Silent Retrieval: Local-Consensus Reads as Information-Theoretically Unlinkable Receive

Abstract

We formalise a receive-side property of asynchronous messaging that has been implemented before and, in adjacent form, analysed before. It is the property Bitmessage relied on from 2012 — every participant holds every message and decrypts locally, so reception produces no observable event — described in the secondary literature as a form of private information retrieval by the blunt method of "everyone gets everything". Neither the property nor its information-theoretic framing is new: the Pynchon Gate applied information-theoretic private information retrieval to unlinkable pseudonymous mail retrieval in 2005, and later systems continue that line. Our contribution is narrower and is stated as such: a precise statement of the property with explicit substrate axioms under which it holds and fails, the observation that full local replication obtains the guarantee with no non-collusion assumption at all, where the PIR-based systems require multiple servers assumed not to collude, and its instantiation over a global consensus substrate replicated for reasons unrelated to messaging rather than over a bespoke flood network that its own users must sustain. When a receiver retrieves a message from a global consensus substrate (a blockchain, a globally-replicated CRDT, a federation with full replication) by holding a local complete copy of that substrate, the receiver's read operation is information-theoretically unlinkable to any specific message. There is no subscription request and no filter query. The guarantee is conditional on one assumption we make explicit and name A5' — that the client's network behaviour is independent of what the application reads — and §2.1a shows that the earlier formulation of this axiom was circular, that the mathematics given A5' is trivial, and that the real content is an unmeasured empirical claim about client software, with resource-coupled timing the most plausible way it fails. We call this property Silent Retrieval and argue it is a foundational primitive for information-theoretic messaging that has been unavailable in the messenger literature until the emergence of globally-replicated substrates (Bitcoin, Ethereum, Arweave, IPFS clusters) coincided with the availability of user-run full-node clients. Silent Retrieval extends AriaVenona's passive-receive doctrine — historically applied to radio and OTA channels — to global consensus substrates, closing the last computational anonymity gap in async messenger receive-side design. We give the formal definition, a proof that the observer's advantage is exactly zero given A5', an explicit account of the three ways A5' is known to fail, a concrete implementation for Bitcoin OP_RETURN (Substrate B of the companion Dead-Drop Family paper), the SPV/light-client fallback with degraded anonymity guarantees, and open questions for extending the property to other substrates. The experiment that would discharge A5' — instrumenting a full node and testing whether scan and no-scan epochs separate on network timing — is specified and has not been run. Keywords: receiver anonymity, unlinkability, private information retrieval, global consensus, full-node participation, one-time pad, asynchronous messaging, passive receive. ---