Published in


HOPR Basics: Proof of Relay

This is the sixth episode in our series covering the basics of HOPR. Links to previous episodes can be found at the end of the article.

There’s a paradox at the heart of building an incentivized mixnet: how do you ensure that nodes properly perform their task of relaying data, rather than just taking the incentive and doing none of the work?

HOPR’s solution is called proof of relay, and this episode will explain how it works.

Trustless Privacy

We can’t rely on people to follow the rules because it’s the right thing to do. We need to make following the rules the rational and profitable thing to do. This is the cornerstone of many crypto systems, and what makes them trustless (a slightly confusing term that means a system is trustworthy because you don’t need to trust anyone member of it). Basically, when the most selfish way to behave is also the way the system wants you to behave, we don’t need to rely on anyone being nice.

In HOPR’s case, we need a way to ensure everyone is fairly rewarded, but only after they’ve relayed the data. This mechanism needs to keep everyone honest without explicitly tracking and checking on everyone, or all the privacy work that went into designing the mixnet would be undone.

Keeping Nodes Honest

In the last episode, we looked at a naive approach to payments where the user would preload payment for the entire route through the network, and at each hop, a node runner would take their share and pass the rest on down the chain.

The problem with this is there’s no guarantees. Why not just take the money and not forward the data? The anonymity of the HOPR network would allow nodes to steal from the system without doing their relay work. Remember, only the sender knows the full route a data packet is supposed to take, and the mixing means there would be no way to track where a route failed.

So we need a way to ensure nodes only get paid after they’ve done their relaying. This is an intuitive solution. After all, people normally get paid after doing work, not before. But how can it be achieved?

One simple approach would be to try and have each node in a chain pay the previous node. So when Dmytro receives data from Chāo, he sends Chāo’s payment as a reward. But now we run into the same problem again. Why should Dmytro bother? Why not just save the effort and not send the money back? Again, the privacy of the network means there’s no way to get caught.

(This is a slight oversimplification — after all, Chāo knows he sent some data to Dmytro and knows he didn’t receive any payment. But he couldn’t prove it was malicious. Things go wrong in networks all the time! And even if Dmytro developed a reputation for not forwarding payments, he could just drop out of the network and start again with a new identity. Again, privacy becomes a double-edged sword.)

So how can we solve this?

Proof of Relay

HOPR’s innovation is to make each consecutive pair of nodes in a chain reliant on each other for payment. Chāo can’t claim payment until he relays data to Dmytro, but Dmytro also can’t claim payment until he unlocks Chāo’s share.

This is achieved through a cryptographic technique, but it’s actually simple to understand.

When data is sent through the HOPR network, a payment is generated for each node in the chain. This is locked with a cryptographic key. If you have the whole key, you can claim your payment. But if any part of it is missing, it’s worthless.

These keys are split in half, so you can only claim a payment once you have both halves.

As the data passes along the chain, consecutive pairs of nodes swap key halves with each other. Chāo swaps the first half of his key for the second half of Betty’s. He swaps the first half of Dmytro’s key for the second half of his. He can then claim his payment, but only because the data has successfully hopped from Betty to Chāo to Dmytro.

This forces everyone to play by the rules. If I’m a node receiving data from you, neither of us can claim any money unless we swap key halves. There’s no benefit to shirking your responsibility, no loophole for stealing money. The selfish thing to do is to cooperate, meaning everyone’s incentives are perfectly aligned.

Preserving Privacy

This simple but extremely powerful innovation unlocks a whole world of possibilities. With proof of relay, we can finally build a fully incentivized private mixnet that can grow to an unlimited scale, because we don’t have to rely on finding trustworthy altruistic people to run it.

We’re not out of the woods yet though. If each payment generates a transaction on a public blockchain, we’re getting dangerously close to accidentally providing a database of everything that happens in the network. HOPR uses probabilistic payments to decouple HOPR’s payment layer from the messaging layer, ensuring privacy is preserved. We’ll explain how that works next time.

Sebastian Bürgel,
HOPR Founder

Website: https://www.hoprnet.org
Twitter: https://twitter.com/hoprnet
Telegram: https://t.me/hoprnet
Discord: https://discord.gg/dEAWC4G
LinkedIn: https://www.linkedin.com/company/hoprnet
Forum: https://forum.hoprnet.org
Github: https://github.com/hoprnet

HOPR Basics Episodes:

Episode 1: What is HOPR?
Episode 2: What is Metadata?
Episode 3: Anonymous Routing
Episode 4: Mixnets
Episode 5: Incentives
Episode 6: Proof of Relay
Episode 7: Tickets and Payment Channels
Episode 8: Probabilistic Payments
Episode 9: Cover Traffic
Episode 10: Cover Traffic Nodes
Episode 11: Balancing Cover Traffic
Episode 12: Intro to the HOPR DAO



The HOPR protocol provides network-level and metadata privacy for every type of data exchange, while introducing the first-ever open incentivized mixnet, where users earn tokens for running nodes.

Get the Medium app

A button that says 'Download on the App Store', and if clicked it will lead you to the iOS App store
A button that says 'Get it on, Google Play', and if clicked it will lead you to the Google Play store