Joan Feigenbaum Aaron Johnson Paul F. Syverson A Model of Onion Routing with Provable Anonymity. 57-71 2007 conf/fc/2007 Financial Cryptography http://dx.doi.org/10.1007/978-3-540-77366-5_9 db/conf/fc/fc2007.html#FeigenbaumJS07