Nym Mixnet Integration

news.tcpreset.net - August 31, 2026 - server administration

This document describes the privacy and anonymity improvements recently deployed on news.tcpreset.net, with a focus on the integration of the Nym mixnet into our posting infrastructure and the hardening of outgoing article headers.

Background

Our server has always operated with a strong privacy commitment: no logging of reader IP addresses in public status pages, data minimisation, abuse contact only. The current round of changes extends that commitment to the posting path - the headers that INN attaches to every article before it is propagated to peer servers.

Simultaneously, we are opening the server to posts arriving through the Nym mixnet, in collaboration with Ch1ffr3punk and the Nym-Usenet ecosystem. Nym provides multi-hop, traffic-analysis-resistant transport - a significant step beyond Tor for high-threat posting scenarios.

N2Usenet, Standalone HTTPS Posting via Nym

The main public posting frontend for this Nym path is now N2Usenet, available at https://n2usenet.virebent.art. It is a standalone HTTPS gateway dedicated to pseudonymous posting into news.tcpreset.net through the TCPReset Mail2News path.

N2Usenet is distinct from the older onion-only m2usenet composer integrated into Onion Newsreader. The legacy onion path is preserved only for reply workflows inside /compose/. N2Usenet is the separate, clearnet-facing, Nym-routed service.

Browser
  -> https://n2usenet.virebent.art
  -> N2Usenet HTTPS backend
  -> local Nym SOCKS5 client
  -> dedicated Nym requester
  -> SMTP STARTTLS to mail2news.tcpreset.net:25
  -> mail2news@mail2news.tcpreset.net
  -> news.tcpreset.net NNTP

The interface preserves the same authorship model developed for the earlier posting tools: an Ed25519 keypair is generated or loaded in the browser, the message body is signed locally, and the corresponding pseudonymous identity produces a deterministic VFACE identicon carried in the standard Face: header.

Browser-side Ed25519 identity generation and local message signing
Deterministic Face: header generation from the pseudonymous identity
Hashcash proof of work before submission
No submitted identity material or compose data written to disk after delivery
Final article delivery into the open news.tcpreset.net NNTP service

In other words, N2Usenet combines an HTTPS entry point, Nym transport, pseudonymous cryptographic authorship, and the existing TCPReset Mail2News and NNTP infrastructure in a single public posting workflow.

Header Changes - filter_nnrpd.pl

All changes are implemented in the INN nnrpd Perl filter, which runs on every article submitted by a posting client before acceptance. The filter now performs four operations:

1. NNTP-Posting-Host - BLAKE2b keyed hash

The previous implementation replaced the poster's IP address with an MD5 hash using a hardcoded salt. MD5 is unsuitable for this purpose: a rainbow table attack over the IPv4 address space (4 billion values) takes seconds and completely defeats the anonymisation.

The new implementation uses BLAKE2b-256 with a secret key stored in /etc/news/nnrpd_hmac.key (readable only by the news system user). BLAKE2b is a non-NIST, RFC 7693 hash function, used in libsodium, Zcash, and Argon2. In keyed mode it is functionally equivalent to a MAC: without the server key, the IP cannot be recovered from the hash even with full knowledge of the input space.

# Before (MD5, hardcoded salt - broken)
NNTP-Posting-Host: 5f4dcc3b5aa765d61d8327deb882cf99

# After (BLAKE2b-256 keyed - opaque without server key)
NNTP-Posting-Host: ec07e4e2ab7b4451c294b937e0564281dcdb28c85abe4130039f7f8e872fc976

The key is loaded lazily by the active filter and then held in memory, with no per-article file I/O after the first successful load.

2. X-Trace - removed

The X-Trace header, added by some nnrpd builds, can contain routing and timing information about the posting session. It is unconditionally removed before the article is accepted.

3. X-No-Archive - removed

The X-No-Archive header is removed from submitted articles. TCPReset does not promise that third-party archives will honour this advisory header, and it no longer injects it into outgoing posts.

X-No-Archive: removed before acceptance

4. Nym Mixnet posts - header ordering

Articles arriving through the Nym mixnet via the Hermes / Onion Courier gateway can carry two non-standard headers describing the pseudonymous path: Contact: and Nym:. The filter preserves and enforces the canonical ordering agreed with the Nym-Usenet ecosystem:

Contact: info@oc2mx.net
Nym: <pseudonym>@<host>

INN serialises non-canonical headers in insertion order. The filter achieves the correct sequence by undefining both headers and reassigning Contact: before Nym: in the rebuilt header block.

Nym Mixnet - What It Means for Posters

The Nym mixnet routes traffic through multiple relay nodes with padding and cover traffic, making traffic analysis significantly harder than with Tor. Posters who route their NNTP connection through a Nym SOCKS5 client pointed at a whitelisted network requester for tcpreset.net benefit from:

Multi-hop mixnet transport - no single node sees both sender and destination
Padding and cover traffic - timing correlation attacks are made substantially harder
Server-side: posting host and account pseudonymized, Sender and X-Trace removed, Path normalized to not-for-mail
No reader authentication required - anonymous access remains open

What Has Not Changed

Port 119 remains open - no authentication required for reading or posting
No publication or plaintext logging of reader IP addresses; protected operational records have 30-day retention
No moderation on open hierarchies
Feed relationships with eternal-september, weretis, pugleaf, endofthelinebbs unchanged

Technical Details

Server: INN 2.7.2 on Ubuntu 24.04 - Active privacy filter: Postfilter-NG 2026.08.1-rc2 in audit mode - Posting identities are encrypted in the private database - Tor use is detected internally without adding a public marker header

Current deployment and aggregate anti-spam information is published in the Postfilter-NG status page. The public report does not expose posting identities, addresses, Message-IDs or article contents.