2026-schadt-breaking-partially-fixing
findings extracted from this paper
The Fragging attack exploits message fragmentation in Nym to break sender-recipient unlinkability without any external side information. In a Shadow network simulator testbed, benign fragment sets complete in an average of 308 ms, while sets with at least one dropped fragment show completion times of ~2000 ms due to Nym's retransmission timeout—a timing signal that remains distinguishable at per-hop mixing delays of up to 500 ms.
Three conditions are jointly necessary and sufficient for a Fragging attack: (C1) the adversary can drop packets while knowing their sender—met by a malicious gateway/entry node in both Nym and Tor; (C2) the adversary can detect a missing fragment—met by Nym's explicit fragment-set identifiers and by Tor's encryption-state desynchronization on cell drop; and (C3) the adversary can learn the recipient from the surviving fragments—met in both systems because other fragments of the set arrive intact.
Fragging-like attacks on Tor allow an adversary controlling the entry node to encode at least a 1-bit confirmation signal by dropping a single stream cell and observing circuit teardown (caused by encryption-state desynchronization between client and exit relay). If the adversary knows the expected cell count, they can select which cell to drop and thereby encode log(n) bits of information to the exit relay.
Scylla, a modified Sphinx mix format, applies OAEP (an all-or-nothing transform) to the concatenated recipient address and message before splitting into fragments, so the final hop cannot recover the recipient or message without all fragments. Scylla adds only 39 bytes of header overhead over Sphinx and ~247 µs per fragment of computation time—negligible compared to Nym's default 15 ms per-hop mixing delay.
Scylla's AONT-based fragmentation closes the C3 condition for Fragging (fragment-drop as a tagging mechanism) but does not close the retransmission timing side-channel in Nym: per-fragment acknowledgments still allow a malicious recipient to measure fragment-set completion time and distinguish dropped-fragment senders. Full mitigation requires replacing per-fragment acknowledgments with per-message acknowledgments that retransmit all fragments under a fresh identifier only after the complete message is confirmed received.