🤖 AI Summary
To address sender/receiver identity leakage, eavesdropping by intermediaries, lack of key forward secrecy, and unverifiable final states in privacy-preserving communication on the Internet Computer Protocol (ICP), this paper proposes ICPP—the first end-to-end privacy-preserving transport architecture tailored for ICP. Methodologically, it employs dual short-lived intermediaries to decouple access and storage, integrates sealed storage with TEE-based trusted destruction; introduces the first non-interactive encapsulation scheme based on rank-deficient matrix power functions (RDMPF); enables fingerprint-free receiver discovery via publicly known prompts; and ensures auditable final states and liveness verifiability through certified destruction intent and zero-knowledge proofs. Formal verification confirms correctness of encapsulation, prompt privacy, authorization reliability, and timeout-based key revocation. The system is deployed on the ICP mainnet, enabling high-privacy, verifiable, and censorship-resistant secure transport.
📝 Abstract
This paper presents a private transfer architecture for the Internet Computer (ICP) that decouples deposit and retrieval through two short-lived intermediaries, with sealed storage and attested teardown by an ephemeral witness. The protocol uses a non-interactive RDMPF-based encapsulation to derive per-transfer transport keys. A public notice hint is computed from the capsule to enable discovery without fingerprinting the recipient's key. Retrieval is authorized by a short proof of decapsulation that reveals no identities. All transaction intermediaries are ephemeral and issue certified destruction intents and proofs, allowing a noticeboard to publish auditable finalization records. The design provides sender identity privacy with respect to the recipient, content confidentiality against intermediaries, forward secrecy for transport keys after staged destruction, verifiable liveness and finality. We formalize the basic interfaces, provide the security arguments for encapsulation correctness, hint privacy, authorization soundness and timeout reclaim.
In terms of implementation, it has been recently brought into production on the ICP under the name ICPP. It has been subject to exhaustive testing and incorporates a few enhancements, focusing on the operational possibilities offered by ICP's technology. This work hence serves as a broad reference for the protocol now publicly accessible.