Security, Privacy & EU Regulations Oblivious Protocols & Anonymity

32. Web Anonymity: Oblivious HTTP (OHTTP) & Private State Tokens

Decouple client network identities from application payloads with Oblivious HTTP (OHTTP), issue fraud-preventing Private State Tokens, and integrate onion routing.

anonymity-oblivious.ts
typescript 
// 1. Oblivious HTTP (OHTTP / RFC 9458) Request Encapsulation
export interface OHttpConfig {
  gatewayUrl: string;
  relayUrl: string;
  keyConfig: Uint8Array; // HPKE Public Key
}
export async function sendObliviousRequest(
  config: OHttpConfig,
  requestPayload: Uint8Array
): Promise<Uint8Array> {
  // Client encrypts payload for Gateway using HPKE (RFC 9180)
  const encryptedPayload = await encryptHpke(config.keyConfig, requestPayload);
  // Client routes via Relay (Relay only sees Client IP, never plaintext)
  const response = await fetch(config.relayUrl, {
    method: 'POST',
    headers: { 'Content-Type': 'message/ohttp-req' },
    body: encryptedPayload
  });
  const encryptedResponse = new Uint8Array(await response.arrayBuffer());
  return decryptHpke(config.keyConfig, encryptedResponse);
}
// 2. Onion Routing Header for Tor Anonymity
export function setTorOnionHeader(headers: Headers, onionAddress: string) {
  headers.set('Onion-Location', `http://${onionAddress}.onion`);
}

Web Anonymity & Oblivious Protocol Architectures

Decoupling network identities (IP addresses, TLS signatures) from application layer requests enables true privacy-preserving telemetry, anti-fraud verifications, and anonymous browsing.

  • Oblivious HTTP (OHTTP / RFC 9458): Employs Hybrid Public Key Encryption (HPKE / RFC 9180) across an untrusted Relay and a Target Gateway. The Relay knows the client IP but cannot read the encrypted payload; the Gateway decrypts the payload but never knows the client IP.
  • Private State Tokens (PST / Privacy Pass RFC 9578): Uses blind signatures (VOPRF) to issue cryptographic tokens that prove a client passed anti-bot or subscriber checks without revealing identity across different domains.
  • Onion-Location & Hidden Services: Advertises authenticated Tor onion endpoints directly via HTTP response headers, allowing privacy-conscious clients to route traffic through 6-hop encrypted circuits.
  • Differential Privacy in Telemetry: Injects calibrated mathematical noise into aggregate metrics to guarantee individual user actions cannot be reconstructed.
Oblivious HTTP & Privacy Pass (PST) Simulator Anonymity 2026
Oblivious HTTP (RFC 9458 / HPKE Encrypted) Relay ⮂ Gateway Topology
1. Client:

Encrypts HPKE

2. OHTTP Relay:

Sees IP Only

3. Target Gateway:

Sees Payload Only

Neither party possesses both the client IP address and the plain application request payload.

Private State Tokens (RFC 9578 Blind Auth) 5 Tokens Remaining

Cryptographically proves human verification or subscription status across origins without cross-site tracking.

←
31. Web Privacy Engineering, Tracking Defenses & Anti-Fingerprinting
33. Robots, AI Web Scrapers & Bot Mitigation Architecture
→