Vuvuzela

Vuvuzela is a research messaging system built to protect not just the content of messages but also metadata, such as who is talking to whom, even against powerful nation-state adversaries. It grew out of an academic research project, presented at SOSP 2015, aimed at showing that strong metadata privacy could scale to millions of users rather than just small groups.

Earlier systems that hid metadata using Tor, such as Pond, were vulnerable to traffic analysis, while systems that fully encrypted metadata with techniques like DC-nets or PIR did not scale past thousands of users. Vuvuzela instead uses efficient cryptography, based on NaCl, to encrypt as much metadata as it can, and adds statistical noise to the parts it cannot encrypt, such as the number of idle versus active users, providing differential privacy guarantees instead of perfect secrecy. In practice this results in message latency of roughly 20 to 40 seconds depending on configured security parameters.

Vuvuzela is written in Go and released under a license listed as Other in the repository metadata, so check the license file for exact terms. It is primarily a research artifact demonstrating the approach described in its accompanying paper and slides, rather than a polished, actively maintained messaging product.