Re: anonymous mailing lists

From: Jeffrey A Nimmo <janimmo@ionet.net>
> On Fri, 28 Jun 1996 ichudov@algebra.com wrote:
> > Then users of alpha.c2.org will have to install mail filters that
> > automatically delete all incoming mail not intended to be read by them
> > (they can't read such messages anyway).
> 
> How exactly would this be done? Since messages from alpha.c2.org
> are conventionally encrypted, they don't contain key id's. 
> 
> Wouldn't that require every recipient to store his/her passphrase
> and call pgp for every message to see if it could be decrypted? This in
> and of itself would be a more serious security breach, not to mention an 
> _enormous_ drain on site resources. 

Since the PGP is run on private computers, and only at mail-reading time,
there should be no problem entering the conventional encryption
passphrase and checking to see whether the messages decrypt.  Actually
PGP puts a pattern at the beginning of the encrypted portion, so
successful decryption can be checked very quickly, without much of a
computational load.

Hal

On Sat, 29 Jun 1996, Hal wrote:

> Since the PGP is run on private computers, and only at mail-reading time,
> there should be no problem entering the conventional encryption
> passphrase and checking to see whether the messages decrypt.  Actually
> PGP puts a pattern at the beginning of the encrypted portion, so
> successful decryption can be checked very quickly, without much of a
> computational load.

OK, so now I'm downloading twenty times as much anonymous mail (the original
scenario called for a 20:1 increase). Suppose for a minute that I'm doing
something really silly, like subscribing to cypherpunks through a nym (as 
some do). Now, instead of an average of sixty messages a day, I'm getting 
twelve hundred. I think my ISP might have something to say about that.

Also, who on earth would be willing to even double the load on his server 
in order to enact this? I doubt that Mr. Parekh or anyone else would do it.

Can anyone do the math as to what the quotient would have to be in order to
defy traffic analysis? It seems to me that even twenty to one would fool 
a determined attacker only for a while. After all, we're not talking 
about a very large pool. Presumably only those individuals who had a nym
on a particular server would be chosen for this mail blind.