Piercing network anonymity in real time

Ivan Krstic <krsticfas.harvard.edu> writes:

> Calling this "piercing network anonymity in real
time" is highly
> misleading; in reality, it's more like "making
it bloody obvious
> that there's no such thing as network
anonymity".

No.  Ever hear of Chaum's "Dining
Cryptographers" [1]?  Anonymity
right there at the table.  Been around for almost twenty
years.

Strong anonymity is available today using chains of
random-latency,
mixing, anonymizing remailers based on mixmaster [2], of
which there
is a thriving worldwide network [3].

> The best one can hope for today is a bit of anonymous
browsing and
> IM with Tor ...

Tor is indicted by its own documentation:

   ... for low-latency systems like Tor, end-to-end traffic
   correlation attacks [8, 21, 31] allow an attacker who can
observe
   both ends of a communication to correlate packet timing
and volume,
   quickly linking the initiator to her destination. [4]


[1] "The Dining Cryptographers Problem: Unconditional
Sender
Untraceability," D.  Chaum, (invited) Journal of
Cryptology, vol. 1
no. 1, 1988, pp. 65-75.
ftp://ftp.csua.berkeley.edu/pub/cypherpunks/papers/chaum.din
ing.cryptographers.gz
http://www.e-
ztown.com/cryptopapers.htm
http://ci
teseer.nj.nec.com/context/143887/0

[2] http://so
urceforge.net/projects/mixmaster/.

[3] See usenet newsgroup alt.privacy.anon-server.

[4] http://tor.eff.org/cvs/tor/doc/design-paper/challenges
.pdf

------------------------------------------------------------
---------
The Cryptography Mailing List
Unsubscribe by sending "unsubscribe
cryptography" to majordomometzdowd.com

StealthMonger wrote:
> No.  Ever hear of Chaum's "Dining
Cryptographers" [1]?  Anonymity
> right there at the table.  Been around for almost
twenty years.
> Strong anonymity is available today using chains of
random-latency,
> mixing, anonymizing remailers based on mixmaster [2],
of which there
> is a thriving worldwide network [3].

You're, er, missing the point entirely. The system Jerry
posted about
relies on sniffing traffic of commonly used services to
passively gather
layer 8 information. The vast majority of regular computer
users had,
and largely still have, an expectation of privacy from their
use of
these standard, non-encrypted services such as plain e-mail
and IM; it's
*this* privacy that I said never existed, except in the
minds of
uneducated users.

This is also why there's no "piercing of
anonymity" going on -- there's
no anonymity to pierce! If Jerry's system had the ability
to, say,
perform attacks on Tor and similar systems to gather data,
then one
could argue for piercing anonymity as an accurate
description.

-- 
Ivan Krstic <krsticfas.harvard.edu> | GPG: 0x147C722D


------------------------------------------------------------
---------
The Cryptography Mailing List
Unsubscribe by sending "unsubscribe
cryptography" to majordomometzdowd.com