http://tttyx2vwp7ihml3vkhywwcizv6nbwrikpgeciy3qrow7l7muak2pnhad.onion/Publications.html
[ PDF ] Onion routing is a scheme for anonymous communication that is
designed for practical use. Until now, however, it has had no formal
model and therefore no rigorous analysis of its anonymity
guarantees. We give an IO-automata model of an onion-routing
protocol and, under possibilistic definitions, characterize the
situations in which anonymity and unlinkability are guaranteed.