Wyden Letter 2026 Requests NSA Guidance on Multi-Hop VPNs and Cryptographic Padding

Wyden's letter specifies questions on single-hop termination points, multi-hop routing, random delays, and padding to counter timing and volume attacks. The request targets users including government personnel and journalists facing nation-state threats. Existing NSA materials address basic encryption but omit operational details on server trust and metadata leakage.

Prior evaluations of VPN fingerprinting, including 2023 research on QUIC and TLS metadata, demonstrate that single-hop services expose sender and destination pairs to compromised exit nodes. Multi-hop designs reduce this exposure but increase latency. Apple Private Relay and Nym implement variants of these approaches; Tor provides documented multi-hop defaults with published threat models.

The letter highlights gaps in prior agency statements that recommended VPNs without specifying trust boundaries or padding requirements. Operational impact includes procurement decisions for defense contractors and configuration standards for journalists. Agencies have issued no equivalent technical depth since 2018 NIST SP 800-77 updates.

NSA response timelines remain unspecified. Any guidance would likely reference existing cryptographic standards rather than endorse commercial providers.