What's the purpose of Kovri?

Question

Obviously the literal purpose of Kovri is to hide the IP address associated with Monero network activity, but what does this achieve in the sense of improving the anonymity of transactions?

I could see the anonymity benefit of decoupling one's IP address from one's addresses if stealth addresses were not a thing. If that was the case, and all inputs (including decoys) came from a single address per wallet, it would be possible for a sufficiently powerful adversary to inject a large number of nodes into the network, associate each new transaction with the first IP found to broadcast it, and then associate this IP to an address by taking the set of all transactions believed to have originated at that IP and finding the most commonly referenced address among that set. Non-full nodes that connect to one of the adversary's Sybil nodes could also be identified this way. This attack would unveil the true "sent from" address in monitored transactions, and allow this address to be filtered as a decoy from any transactions not successfully monitored in this way. Kovri would serve as a defense against this attack, as you could no longer associate an IP address with a transaction broadcast.

Stealth addresses would seem to have already resolved this issue though. As each transaction sends Monero to a completely different address and stealth addresses are not linkable (barring a breakthrough in cryptography), it seems like it would be highly unlikely that you would ever see the same address appearing in the blockchain twice as a real input. As a result, the heuristic of "the address most commonly seen in transactions broadcast from this IP is the address used by the person at this IP" breaks down.

I guess using Kovri hides the fact that you're using Monero, but it just replaces "is using Monero" with "is using I2P," which seems equally suspicious from the perspective of someone operating in an adversarial local network.

Am I missing something here? I'm sure there's a very good reason for Kovri to be implemented, it's just that from the perspective of transaction anonymity I can't see it. Please correct me if I'm wrong.

Answer 1

Firstly, Kovri is an abandoned i2p router implementation. There are plenty of other actively developed i2p routers (such as i2p-zero), all of which can be configured to work with Monero via the various Anonymity Network options.

Second, when discussing anonymity of transactions, there are multiple threat models that need considering. By default, Monero transactions on the blockchain hide the sender and recipient wallet addresses and the transaction amounts. However, this alone does not cover all possible threat models. A simple example could be a regime that outlaws cryptocurrencies. Simply running a node then becomes a threat. One also needs to consider various deanonimization attacks. If a vendor/exchange/ISP is coerced or compromised, transactions could be linked to IP addresses, and IP addresses link to actual identities via the network providers.

This is why it's soo important to consider all possible places that data can be leaked and all types of adversaries. Hiding the sender and receiver wallet addresses and the transaction amounts from the publicly visible blockchain covers some threat models, but not all.

What tor/i2p aim to do is hide network usage. If a transaction is broadcast over i2p/tor, it's considerably harder to tie that transaction to an IP address and thus a real world identity.

It's also worth noting that tor/i2p are not silver-bullets here, which is why other techniques have also been under development, such as adding network "noise" and some kind of Dandelion++ implementation.