canpolatOriginal post
Sep 29, 2026
Hi all,
Posting this as a draft for discussion before any implementation work.
Canton’s need-to-know model protects transaction content. It does not hide the envelope: timing, ordering, message size and communication patterns remain observable, and that is enough for correlation attacks that reconstruct who transacted with whom, when and at roughly what size.
The draft proposes four mechanisms at the synchronizer and sequencing layer. The load-bearing one is auditable cover traffic, which is an attempt to answer the objection that has kept traffic shaping off regulated ledgers: each decoy is a commitment, opaque to observers and openable by an authorised auditor, so the noise is provably honest.
No proof-of-concept has been built. I would rather have the problem statement and the approach examined first. Four specific questions are listed at the end of the draft.
Full draft below.
Best,
Abdulkadir Canpolat
Team Lead, The Hub
canpolat@... <mailto:canpolat@...>
————————————————————————————————————
CIP: <unassigned>
Title: Metadata Privacy for Canton
Author: Abdulkadir Canpolat (The Hub) <canpolat@... <mailto:canpolat@...>>
Status: Draft
Type: Standards Track
Created: 2026-09-29
Discussions-To: cip-discuss@... <mailto:cip-discuss@...>
# Metadata Privacy for Canton
Extending need-to-know privacy from transaction content to transaction metadata.
## Abstract
Canton’s need-to-know model keeps transaction content confidential at the protocol level. It does not hide the envelope. Even when content is perfectly protected, the synchronizer and Super Validators still observe timing, ordering, message size, and the pattern of which participants communicate. That residual signal is sufficient for traffic-analysis and correlation attacks that can reconstruct who transacted with whom, when, and at roughly what size, without ever seeing content.
This proposal specifies a Metadata Privacy Layer: four coordinated mechanisms at the synchronizer and sequencing layer that make metadata as need-to-know as content already is. They are fixed-size message bucketing, epoch-quantized sequencing, auditable cover traffic, and participant-set unlinkability.
The central contribution is auditable cover traffic. Cover traffic is the standard defence against traffic analysis, and it has been rejected for regulated ledgers for one reason: blind decoys are indistinguishable from real settlement, which breaks audit and cost accounting. This proposal makes each decoy a cryptographic commitment that is opaque to observers and openable by an authorized auditor. Privacy and audibility stop being a trade-off.
## Motivation
Canton already solves the hardest part. A transaction is decomposed into a tree split by party, and each participant receives only the view that applies to it. For the parts a participant is not entitled to, it sees neither payload nor metadata, not even who the other parties are. In a delivery-versus-payment settlement the cash bank sees only the cash leg while the securities custodian sees only the securities leg, within a single transaction. This proposal does not question that model and does not modify it.
The open surface is one layer above. Super Validators are, by design, blind traffic controllers: they never see raw content, but they do observe limited metadata. From message size, arrival time, ordering and routing, an observer can infer transaction class and value band, and can correlate on-ledger events with off-venue activity.
This is the named institutional fear for large execution and active strategies: timing and size correlation exposing deal flow and enabling front-running. Content privacy does not address it. Metadata privacy does.
Two further points make this worth the network’s attention now.
It targets an open surface rather than a solved one. Most privacy proposals restate content privacy, which Canton already has.
It answers the privacy argument and the transparency argument with the same mechanism. Institutions get protection against deal-flow leakage. Those who worry that privacy conceals misconduct get the opposite of opacity: noise whose honesty is cryptographically provable to an auditor.
## Specification
Four mechanisms, designed to compose with the existing model rather than replace any part of it.
### 1. Fixed-size message bucketing
Every protocol message is padded up to the nearest size in a small set of fixed buckets before it reaches the sequencer. Transaction type and value band can no longer be read off message length, because a small payment and a large settlement present identically on the wire. Padding is deterministic, cheap, and introduces no trust assumptions. It removes the size dimension of correlation entirely.
Open parameters for discussion: the bucket ladder, and whether bucketing applies to confirmation responses as well as confirmation requests.
### 2. Epoch-quantized sequencing
Rather than exposing precise per-message timestamps, the sequencer commits messages into discrete time epochs. Ordering, fairness and finality within an epoch are preserved, so correctness is unchanged, while the fine-grained timing signal that powers correlation is blurred.
Epoch length becomes a tunable privacy parameter. Longer epochs give stronger unlinkability, shorter epochs give lower latency. Each deployment chooses its point on that curve.
Open parameters for discussion: epoch length bounds, and the interaction with existing latency and liveness expectations.
### 3. Auditable cover traffic
This is the mechanism that unlocks the rest, and the one where prior attempts stalled.
Cover traffic means sending decoy messages so that real activity hides in a crowd. It has not been adopted on an institutional ledger because blind decoys are indistinguishable from real transactions, which is unacceptable for audit, cost accounting and regulatory reporting. A regulated network cannot run on noise that nobody, including the regulator, can separate from settlement.
This proposal makes cover traffic auditable. A decoy is not blind noise, it is a commitment. When a participant emits a decoy it publishes a cryptographic commitment binding that message as a decoy, opaque to Super Validators and to any external observer, and openable by an authorised auditor holding a viewing key.
Required properties:
- Indistinguishability to observers. Super Validators, other participants and outside analysts cannot tell a decoy from a real message. The crowd is genuine, so correlation fails.
- Selective operability to auditors. A holder of the appropriate viewing key can distinguish real from decoy after the fact, and can verify that decoys carried no value and settled nothing.
- Non-repudiable accounting. Because decoys are committed, they cannot later be reinterpreted as real, and real transactions cannot be disguised as decoys.
Open questions for discussion: the commitment scheme and viewing-key custody model, who is entitled to hold a viewing key, and how decoy traffic is accounted for against synchronizer traffic fees.
### 4. Participant-set unlinkability
Even with padding, epochs and cover traffic, the sequencer could still learn which set of participants co-occur if confirmation routing reveals it. Confirmation and routing messages should be structured so that the sequencer cannot map the stakeholder set of a given transaction, for example through re-randomizable routing or anonymous confirmation credentials, so that the who-with-whom graph cannot be reconstructed from routing alone.
Open questions for discussion: whether this is achievable without weakening the BFT guarantees of the sequencing layer.
## Rationale
The four mechanisms are separable and address distinct correlation channels: size, timing, volume and topology. Each closes one channel and none is sufficient alone, which is why they are proposed together rather than individually.
Auditable cover traffic is the load-bearing idea. The reason cover traffic has been rejected for regulated ledgers is not that it fails technically, it is that it destroys the audit trail. Committing each decoy inverts that: privacy is obtained while audibility is strengthened, because the honesty of the noise is itself provable. The weakness that previously blocked traffic shaping becomes the property that makes it acceptable.
Alternatives considered and set aside: application-layer batching, which shifts the problem to applications and leaves the network-level signal intact; and reducing Super Validator visibility, which conflicts with the operational role Super Validators have in traffic control and fee accounting.
## Backwards compatibility
The mechanisms are designed to compose with the existing model rather than replace any part of it. Content privacy, the sub-transaction view model, and the confirmation protocol are unchanged.
Bucketing and epoch quantization change wire-level behavior and sequencing timing, so they require protocol-version coordination and would affect latency characteristics. Cover traffic introduces messages that must be accounted for in traffic fees without being counted as economic activity. Participant-set unlinkability touches routing and is the most invasive of the four.
A staged adoption path is therefore assumed: the mechanisms can be introduced independently and in increasing order of invasiveness.
## Reference implementation
None, deliberately.
This draft is posted for discussion before any implementation work, so that the problem statement and the proposed approach can be examined by Super Validators, technical contributors and others in the ecosystem while the proposal is still being shaped.
If the direction is validated in discussion, the author offers to write the full specification and to build and open-source a proof-of-concept covering the padding and epoch behavior and a working model of the auditable cover-traffic commitment scheme, including the auditor open-and-verify path.
Production integration into the core synchronizer and sequencer is protocol-level work that belongs with Digital Asset and the Foundation through the normal review process. No claim is made that it can or should be delivered independently.
## Feedback sought
1. Is metadata correlation considered an open surface worth addressing at protocol level, or is it regarded as acceptable residual exposure?
2. Is auditable cover traffic a credible answer to the audit objection that has blocked traffic shaping, and what would a reviewer need to see to be convinced?
3. Which of the four mechanisms, if any, is achievable independently of the others?
4. What are the latency and fee-accounting constraints that any proposal here must respect?
## Copyright
This document is placed in the public domain.
Posting this as a draft for discussion before any implementation work.
Canton’s need-to-know model protects transaction content. It does not hide the envelope: timing, ordering, message size and communication patterns remain observable, and that is enough for correlation attacks that reconstruct who transacted with whom, when and at roughly what size.
The draft proposes four mechanisms at the synchronizer and sequencing layer. The load-bearing one is auditable cover traffic, which is an attempt to answer the objection that has kept traffic shaping off regulated ledgers: each decoy is a commitment, opaque to observers and openable by an authorised auditor, so the noise is provably honest.
No proof-of-concept has been built. I would rather have the problem statement and the approach examined first. Four specific questions are listed at the end of the draft.
Full draft below.
Best,
Abdulkadir Canpolat
Team Lead, The Hub
canpolat@... <mailto:canpolat@...>
————————————————————————————————————
CIP: <unassigned>
Title: Metadata Privacy for Canton
Author: Abdulkadir Canpolat (The Hub) <canpolat@... <mailto:canpolat@...>>
Status: Draft
Type: Standards Track
Created: 2026-09-29
Discussions-To: cip-discuss@... <mailto:cip-discuss@...>
# Metadata Privacy for Canton
Extending need-to-know privacy from transaction content to transaction metadata.
## Abstract
Canton’s need-to-know model keeps transaction content confidential at the protocol level. It does not hide the envelope. Even when content is perfectly protected, the synchronizer and Super Validators still observe timing, ordering, message size, and the pattern of which participants communicate. That residual signal is sufficient for traffic-analysis and correlation attacks that can reconstruct who transacted with whom, when, and at roughly what size, without ever seeing content.
This proposal specifies a Metadata Privacy Layer: four coordinated mechanisms at the synchronizer and sequencing layer that make metadata as need-to-know as content already is. They are fixed-size message bucketing, epoch-quantized sequencing, auditable cover traffic, and participant-set unlinkability.
The central contribution is auditable cover traffic. Cover traffic is the standard defence against traffic analysis, and it has been rejected for regulated ledgers for one reason: blind decoys are indistinguishable from real settlement, which breaks audit and cost accounting. This proposal makes each decoy a cryptographic commitment that is opaque to observers and openable by an authorized auditor. Privacy and audibility stop being a trade-off.
## Motivation
Canton already solves the hardest part. A transaction is decomposed into a tree split by party, and each participant receives only the view that applies to it. For the parts a participant is not entitled to, it sees neither payload nor metadata, not even who the other parties are. In a delivery-versus-payment settlement the cash bank sees only the cash leg while the securities custodian sees only the securities leg, within a single transaction. This proposal does not question that model and does not modify it.
The open surface is one layer above. Super Validators are, by design, blind traffic controllers: they never see raw content, but they do observe limited metadata. From message size, arrival time, ordering and routing, an observer can infer transaction class and value band, and can correlate on-ledger events with off-venue activity.
This is the named institutional fear for large execution and active strategies: timing and size correlation exposing deal flow and enabling front-running. Content privacy does not address it. Metadata privacy does.
Two further points make this worth the network’s attention now.
It targets an open surface rather than a solved one. Most privacy proposals restate content privacy, which Canton already has.
It answers the privacy argument and the transparency argument with the same mechanism. Institutions get protection against deal-flow leakage. Those who worry that privacy conceals misconduct get the opposite of opacity: noise whose honesty is cryptographically provable to an auditor.
## Specification
Four mechanisms, designed to compose with the existing model rather than replace any part of it.
### 1. Fixed-size message bucketing
Every protocol message is padded up to the nearest size in a small set of fixed buckets before it reaches the sequencer. Transaction type and value band can no longer be read off message length, because a small payment and a large settlement present identically on the wire. Padding is deterministic, cheap, and introduces no trust assumptions. It removes the size dimension of correlation entirely.
Open parameters for discussion: the bucket ladder, and whether bucketing applies to confirmation responses as well as confirmation requests.
### 2. Epoch-quantized sequencing
Rather than exposing precise per-message timestamps, the sequencer commits messages into discrete time epochs. Ordering, fairness and finality within an epoch are preserved, so correctness is unchanged, while the fine-grained timing signal that powers correlation is blurred.
Epoch length becomes a tunable privacy parameter. Longer epochs give stronger unlinkability, shorter epochs give lower latency. Each deployment chooses its point on that curve.
Open parameters for discussion: epoch length bounds, and the interaction with existing latency and liveness expectations.
### 3. Auditable cover traffic
This is the mechanism that unlocks the rest, and the one where prior attempts stalled.
Cover traffic means sending decoy messages so that real activity hides in a crowd. It has not been adopted on an institutional ledger because blind decoys are indistinguishable from real transactions, which is unacceptable for audit, cost accounting and regulatory reporting. A regulated network cannot run on noise that nobody, including the regulator, can separate from settlement.
This proposal makes cover traffic auditable. A decoy is not blind noise, it is a commitment. When a participant emits a decoy it publishes a cryptographic commitment binding that message as a decoy, opaque to Super Validators and to any external observer, and openable by an authorised auditor holding a viewing key.
Required properties:
- Indistinguishability to observers. Super Validators, other participants and outside analysts cannot tell a decoy from a real message. The crowd is genuine, so correlation fails.
- Selective operability to auditors. A holder of the appropriate viewing key can distinguish real from decoy after the fact, and can verify that decoys carried no value and settled nothing.
- Non-repudiable accounting. Because decoys are committed, they cannot later be reinterpreted as real, and real transactions cannot be disguised as decoys.
Open questions for discussion: the commitment scheme and viewing-key custody model, who is entitled to hold a viewing key, and how decoy traffic is accounted for against synchronizer traffic fees.
### 4. Participant-set unlinkability
Even with padding, epochs and cover traffic, the sequencer could still learn which set of participants co-occur if confirmation routing reveals it. Confirmation and routing messages should be structured so that the sequencer cannot map the stakeholder set of a given transaction, for example through re-randomizable routing or anonymous confirmation credentials, so that the who-with-whom graph cannot be reconstructed from routing alone.
Open questions for discussion: whether this is achievable without weakening the BFT guarantees of the sequencing layer.
## Rationale
The four mechanisms are separable and address distinct correlation channels: size, timing, volume and topology. Each closes one channel and none is sufficient alone, which is why they are proposed together rather than individually.
Auditable cover traffic is the load-bearing idea. The reason cover traffic has been rejected for regulated ledgers is not that it fails technically, it is that it destroys the audit trail. Committing each decoy inverts that: privacy is obtained while audibility is strengthened, because the honesty of the noise is itself provable. The weakness that previously blocked traffic shaping becomes the property that makes it acceptable.
Alternatives considered and set aside: application-layer batching, which shifts the problem to applications and leaves the network-level signal intact; and reducing Super Validator visibility, which conflicts with the operational role Super Validators have in traffic control and fee accounting.
## Backwards compatibility
The mechanisms are designed to compose with the existing model rather than replace any part of it. Content privacy, the sub-transaction view model, and the confirmation protocol are unchanged.
Bucketing and epoch quantization change wire-level behavior and sequencing timing, so they require protocol-version coordination and would affect latency characteristics. Cover traffic introduces messages that must be accounted for in traffic fees without being counted as economic activity. Participant-set unlinkability touches routing and is the most invasive of the four.
A staged adoption path is therefore assumed: the mechanisms can be introduced independently and in increasing order of invasiveness.
## Reference implementation
None, deliberately.
This draft is posted for discussion before any implementation work, so that the problem statement and the proposed approach can be examined by Super Validators, technical contributors and others in the ecosystem while the proposal is still being shaped.
If the direction is validated in discussion, the author offers to write the full specification and to build and open-source a proof-of-concept covering the padding and epoch behavior and a working model of the auditable cover-traffic commitment scheme, including the auditor open-and-verify path.
Production integration into the core synchronizer and sequencer is protocol-level work that belongs with Digital Asset and the Foundation through the normal review process. No claim is made that it can or should be delivered independently.
## Feedback sought
1. Is metadata correlation considered an open surface worth addressing at protocol level, or is it regarded as acceptable residual exposure?
2. Is auditable cover traffic a credible answer to the audit objection that has blocked traffic shaping, and what would a reviewer need to see to be convinced?
3. Which of the four mechanisms, if any, is achievable independently of the others?
4. What are the latency and fee-accounting constraints that any proposal here must respect?
## Copyright
This document is placed in the public domain.