From 2973620997c638b019226bf4672efba4c9b03e0a Mon Sep 17 00:00:00 2001 From: Darkjay123 Date: Tue, 10 Nov 2026 01:24:11 +0000 Subject: [PATCH 1/3] feat: add approach card for private institutional messaging --- approaches/approach-private-messaging.md | 203 +++++++++++++++++++++++ 1 file changed, 203 insertions(+) create mode 100644 approaches/approach-private-messaging.md diff --git a/approaches/approach-private-messaging.md b/approaches/approach-private-messaging.md new file mode 100644 index 0000000..ad87207 --- /dev/null +++ b/approaches/approach-private-messaging.md @@ -0,0 +1,203 @@ +--- +title: "Approach: Private Institutional Messaging" +status: draft +last_reviewed: 2026-11-10 + +use_case: private-messaging +related_use_cases: [private-bonds, private-fx, private-derivatives, private-stocks] + +primary_patterns: + - pattern-l2-encrypted-offchain-audit + - pattern-regulatory-disclosure-keys-proofs +supporting_patterns: + - pattern-commit-and-prove + - pattern-mixnet-anonymity + - pattern-onion-routing + - pattern-threshold-encrypted-mempool + - pattern-user-controlled-viewing-keys + +open_source_implementations: + - url: https://github.com/element-hq/synapse + description: "Matrix homeserver reference implementation (federated, Olm/Megolm message encryption)" + language: Python + - url: https://github.com/xmtp/libxmtp + description: "XMTP messaging protocol client library (encrypted, wallet-keyed messaging)" + language: Rust + - url: https://github.com/waku-org/nwaku + description: "Waku v2 node implementation (privacy-preserving relay, mixnet-ready messaging for web3)" + language: Nim +--- + +# Approach: Private Institutional Messaging + +## Problem framing + +### Scenario + +A trading desk negotiates a EUR 40M bond block with a bank's syndicate desk over a commercial chat platform. Every message sits on a third-party server, in plaintext, on the vendor's backup schedule. When the deal settles on chain, the negotiation trail and the settlement record live in two systems with no integrity link between them. The desk needs message content to stay between counterparties, a tamper-evident audit trail for the 5-7 year retention window, and a disclosure path a regulator can exercise without reading the whole channel. + +### Requirements + +- Hide message content and negotiation history from third parties and platform operators +- Provide selective disclosure to regulators with scoped, logged access +- Produce a tamper-evident audit trail that survives 5-7 year retention +- Preserve message integrity and non-repudiation between counterparties +- Minimize leakage of communication metadata (who talks to whom, when) + +### Constraints + +- Record-keeping rules (MiFID II, Dodd-Frank) demand retrievable, retained communications +- eDiscovery and legal hold must work over encrypted archives +- Institutions already run approved messaging channels; migration is incremental +- On-chain anchoring costs and message volume must stay proportionate + +## Approaches + +### Anchored Off-chain Messaging + +```yaml +maturity: documented +context: i2i +crops: { cr: medium, o: partial, p: partial, s: medium } +uses_patterns: [pattern-l2-encrypted-offchain-audit, pattern-commit-and-prove, pattern-regulatory-disclosure-keys-proofs] +``` + +**Summary:** Counterparties message over encrypted off-chain channels they control; periodic commitments to the message log anchor integrity on chain, with disclosure keys for scoped regulator access. + +**How it works:** Each party runs or co-operates a federated messaging node (Matrix-class federation or XMTP-class protocol). Messages are encrypted between counterparties; the operator of a node holds ciphertext, not plaintext. A hash chain over the message log is committed to L1 or an L2 on a schedule ([Commit-and-Prove](../patterns/pattern-commit-and-prove.md)), so any retroactive edit to the archive breaks the anchor. Regulator access runs through disclosure keys ([Selective Disclosure](../patterns/pattern-regulatory-disclosure-keys-proofs.md)): the institution grants a scoped key over a defined period, and access is logged. + +**Trust assumptions:** +- Each institution's node operator keeps ciphertext and keys available for the retention window +- The anchoring schedule is followed honestly by at least one party (dispute path covers divergence) +- Key management over years, not minutes: retention-period keys need escrow or recovery +- Federation servers route messages but cannot read plaintext + +**Threat model:** +- A compromised node operator deletes or withholds archives; anchoring makes gaps detectable, not recoverable +- Long-lived disclosure keys leak and expose historical message ranges +- Metadata (timing, frequency, counterparties) remains visible to network observers unless routing adds cover +- Key loss after staff turnover destroys access to old archives + +**Works best when:** +- Institutions want to keep existing messaging workflows and add verifiable integrity +- Retention and eDiscovery matter more than metadata minimization +- Regulator access must be scoped and logged rather than blanket + +**Avoid when:** +- Counterparty identity itself must be hidden from third parties +- No operational capacity exists to run node infrastructure and key recovery + +### Mixnet-routed Institutional Messaging + +```yaml +maturity: concept +context: i2i +crops: { cr: medium, o: partial, p: full, s: medium } +uses_patterns: [pattern-mixnet-anonymity, pattern-onion-routing] +``` + +**Summary:** Messages route through mix networks so network observers cannot link sender to recipient or correlate timing, layering metadata protection over encrypted content. + +**How it works:** Messages are layered-encrypted ([Onion Routing](../patterns/pattern-onion-routing.md)) and batched through a mixnet ([Mixnet Anonymity](../patterns/pattern-mixnet-anonymity.md)) before delivery. Observers see cover traffic, not pairwise communication graphs. Content encryption is independent of routing, so disclosure mechanisms from the anchored approach still apply on top. + +**Trust assumptions:** +- A sufficient fraction of mix nodes is honest (mixnets degrade gracefully but leak under full compromise) +- Cover traffic volume is sustained; thin institutional traffic is easier to correlate +- Directory or routing-layer infrastructure is not a single censoring point + +**Threat model:** +- Timing correlation on low-volume institutional channels defeats batching cover +- Global passive adversaries observing entry and exit traffic +- Operational complexity concentrates risk: more moving parts, more failure points + +**Works best when:** +- Who-talks-to-whom is as sensitive as what is said +- Channels are active enough to sustain batching and cover traffic + +**Avoid when:** +- Latency budgets are tight (mix batching adds seconds to minutes) +- Compliance teams require predictable message delivery timestamps + +### Threshold-encrypted On-chain Channels + +```yaml +maturity: concept +context: i2i +crops: { cr: high, o: yes, p: full, s: medium } +uses_patterns: [pattern-threshold-encrypted-mempool, pattern-user-controlled-viewing-keys] +``` + +**Summary:** Message ciphertext lives on chain inside protocol-level encrypted channels; ordering and existence are consensus-visible while content stays hidden until authorized decryption. + +**How it works:** Messages are encrypted to a threshold key or to counterparty-derived keys and submitted on chain. Inclusion and ordering are public; content is not ([Threshold Encrypted Mempool](../patterns/pattern-threshold-encrypted-mempool.md)). Parties decrypt with their own keys ([User-controlled viewing keys](../patterns/pattern-user-controlled-viewing-keys.md)); disclosure to regulators reuses the same key structure. The chain itself becomes the tamper-evident archive, removing the separate anchoring step. + +**Trust assumptions:** +- Threshold committee liveness and honesty for any committee-gated decryption +- Counterparty key availability across the retention window +- On-chain storage costs scale with message volume + +**Threat model:** +- Threshold collusion reveals ciphertext ahead of schedule +- Channel existence and message volume remain publicly visible (traffic analysis) +- Gas costs make high-frequency negotiation uneconomic on L1; L2 moves the cost but adds an operator + +**Works best when:** +- Message integrity and ordering must be trustless, with no operator to trust +- The messaging volume is low-frequency and high-value (deal milestones, not chat) + +**Avoid when:** +- Message volume is conversational; per-message on-chain cost dominates +- Institutions require off-chain eDiscovery tooling over plaintext archives + +## Comparison + +| Axis | Anchored Off-chain Messaging | Mixnet-routed Institutional Messaging | Threshold-encrypted On-chain Channels | +|---|---|---|---| +| **Maturity** | documented | concept | concept | +| **Context** | i2i | i2i | i2i | +| **CROPS** | CR:med O:part P:part S:med | CR:med O:part P:full S:med | CR:hi O:y P:full S:med | +| **Trust model** | Node operators + anchor schedule | Mix node majority | Threshold committee | +| **Privacy scope** | Content hidden; metadata visible | Content + metadata hidden | Content hidden; existence public | +| **Performance** | Real-time; anchoring periodic | Seconds to minutes (batching) | Per-message chain latency | +| **Operator req.** | Yes (nodes + key escrow) | Yes (mix infrastructure) | No (chain-native) | +| **Cost class** | Low | Medium | High (per-message gas) | +| **Regulatory fit** | Strong (scoped disclosure, retention) | Unproven (retention and eDiscovery open) | Strong content audit; traffic visible | +| **Failure modes** | Archive gap on operator compromise; key loss | Timing correlation on thin traffic | Cost blowout; threshold collusion | + +## Persona perspectives + +### Business perspective + +Anchored Off-chain Messaging is the practical default for institutions today: it preserves approved messaging workflows, satisfies retention and eDiscovery on infrastructure the compliance team already understands, and adds the piece institutions cannot get from a vendor chat platform, which is verifiable integrity and scoped regulator access. Mixnet routing matters when counterparty graph secrecy is a competitive requirement, which is rare and expensive to sustain. Threshold-encrypted channels are worth piloting for deal milestones where no intermediary should ever hold the record, but conversational volume does not belong on chain at current costs. + +### Technical perspective + +The anchored approach is mostly integration work: federated or wallet-keyed messaging protocols exist and run, and the engineering lifts are the hash-chain anchoring job and multi-year key management, which is an unsolved operational problem more than a cryptographic one. Mixnets are the simplest to deploy as a sidecar but hardest to keep effective on thin institutional traffic; batching needs volume that two-party channels rarely produce. On-chain channels require the least infrastructure to operate and the most cryptographic care per message, and they inherit consensus-level liveness, which is either a feature or an outage dependency depending on the deal. + +### Legal & risk perspective + +This is a perspective for legal review by the deploying institution, not legal advice. Record-keeping regimes generally require retained communications to be retrievable and producible; encrypted archives with documented key escrow and logged disclosure are a design question counsel should bless early, because a key-management failure that makes old messages unrecoverable is a compliance failure, not just an outage. Whether a regulator accepts scoped key disclosure in place of direct platform access is jurisdictional and unsettled. Mixnet routing raises the question of whether metadata shielding conflicts with surveillance-oriented obligations in some regimes; the document makes no claim of acceptance in any jurisdiction. + +## Recommendation + +### Default + +Default to Anchored Off-chain Messaging: encrypted counterpart channels over institution-operated or federated nodes, periodic integrity anchors, and disclosure keys issued per investigation. It is the variant that keeps existing compliance tooling working while adding the integrity and disclosure properties that move messaging off vendor trust. + +### Decision factors + +- If counterparty graph secrecy outweighs latency, layer mixnet routing over the anchored design rather than replacing it. +- If no intermediary may ever hold the record, use threshold-encrypted on-chain channels for deal milestones. +- If message volume is high and cost-sensitive, keep conversation off chain and anchor digests only. + +### Hybrid + +Run the anchored design as the base layer, add mixnet routing on the most sensitive negotiation channels, and move contract milestones (signed term sheets, amendment notices) into on-chain encrypted channels so their ordering is trustless. One disclosure-key scheme spans all three layers so a regulator request has a single entry point. + +## Open questions + +1. **Retention key management.** What operational schemes survive 5-7 year key custody through staff turnover, without turning escrow into a single point of compromise? +2. **eDiscovery over ciphertext.** Do discovery workflows accept scoped-decryption production, or do regulators require plaintext archive access by default? +3. **Metadata standards.** Is there a shared institutional profile for mixnet-compatible messaging, or does every deployment route differently and fragment cover traffic? +4. **Anchoring cadence.** What commit frequency balances cost against the maximum window a retroactive edit could hide in? +5. **Jurisdictional acceptance.** Which record-keeping regimes recognize threshold or key-based disclosure as equivalent to platform access? From 89deb11f38be1abea3d9dd9b194c4d0274e209b8 Mon Sep 17 00:00:00 2001 From: Darkjay123 Date: Tue, 10 Nov 2026 01:26:04 +0000 Subject: [PATCH 2/3] docs: changelog entry for private institutional messaging approach (#215) --- CHANGELOG.md | 1 + 1 file changed, 1 insertion(+) diff --git a/CHANGELOG.md b/CHANGELOG.md index d0bbcee..402f876 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -4,6 +4,7 @@ All notable changes to the EthSystems Map are documented here. ## [Unreleased] +- feat(approach): [Private Institutional Messaging](approaches/approach-private-messaging.md), filling the "Approach TBD" gap on [Private Messaging](use-cases/private-messaging.md). Compares anchored off-chain messaging (documented, I2I), mixnet-routed messaging (concept) and threshold-encrypted on-chain channels (concept), with a 10-row comparison matrix, persona perspectives, a conditional recommendation and open questions. ([#215](https://github.com/ethsystems/map/pull/215)) - feat(use-case): [Private Tokenized Deposits](use-cases/private-tokenized-deposits.md), bank deposits as claims on a shared ledger: payment privacy between banks, the interbank settlement leg, and the link to the core banking system. Linked from [Private Stablecoins](use-cases/private-stablecoins.md), the [Private Payments](approaches/approach-private-payments.md) approach and the [Payments](domains/payments.md) domain. Adds RTGS to the [Glossary](GLOSSARY.md) ([#214](https://github.com/ethsystems/map/pull/214)) - fix: factual audit of the [Private FX](use-cases/private-fx.md) entry. - fix: factual audit of the [Private Repo](use-cases/private-repo.md) entry and the Private Trade Settlement cards it builds on. From 8d1b43b4ae5b0ae07cf246422ff84c2bbecc6a13 Mon Sep 17 00:00:00 2001 From: Darkjay123 Date: Tue, 10 Nov 2026 09:00:39 +0000 Subject: [PATCH 3/3] fix(approach): address maintainer review on private institutional messaging (#215) - replace stale libxmtp (MLS, inbox ID) and nwaku (Logos Delivery) entries - cite the L2 audit log pattern for anchoring, drop commit-and-prove - name sender signatures for non-repudiation; drop the dispute-path parenthetical - name the retention regimes (SEC 17a-4(b)(4), CFTC 1.31(b)) instead of a blanket 5-7 year window - add the counterparty-identity requirement and note the anchored design does not meet it alone - correct mixnet and threshold crops (p partial, o partial) - on-chain channels: encrypt to counterparty keys only, drop the threshold mempool citation (committee releases keys after inclusion, so content would go public); rename the variant - re-rate regulatory fit rows with the reason for each claim - align the mixnet sidecar claim with the trade-off sections; scope the disclosure-key scheme to the anchored layer - link the Private Messaging use case's recommended-approaches section to the card --- CHANGELOG.md | 2 +- approaches/approach-private-messaging.md | 59 ++++++++++++------------ use-cases/private-messaging.md | 6 +-- 3 files changed, 31 insertions(+), 36 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 402f876..9f67a53 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -4,7 +4,7 @@ All notable changes to the EthSystems Map are documented here. ## [Unreleased] -- feat(approach): [Private Institutional Messaging](approaches/approach-private-messaging.md), filling the "Approach TBD" gap on [Private Messaging](use-cases/private-messaging.md). Compares anchored off-chain messaging (documented, I2I), mixnet-routed messaging (concept) and threshold-encrypted on-chain channels (concept), with a 10-row comparison matrix, persona perspectives, a conditional recommendation and open questions. ([#215](https://github.com/ethsystems/map/pull/215)) +- feat(approach): [Private Institutional Messaging](approaches/approach-private-messaging.md), filling the "Approach TBD" gap on [Private Messaging](use-cases/private-messaging.md), whose recommended-approaches section now links to the card. Compares anchored off-chain messaging (documented, I2I), mixnet-routed messaging (concept) and on-chain encrypted channels (concept), with a 10-row comparison matrix, persona perspectives, a conditional recommendation and open questions. ([#215](https://github.com/ethsystems/map/pull/215)) - feat(use-case): [Private Tokenized Deposits](use-cases/private-tokenized-deposits.md), bank deposits as claims on a shared ledger: payment privacy between banks, the interbank settlement leg, and the link to the core banking system. Linked from [Private Stablecoins](use-cases/private-stablecoins.md), the [Private Payments](approaches/approach-private-payments.md) approach and the [Payments](domains/payments.md) domain. Adds RTGS to the [Glossary](GLOSSARY.md) ([#214](https://github.com/ethsystems/map/pull/214)) - fix: factual audit of the [Private FX](use-cases/private-fx.md) entry. - fix: factual audit of the [Private Repo](use-cases/private-repo.md) entry and the Private Trade Settlement cards it builds on. diff --git a/approaches/approach-private-messaging.md b/approaches/approach-private-messaging.md index ad87207..14f4afe 100644 --- a/approaches/approach-private-messaging.md +++ b/approaches/approach-private-messaging.md @@ -10,21 +10,18 @@ primary_patterns: - pattern-l2-encrypted-offchain-audit - pattern-regulatory-disclosure-keys-proofs supporting_patterns: - - pattern-commit-and-prove - pattern-mixnet-anonymity - pattern-onion-routing - - pattern-threshold-encrypted-mempool - - pattern-user-controlled-viewing-keys open_source_implementations: - url: https://github.com/element-hq/synapse description: "Matrix homeserver reference implementation (federated, Olm/Megolm message encryption)" language: Python - url: https://github.com/xmtp/libxmtp - description: "XMTP messaging protocol client library (encrypted, wallet-keyed messaging)" + description: "XMTP messaging protocol library (MLS end-to-end encryption, inbox ID identity)" language: Rust - - url: https://github.com/waku-org/nwaku - description: "Waku v2 node implementation (privacy-preserving relay, mixnet-ready messaging for web3)" + - url: https://github.com/logos-messaging/logos-delivery + description: "Logos Delivery node, formerly nwaku (Logos Messaging protocols, opt-in mix sender anonymity)" language: Nim --- @@ -34,19 +31,21 @@ open_source_implementations: ### Scenario -A trading desk negotiates a EUR 40M bond block with a bank's syndicate desk over a commercial chat platform. Every message sits on a third-party server, in plaintext, on the vendor's backup schedule. When the deal settles on chain, the negotiation trail and the settlement record live in two systems with no integrity link between them. The desk needs message content to stay between counterparties, a tamper-evident audit trail for the 5-7 year retention window, and a disclosure path a regulator can exercise without reading the whole channel. +A trading desk negotiates a EUR 40M bond block with a bank's syndicate desk over a commercial chat platform. Every message sits on a third-party server, in plaintext, on the vendor's backup schedule. When the deal settles on chain, the negotiation trail and the settlement record live in two systems with no integrity link between them. The desk needs message content to stay between counterparties, a tamper-evident audit trail for the applicable retention window, and a disclosure path a regulator can exercise without reading the whole channel. ### Requirements - Hide message content and negotiation history from third parties and platform operators - Provide selective disclosure to regulators with scoped, logged access -- Produce a tamper-evident audit trail that survives 5-7 year retention -- Preserve message integrity and non-repudiation between counterparties +- Produce a tamper-evident audit trail that survives the applicable retention period +- Preserve message integrity and non-repudiation between counterparties (sender signatures over each message) - Minimize leakage of communication metadata (who talks to whom, when) +- Hide counterparty identity from third parties where the institution requires it ### Constraints - Record-keeping rules (MiFID II, Dodd-Frank) demand retrievable, retained communications +- Retention periods differ by regime: SEC rule 17a-4(b)(4) keeps broker-dealer communications for three years; CFTC rule 1.31(b) keeps swap records for the life of the swap plus five years, and oral communications for one year - eDiscovery and legal hold must work over encrypted archives - Institutions already run approved messaging channels; migration is incremental - On-chain anchoring costs and message volume must stay proportionate @@ -59,16 +58,16 @@ A trading desk negotiates a EUR 40M bond block with a bank's syndicate desk over maturity: documented context: i2i crops: { cr: medium, o: partial, p: partial, s: medium } -uses_patterns: [pattern-l2-encrypted-offchain-audit, pattern-commit-and-prove, pattern-regulatory-disclosure-keys-proofs] +uses_patterns: [pattern-l2-encrypted-offchain-audit, pattern-regulatory-disclosure-keys-proofs] ``` **Summary:** Counterparties message over encrypted off-chain channels they control; periodic commitments to the message log anchor integrity on chain, with disclosure keys for scoped regulator access. -**How it works:** Each party runs or co-operates a federated messaging node (Matrix-class federation or XMTP-class protocol). Messages are encrypted between counterparties; the operator of a node holds ciphertext, not plaintext. A hash chain over the message log is committed to L1 or an L2 on a schedule ([Commit-and-Prove](../patterns/pattern-commit-and-prove.md)), so any retroactive edit to the archive breaks the anchor. Regulator access runs through disclosure keys ([Selective Disclosure](../patterns/pattern-regulatory-disclosure-keys-proofs.md)): the institution grants a scoped key over a defined period, and access is logged. +**How it works:** Each party runs or co-operates a federated messaging node (Matrix-class federation or XMTP-class protocol). Messages are encrypted between counterparties; the operator of a node holds ciphertext, not plaintext. Each message carries the sender's signature over the message and its chain position, which carries integrity and non-repudiation between counterparties. A hash chain over the message log is committed to L1 or an L2 on a schedule ([Low-cost L2 + Off-chain Encrypted Audit Log](../patterns/pattern-l2-encrypted-offchain-audit.md)), so a retroactive edit to an anchored range breaks the anchor. Regulator access runs through disclosure keys ([Selective Disclosure](../patterns/pattern-regulatory-disclosure-keys-proofs.md)): the institution grants a scoped key over a defined period, and access is logged. **Trust assumptions:** - Each institution's node operator keeps ciphertext and keys available for the retention window -- The anchoring schedule is followed honestly by at least one party (dispute path covers divergence) +- The anchoring schedule is followed honestly by at least one party - Key management over years, not minutes: retention-period keys need escrow or recovery - Federation servers route messages but cannot read plaintext @@ -92,7 +91,7 @@ uses_patterns: [pattern-l2-encrypted-offchain-audit, pattern-commit-and-prove, p ```yaml maturity: concept context: i2i -crops: { cr: medium, o: partial, p: full, s: medium } +crops: { cr: medium, o: partial, p: partial, s: medium } uses_patterns: [pattern-mixnet-anonymity, pattern-onion-routing] ``` @@ -118,26 +117,26 @@ uses_patterns: [pattern-mixnet-anonymity, pattern-onion-routing] - Latency budgets are tight (mix batching adds seconds to minutes) - Compliance teams require predictable message delivery timestamps -### Threshold-encrypted On-chain Channels +### On-chain Encrypted Channels ```yaml maturity: concept context: i2i -crops: { cr: high, o: yes, p: full, s: medium } -uses_patterns: [pattern-threshold-encrypted-mempool, pattern-user-controlled-viewing-keys] +crops: { cr: high, o: partial, p: partial, s: medium } +uses_patterns: [pattern-regulatory-disclosure-keys-proofs] ``` **Summary:** Message ciphertext lives on chain inside protocol-level encrypted channels; ordering and existence are consensus-visible while content stays hidden until authorized decryption. -**How it works:** Messages are encrypted to a threshold key or to counterparty-derived keys and submitted on chain. Inclusion and ordering are public; content is not ([Threshold Encrypted Mempool](../patterns/pattern-threshold-encrypted-mempool.md)). Parties decrypt with their own keys ([User-controlled viewing keys](../patterns/pattern-user-controlled-viewing-keys.md)); disclosure to regulators reuses the same key structure. The chain itself becomes the tamper-evident archive, removing the separate anchoring step. +**How it works:** Messages are encrypted to counterparty-derived keys and submitted on chain. Inclusion and ordering are public; content is not, and stays hidden from everyone without a counterparty key. Disclosure to regulators runs through scoped disclosure keys ([Selective Disclosure](../patterns/pattern-regulatory-disclosure-keys-proofs.md)). The chain itself becomes the tamper-evident archive, removing the separate anchoring step. **Trust assumptions:** -- Threshold committee liveness and honesty for any committee-gated decryption +- Counterparty key custody across the retention window - Counterparty key availability across the retention window - On-chain storage costs scale with message volume **Threat model:** -- Threshold collusion reveals ciphertext ahead of schedule +- Compromise of a counterparty decryption key reveals that pair's entire historical message archive - Channel existence and message volume remain publicly visible (traffic analysis) - Gas costs make high-frequency negotiation uneconomic on L1; L2 moves the cost but adds an operator @@ -151,28 +150,28 @@ uses_patterns: [pattern-threshold-encrypted-mempool, pattern-user-controlled-vie ## Comparison -| Axis | Anchored Off-chain Messaging | Mixnet-routed Institutional Messaging | Threshold-encrypted On-chain Channels | +| Axis | Anchored Off-chain Messaging | Mixnet-routed Institutional Messaging | On-chain Encrypted Channels | |---|---|---|---| | **Maturity** | documented | concept | concept | | **Context** | i2i | i2i | i2i | -| **CROPS** | CR:med O:part P:part S:med | CR:med O:part P:full S:med | CR:hi O:y P:full S:med | -| **Trust model** | Node operators + anchor schedule | Mix node majority | Threshold committee | +| **CROPS** | CR:med O:part P:part S:med | CR:med O:part P:part S:med | CR:hi O:part P:part S:med | +| **Trust model** | Node operators + anchor schedule | Mix node majority | Counterparty keys | | **Privacy scope** | Content hidden; metadata visible | Content + metadata hidden | Content hidden; existence public | | **Performance** | Real-time; anchoring periodic | Seconds to minutes (batching) | Per-message chain latency | -| **Operator req.** | Yes (nodes + key escrow) | Yes (mix infrastructure) | No (chain-native) | +| **Operator req.** | Yes (nodes + key escrow) | Yes (mix infrastructure) | No (counterparty keys only; an L2 adds an operator) | | **Cost class** | Low | Medium | High (per-message gas) | -| **Regulatory fit** | Strong (scoped disclosure, retention) | Unproven (retention and eDiscovery open) | Strong content audit; traffic visible | +| **Regulatory fit** | Unproven (retention satisfiable; scoped-disclosure acceptance unsettled) | Unproven (retention and eDiscovery open) | Unproven (acceptance of key-based disclosure unsettled; traffic visible) | | **Failure modes** | Archive gap on operator compromise; key loss | Timing correlation on thin traffic | Cost blowout; threshold collusion | ## Persona perspectives ### Business perspective -Anchored Off-chain Messaging is the practical default for institutions today: it preserves approved messaging workflows, satisfies retention and eDiscovery on infrastructure the compliance team already understands, and adds the piece institutions cannot get from a vendor chat platform, which is verifiable integrity and scoped regulator access. Mixnet routing matters when counterparty graph secrecy is a competitive requirement, which is rare and expensive to sustain. Threshold-encrypted channels are worth piloting for deal milestones where no intermediary should ever hold the record, but conversational volume does not belong on chain at current costs. +Anchored Off-chain Messaging is the practical default for institutions today: it preserves approved messaging workflows, satisfies retention and eDiscovery on infrastructure the compliance team already understands, and adds the piece institutions cannot get from a vendor chat platform, which is verifiable integrity and scoped regulator access. Mixnet routing matters when counterparty graph secrecy is a competitive requirement, which is rare and expensive to sustain. On-chain encrypted channels are worth piloting for deal milestones where no intermediary should ever hold the record, but conversational volume does not belong on chain at current costs. ### Technical perspective -The anchored approach is mostly integration work: federated or wallet-keyed messaging protocols exist and run, and the engineering lifts are the hash-chain anchoring job and multi-year key management, which is an unsolved operational problem more than a cryptographic one. Mixnets are the simplest to deploy as a sidecar but hardest to keep effective on thin institutional traffic; batching needs volume that two-party channels rarely produce. On-chain channels require the least infrastructure to operate and the most cryptographic care per message, and they inherit consensus-level liveness, which is either a feature or an outage dependency depending on the deal. +The anchored approach is mostly integration work: federated or MLS-based messaging protocols exist and run, and the engineering lifts are the hash-chain anchoring job and multi-year key management, which is an unsolved operational problem more than a cryptographic one. Mixnets bolt on as a sidecar but are the hardest to keep effective on thin institutional traffic; batching needs volume that two-party channels rarely produce. On-chain channels require the least infrastructure to operate and the most cryptographic care per message, and they inherit consensus-level liveness, which is either a feature or an outage dependency depending on the deal. ### Legal & risk perspective @@ -182,21 +181,21 @@ This is a perspective for legal review by the deploying institution, not legal a ### Default -Default to Anchored Off-chain Messaging: encrypted counterpart channels over institution-operated or federated nodes, periodic integrity anchors, and disclosure keys issued per investigation. It is the variant that keeps existing compliance tooling working while adding the integrity and disclosure properties that move messaging off vendor trust. +Default to Anchored Off-chain Messaging: encrypted counterpart channels over institution-operated or federated nodes, periodic integrity anchors, and disclosure keys issued per investigation. It is the variant that keeps existing compliance tooling working while adding the integrity and disclosure properties that move messaging off vendor trust. Note that the anchored design alone does not meet a hide-counterparty-identity requirement: periodic anchors expose timing and counterparty pairs on chain, so layer mixnet routing (see Decision factors) where identity secrecy is required. ### Decision factors - If counterparty graph secrecy outweighs latency, layer mixnet routing over the anchored design rather than replacing it. -- If no intermediary may ever hold the record, use threshold-encrypted on-chain channels for deal milestones. +- If no intermediary may ever hold the record, use on-chain encrypted channels for deal milestones. - If message volume is high and cost-sensitive, keep conversation off chain and anchor digests only. ### Hybrid -Run the anchored design as the base layer, add mixnet routing on the most sensitive negotiation channels, and move contract milestones (signed term sheets, amendment notices) into on-chain encrypted channels so their ordering is trustless. One disclosure-key scheme spans all three layers so a regulator request has a single entry point. +Run the anchored design as the base layer, add mixnet routing on the most sensitive negotiation channels, and move contract milestones (signed term sheets, amendment notices) into on-chain encrypted channels so their ordering is trustless. The anchored layer carries the single disclosure-key scheme so a regulator request has one entry point; the mixnet and on-chain layers keep their own access models. ## Open questions -1. **Retention key management.** What operational schemes survive 5-7 year key custody through staff turnover, without turning escrow into a single point of compromise? +1. **Retention key management.** What operational schemes survive multi-year key custody through staff turnover, without turning escrow into a single point of compromise? 2. **eDiscovery over ciphertext.** Do discovery workflows accept scoped-decryption production, or do regulators require plaintext archive access by default? 3. **Metadata standards.** Is there a shared institutional profile for mixnet-compatible messaging, or does every deployment route differently and fragment cover traffic? 4. **Anchoring cadence.** What commit frequency balances cost against the maximum window a retroactive edit could hide in? diff --git a/use-cases/private-messaging.md b/use-cases/private-messaging.md index 13173c9..f2e42b2 100644 --- a/use-cases/private-messaging.md +++ b/use-cases/private-messaging.md @@ -52,11 +52,7 @@ Settlement instructions, confirmation messages, and reconciliation communication ## 5) Recommended Approaches -Approach TBD. Consider: - -- Integration with existing institutional messaging platforms -- On-chain anchoring for message integrity with off-chain content -- Selective disclosure mechanisms for regulatory access +See detailed solution architecture and trade-offs in [**Approach: Private Institutional Messaging**](../approaches/approach-private-messaging.md): anchored off-chain messaging as the practical default (encrypted counterpart channels, periodic integrity anchors, scoped disclosure keys), mixnet-routed messaging when counterparty graph secrecy matters, and on-chain encrypted channels for deal milestones where no intermediary may hold the record. ## 6) Open Questions