  Anycast messaging (i.e., sending a message to an unspecified receiver) has
long been neglected by the anonymous communication community. An anonymous
anycast prevents senders from learning who the receiver of their message is,
allowing for greater privacy in areas such as political activism and
whistleblowing. While there have been some protocol ideas proposed, formal
treatment of the problem is absent. Formal definitions of what constitutes
anonymous anycast and privacy in this context are however a requirement for
constructing protocols with provable guarantees. In this work, we define the
anycast functionality and use a game-based approach to formalize its privacy
and security goals. We further propose Panini, the first anonymous anycast
protocol that only requires readily available infrastructure. We show that
Panini allows the actual receiver of the anycast message to remain anonymous,
even in the presence of an honest but curious sender. In an empirical
evaluation, we find that Panini adds only minimal overhead over regular
unicast: Sending a message anonymously to one of eight possible receivers
results in an end-to-end latency of 0.76s.
