Cryptography

Proof of Work — a toll with no bulk discount

Privex can’t check ID, so it can’t rate-limit by who you are. Instead every new account or lookup must solve a puzzle whose price climbs with the crowd — cheap for one person, ruinous for a botnet.

Imagine a toll road that doubles its price every time the queue gets longer. One driver barely notices. A thousand drivers? Each one pays a full day’s wages just to merge — and there’s no carpool discount. That’s proof-of-work: the puzzle gets harder as traffic spikes, and every bot pays the full inflated price on its own.

Hybrid hashcash: a SHA-256 pre-filter (22→31 leading-zero bits) plus a memory-hard Argon2id step (32 MiB, 1→4 bits). Difficulty auto-climbs from aggregate Redis pressure counters — no per-IP or per-identity state to evade. Work is per-attempt and non-amortizable: a fleet of N bots pays N × the inflated per-solve cost, and the Argon2id memory wall neutralizes GPU/ASIC parallelism.

Try it: how a botnet’s bill explodes

Drag to grow the attacker’s fleet. Watch the puzzle difficulty rise and the total cost detonate — because every bot pays the full inflated price.

1 user 1 bot
Puzzle difficulty
22 bits
Cost per bot
1×
Total attacker cost
1×

One puzzle, once. Solved in milliseconds. You never notice.

What the toll blocks

Attack

Register accounts faster than any human, using scripts across many machines.

Wall

Every account costs a solved puzzle that gets harder as the crowd grows.

Hybrid PoW gates /keys/register; difficulty climbs from aggregate pressure — no per-IP state to rotate around.

Attack

Probe id after id to map who uses Privex.

Wall

Every lookup costs a puzzle too, so mapping the userbase gets expensive fast.

Bundle fetch + KT proof + OPAQUE init are PoW-gated, plus a 30/60s per-target cap as defense in depth.

Attack

Spam garbage answers, hoping the server wastes work anyway.

Wall

Every puzzle is single-use — even a wrong answer burns it, so it can’t be replayed.

Invalid attempts still GETDEL the challenge; a concurrency semaphore caps simultaneous Argon2id verifies.

Why a botnet can’t win The cost curve isn’t a line, it’s a cliff. There’s no shared credit and no parallelism trick: each bot pays the full inflated price independently, and the memory-hard step means a GPU farm is bandwidth-bound, not compute-bound.