Re: The Dining Cryptographers Protocol

My spin on the Dining Cryptographers Protocol is, it's nifty and
theoretically strong, but in practice mixes are better for almost all uses.

If you have N people in a DC-net, you must exchange N bits of traffic per bit
of anonymous message transmitted.  If you use mixes and send each message on
M hops, you exchange M bits of traffic per bit of anonymous message 
transmitted.  N is typically 100-10000, and M is typically 2-10.  Mixes
are more efficient.

One advantage of DC-nets is that they're instant; with mixes there must be
some delays in order to accumulate enough cover messages to defeat traffic
analysis.



-- Marc Ringuette (mnr@cs.cmu.edu)

Marc.Ringuette writes:

>My spin on the Dining Cryptographers Protocol is, it's nifty and
>theoretically strong, but in practice mixes are better for almost all
>uses.  [...]  N is typically 100-10000, and M is typically 2-10.
>Mixes are more efficient.

Let me continue to be a broken record.  Cryptography is all economics.

You want unconditional security, you pay.  Period.  Sometimes it's
worth it, sometimes it's not.  It is not up to the cryptographer to
make the economic judgement, it is up to the user.

>One advantage of DC-nets is that they're instant; with mixes there must be
>some delays in order to accumulate enough cover messages to defeat traffic
>analysis.

This idea of "delays" providing security for a mix is a common, but
incorrect, notion.  I don't think Marc is incorrect about this here,
merely unclear.  In a well used mix system, the latency time to
accumulate ten messages would be only a few minutes.

It is the reordering of the output messages with respect to the input
that provides mix security.  Any delay in merely a consequence of the
time to collect.

Eric