1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
|
<!doctype html>
<html lang="en">
<head>
<meta charset="utf-8">
<meta name="viewport" content="width=device-width, initial-scale=1">
<meta name="description" content="YAMN Web 2 architecture: a Nym-before-YAMN send-only interface for email and Usenet messages.">
<title>YAMN Web 2 | Nym before YAMN</title>
<style>
:root {
color-scheme: dark;
--bg: #080b10;
--surface: #10161f;
--surface-strong: #151e2a;
--text: #edf4f8;
--muted: #9aaaba;
--line: #263545;
--cyan: #57e6ff;
--green: #79f2b0;
--violet: #b89cff;
--amber: #ffc66d;
--shadow: 0 22px 60px rgba(0, 0, 0, .28);
}
* { box-sizing: border-box; }
html { scroll-behavior: smooth; }
body {
margin: 0;
background:
radial-gradient(circle at 15% 0%, rgba(87, 230, 255, .10), transparent 34rem),
radial-gradient(circle at 90% 18%, rgba(184, 156, 255, .10), transparent 30rem),
var(--bg);
color: var(--text);
font: 16px/1.7 Inter, ui-sans-serif, system-ui, -apple-system, BlinkMacSystemFont, "Segoe UI", sans-serif;
}
a { color: var(--cyan); }
a:hover { color: #a1f3ff; }
code, pre, .eyebrow, .badge, .step-number { font-family: "SFMono-Regular", Consolas, "Liberation Mono", monospace; }
main { width: min(1120px, calc(100% - 36px)); margin: 0 auto; padding: 28px 0 72px; }
.topbar { display: flex; justify-content: space-between; align-items: center; gap: 20px; margin-bottom: 72px; }
.brand { color: var(--text); text-decoration: none; font-weight: 700; letter-spacing: .08em; }
.back { color: var(--muted); text-decoration: none; }
.hero { max-width: 900px; margin-bottom: 54px; }
.eyebrow { color: var(--cyan); font-size: .78rem; letter-spacing: .16em; text-transform: uppercase; }
h1, h2, h3 { line-height: 1.15; letter-spacing: -.025em; }
h1 { max-width: 820px; margin: 14px 0 22px; font-size: clamp(2.7rem, 8vw, 5.8rem); }
h2 { margin: 0 0 16px; font-size: clamp(1.65rem, 3vw, 2.45rem); }
h3 { margin: 0 0 10px; font-size: 1.08rem; }
.lead { max-width: 780px; margin: 0; color: var(--muted); font-size: clamp(1.08rem, 2vw, 1.35rem); }
.badges { display: flex; flex-wrap: wrap; gap: 9px; margin-top: 26px; }
.badge { padding: 6px 10px; border: 1px solid var(--line); border-radius: 999px; color: var(--green); background: rgba(121, 242, 176, .06); font-size: .76rem; }
.section { margin-top: 88px; }
.section-intro { max-width: 760px; color: var(--muted); margin-top: -4px; }
.muted { color: var(--muted); }
.panel { padding: 28px; border: 1px solid var(--line); border-radius: 18px; background: linear-gradient(145deg, rgba(21, 30, 42, .96), rgba(12, 17, 24, .96)); box-shadow: var(--shadow); }
.grid { display: grid; grid-template-columns: repeat(2, minmax(0, 1fr)); gap: 16px; }
.three { grid-template-columns: repeat(3, minmax(0, 1fr)); }
.card { padding: 22px; border: 1px solid var(--line); border-radius: 14px; background: rgba(16, 22, 31, .78); }
.card p, .card li, .section-intro, .panel p { color: var(--muted); }
.card strong, .panel strong { color: var(--text); }
.flow { display: grid; grid-template-columns: repeat(6, minmax(0, 1fr)); gap: 10px; align-items: stretch; }
.flow-step { position: relative; min-height: 154px; padding: 17px 14px; border: 1px solid var(--line); border-radius: 14px; background: var(--surface); }
.flow-step:not(:last-child)::after { content: ">"; position: absolute; right: -13px; top: 50%; z-index: 2; color: var(--cyan); transform: translateY(-50%); font-weight: 700; }
.step-number { display: block; margin-bottom: 18px; color: var(--cyan); font-size: .76rem; }
.flow-step p { margin: 0; color: var(--muted); font-size: .91rem; line-height: 1.45; }
.flow-step:nth-child(3) { border-color: rgba(184, 156, 255, .55); }
.flow-step:nth-child(4) { border-color: rgba(121, 242, 176, .55); }
.crypto-list { display: grid; gap: 12px; margin: 20px 0 0; padding: 0; list-style: none; }
.crypto-list li { display: grid; grid-template-columns: 180px 1fr; gap: 18px; padding: 14px 0; border-top: 1px solid var(--line); }
.crypto-list strong { color: var(--cyan); }
.crypto-list span { color: var(--muted); }
.callout { border-left: 4px solid var(--amber); }
.callout p:last-child { margin-bottom: 0; }
pre { margin: 20px 0 0; overflow-x: auto; padding: 20px; border: 1px solid var(--line); border-radius: 12px; background: #070a0e; color: #ccecf2; line-height: 1.55; }
ul { padding-left: 1.25rem; }
li { margin: 8px 0; }
.footer { margin-top: 78px; padding-top: 22px; border-top: 1px solid var(--line); color: var(--muted); }
@media (max-width: 900px) {
.flow { grid-template-columns: repeat(3, minmax(0, 1fr)); }
.flow-step:not(:last-child)::after { display: none; }
.three { grid-template-columns: 1fr; }
}
@media (max-width: 640px) {
main { width: min(100% - 24px, 1120px); padding-top: 18px; }
.topbar { margin-bottom: 52px; }
.grid, .flow { grid-template-columns: 1fr; }
.panel, .card { padding: 20px; }
.crypto-list li { grid-template-columns: 1fr; gap: 4px; }
}
</style>
</head>
<body>
<main>
<nav class="topbar" aria-label="Primary navigation">
<a class="brand" href="./">YAMNWEB2</a>
<a class="back" href="./">Back to the interface</a>
</nav>
<header class="hero">
<div class="eyebrow">Architecture note / send-only gateway</div>
<h1>Nym before YAMN.</h1>
<p class="lead">The browser sends the form to this host over HTTPS or the Onion service. PHP then runs the local <code>yamn-encode</code> program, which creates the encrypted YAMN v2 packet in server memory before Nym transport starts.</p>
<div class="badges">
<span class="badge">Nym-first transport</span>
<span class="badge">YAMN v2 envelope</span>
<span class="badge">Email + Usenet</span>
<span class="badge">Send-only</span>
</div>
</header>
<section class="section">
<h2>Where YAMN encryption happens</h2>
<p class="section-intro"><strong>It happens locally on the YAMNWeb host, before the message enters Nym.</strong> It does not happen in the browser, in JavaScript, in Apache, or in Nym.</p>
<div class="grid three">
<article class="card">
<h3>1. Browser</h3>
<p>The browser sends the form fields, including the message body, to YAMNWeb through HTTPS or the Onion service. The page contains no JavaScript cryptography and does not hold YAMN remailer keys.</p>
</article>
<article class="card">
<h3>2. Local encoder</h3>
<p>Apache serves PHP. PHP validates the request and starts the local Go binary <code>yamn-encode</code>. That binary reads the selected remailers' public keys and creates the encrypted YAMN envelope in RAM on this host.</p>
</article>
<article class="card">
<h3>3. Nym transport</h3>
<p>Only after encoding, PHP starts the local Rust Nym sender. It receives the finished armored YAMN envelope and the selected Entry address needed by the Nym relay service, not separate form fields.</p>
</article>
</div>
<div class="panel callout">
<p><strong>This is server-side encryption, not browser-side end-to-end encryption.</strong> The plaintext exists in the PHP process and in <code>yamn-encode</code> memory while the packet is being built. The message becomes opaque to Nym only after the local YAMN encoder has finished.</p>
</div>
</section>
<section class="section">
<h2>The active path</h2>
<p class="section-intro">This diagram names the actual components. Apache is the web server, PHP is the application runtime, and <code>yamn-encode</code> is the local program that performs YAMN encryption.</p>
<div class="panel">
<div class="flow" aria-label="Message route">
<div class="flow-step"><span class="step-number">01 / BROWSER</span><h3>Compose</h3><p>No YAMN encryption or crypto JS</p></div>
<div class="flow-step"><span class="step-number">02 / APACHE + PHP</span><h3>Receive</h3><p>Plaintext reaches PHP on this host</p></div>
<div class="flow-step"><span class="step-number">03 / GO ENCODER</span><h3>Encrypt</h3><p>Builds YAMN v2 envelope in RAM</p></div>
<div class="flow-step"><span class="step-number">04 / NYM</span><h3>Mix</h3><p>Carries envelope to the relay service</p></div>
<div class="flow-step"><span class="step-number">05 / RELAY SERVICE</span><h3>Forward</h3><p>Reads Entry address, not message contents</p></div>
<div class="flow-step"><span class="step-number">06 / YAMN</span><h3>Open layers</h3><p>Entry, Middle, Exit</p></div>
</div>
<pre>Browser -- HTTPS or Onion --> Apache + PHP -- plaintext in RAM --> local Go yamn-encode
-- encrypted YAMN envelope --> Rust Nym sender --> Nym mixnet
--> Nym relay service --> YAMN Entry --> Middle --> Exit --> SMTP or Mail-to-News</pre>
</div>
</section>
<section class="section">
<h2>Where Tor fits</h2>
<div class="grid">
<article class="card">
<h3>Onion interface</h3>
<p>The existing Onion address provides an alternate way to reach the same web interface. It does not change the message format or create a second delivery protocol. The public HTTPS and Onion interfaces serve the same application.</p>
</article>
<article class="card">
<h3>Remailer data</h3>
<p>Tor is used for remailer statistics and public-key material downloads, with Victor's Echolot pinger as the primary configured source and fallback pingers when needed.</p>
</article>
</div>
<div class="panel callout">
<p><strong>The message submission path is Nym-first after local YAMN encoding.</strong> On this host, PHP calls <code>yamn-encode</code>; that local program encrypts the message. PHP then gives Nym the opaque envelope and its selected Entry address. The Nym relay service receives the envelope and forwards it to that Entry.</p>
<p class="muted">The relay service can read the Entry address because it must choose the SMTP destination, but it cannot open the YAMN message or its next-hop headers. In the current deployment, it uses a Tor SOCKS connection for this SMTP leg to the YAMN Entry. This is separate from the browser-to-service transport.</p>
</div>
</section>
<section class="section">
<h2>Cryptographic layers</h2>
<p class="section-intro">YAMN uses hybrid cryptography: asymmetric encryption protects the instruction header for each remailer, while fresh symmetric keys encrypt the bulk packet layers. The Nym SDK is a separate transport layer with its own network cryptography.</p>
<div class="panel">
<ul class="crypto-list">
<li><strong>NaCl box</strong><span>One header is encrypted to the public key of every selected remailer, Entry, Middle, and Exit. Only the holder of that remailer's private key can open its header. It uses Curve25519 authenticated public-key encryption with XSalsa20-Poly1305.</span></li>
<li><strong>AES-256-CTR</strong><span>Fresh, random symmetric keys encrypt the packet payload and intermediate header slots in nested layers. This is efficient for the fixed-size packet; the corresponding AES key is placed inside the header that only the relevant remailer can open.</span></li>
<li><strong>BLAKE2s-256</strong><span>Anti-tags and packet digests detect altered or incorrectly layered packet data.</span></li>
<li><strong>Random per message</strong><span>Keys, IVs, packet identifiers, nonces, padding bytes, and header values are generated for each envelope.</span></li>
<li><strong>Transport boundary</strong><span>The Nym sender accepts the armored YAMN envelope and the selected Entry address needed by the Nym relay service. It does not receive the message fields separately.</span></li>
</ul>
</div>
</section>
<section class="section">
<h2>How a message is layered and opened</h2>
<p class="section-intro">Yes: the completed packet is addressed first to the selected YAMN Entry. However, it already contains encrypted instructions for the Middle and Exit. Nym and the relay service do not decrypt YAMN; each remailer opens only the part intended for its role.</p>
<div class="grid">
<article class="card">
<h3>1. Building the packet</h3>
<p>The encoder reads the selected Entry, Middle, and Exit public keys from the local keyring. It places the SMTP message in a fixed-size packet, encrypts it for the Exit with a fresh AES key, then wraps it in additional AES layers for the Middle and Entry.</p>
<p>It adds one public-key-encrypted header per remailer. The Entry header says how to reach the Middle and contains the key for the Entry layer; the Middle header similarly leads to the Exit; the Exit header contains the final AES key needed to recover the SMTP message.</p>
</article>
<article class="card">
<h3>2. Opening one step at a time</h3>
<p>The relay service submits the finished packet to the selected Entry over SMTP. The Entry uses its private key to open only its header, learns the Middle address and the AES key for its outer layer, removes that layer, and forwards the packet.</p>
<p>The Middle repeats the operation for the Exit. Neither Entry nor Middle has the private key needed to open another remailer's header, and neither receives the final plaintext message.</p>
</article>
<article class="card">
<h3>3. Final delivery</h3>
<p>The Exit opens the last header, verifies the packet integrity data, and uses the final AES key and initialization vector to recover the original SMTP message.</p>
<p>The Exit then delivers that ordinary message to the email recipient or to the configured Mail-to-News service. The final recipient does not need a YAMN key or special software.</p>
</article>
</div>
<div class="panel callout">
<p><strong>Nym does not decrypt the message.</strong> Nym carries the already layered YAMN packet to the server-side relay service. The YAMN remailers perform the sequential opening, and the Exit is the component that turns the packet back into an SMTP message.</p>
</div>
</section>
<section class="section">
<h2>YAMN chain and destinations</h2>
<div class="grid">
<article class="card">
<h3>Three YAMN roles</h3>
<ul>
<li><strong>Entry</strong> receives the packet and removes the first layer.</li>
<li><strong>Middle</strong> forwards the still-layered packet.</li>
<li><strong>Exit</strong> removes the final layer and delivers through SMTP.</li>
</ul>
<p>The <code>*</code> option selects an available remailer from the local statistics list.</p>
</article>
<article class="card">
<h3>Email or Usenet</h3>
<p>For email, the selected recipient is placed inside the encrypted message. For Usenet, the selected newsgroup is preserved and the server-configured Mail-to-News recipient performs SMTP-to-NNTP conversion.</p>
<p><strong>References</strong> accepts one or more Message-IDs and links the article to an existing Usenet thread. The last Message-ID is also emitted as <strong>In-Reply-To</strong>. The separate <strong>Reply-To</strong> field is an optional email response address; neither field enables message retrieval in this send-only service.</p>
</article>
</div>
</section>
<section class="section">
<h2>Data handling and limits</h2>
<div class="grid">
<article class="card">
<h3>Kept minimal</h3>
<ul>
<li>The message and encrypted envelope are held in memory by the submission route.</li>
<li>The Nym client keeps only technical transport state.</li>
<li>The public keyring and remailer statistics are service data.</li>
<li>The web session stores CSRF and minimum request state.</li>
</ul>
</article>
<article class="card">
<h3>Send-only by design</h3>
<p>There is no inbox, message fetching, message viewing, or reply retrieval. Acceptance by the Nym sender confirms that transport started, not that a remailer delivered the message.</p>
<p>YAMN remailer queues may introduce delays of several hours, especially for Usenet publication.</p>
</article>
</div>
<div class="panel callout">
<p><strong>Privacy still depends on use.</strong> Message wording, timing, recipient choice, browser state, and operational mistakes can reveal information outside the cryptographic packet. Do not submit passwords, private keys, or data that must not leave your device.</p>
</div>
</section>
<footer class="footer">
<p>YAMN Web 2 is a send-only Nym-before-YAMN interface. <a href="./">Return to message composition</a>.</p>
</footer>
</main>
</body>
</html>
|
