  We present Loopix, a low-latency anonymous communication system that provides
bi-directional 'third-party' sender and receiver anonymity and unobservability.
Loopix leverages cover traffic and brief message delays to provide anonymity
and achieve traffic analysis resistance, including against a global network
adversary. Mixes and clients self-monitor the network via loops of traffic to
provide protection against active attacks, and inject cover traffic to provide
stronger anonymity and a measure of sender and receiver unobservability.
Service providers mediate access in and out of a stratified network of Poisson
mix nodes to facilitate accounting and off-line message reception, as well as
to keep the number of links in the system low, and to concentrate cover
traffic. We provide a theoretical analysis of the Poisson mixing strategy as
well as an empirical evaluation of the anonymity provided by the protocol and a
functional implementation that we analyze in terms of scalability by running it
on AWS EC2. We show that a Loopix relay can handle upwards of 300 messages per
second, at a small delay overhead of less than 1.5 ms on top of the delays
introduced into messages to provide security. Overall message latency is in the
order of seconds - which is low for a mix-system. Furthermore, many mix nodes
can be securely added to a stratified topology to scale throughput without
sacrificing anonymity.
