Joan Feigenbaum, Aaron Johnson, Paul F. Syverson: A Model of Onion Routing with Provable Anonymity. Financial Cryptography 2007: 57-71