action identifiers stop nodes from repeatedly forwarding the same gossip item, and an action class that has declared itself liveness-critical may still choose early broad diffusion as a visible tradeoff. None of this claims the public body stays confidential once it fluffs — Dandelion# protects where it entered the network, and nothing else.

Privacy is weakest where contexts meet

The mechanisms so far protect the middle of an action’s life: the computation, the disclosure, the route, the origin. The edges are different. A private computation may begin with a public deposit, call an outside service, or end in a public state change, and an observer who sees both sides can compare public values, identifiers, size classes, and timing. The hidden middle does not erase those boundary facts.

Astrea applies declared shaping at the edges where the application permits it: public values or action sizes can enter common classes, releases can share scheduled windows with other activity, and route policy can avoid one direct endpoint pair. These controls reduce a distinctive match. They do not make two public events impossible to correlate.

BOUNDARY CORRELATION

the protected middle cannot erase public edges

Every promise names its observer and source

Astrea is engineered for 160-bit post-quantum security in its primary profile, and no supported profile falls below an absolute 128-bit post-quantum floor. Both statements depend on the declared construction, parameters, assumptions, implementation, and deployment boundary. They apply to the cryptographic boundaries that name them; they do not erase traffic metadata or secure a compromised endpoint.

See the transport layer →

A crossing between two chains has a fourth surface

When an agent bridges ZEC into Astrea and acts on an Ethereum venue, three records exist at once: Zcash's public ledger, the venue's public state, and Astrea's certified private state. The computation, the disclosure, and the route each keep the policies above. The crossing adds a fourth surface: what an observer who can read both public chains, or who holds the bridge's keys, can still line up.

The bridge's design answers that surface in three ways. A deposit and a withdrawal are ordinary shielded transfers, and the bridge's reserve stays in Zcash's shielded pool, so Zcash shows no transparent exit and no entry: an observer of the Zcash chain sees a shielded transaction like any other. The venue sees the bridge's proxy account and a manifest of declared fields, so its ledger shows the bridge acting, not an owner. Inside Astrea the ledger is zero-knowledge, so validators verify that a deposit was credited and an action was authorized without learning whose balance moved, and a withdrawal's timing and amount follow the owner's policy rather than the trade.