One Time Reply Blocks (was Re: strengthening remailer protocols)

On Sun, 8 Sep 1996, Lance Cottrell wrote:

> Mixmaster prevents replay, so flooding multiple copies of a single message
> will not work. This is the reason Mixmaster has no reply block feature. I
> can see two ways in which replies can work safely.

To paraphrase John Von Neumann, any system which uses reply blocks is in a
state of sin.  By this I mean that if there is a chain pointing at you, a
sufficiently powerful attacker can walk down that chain and find you.

Given that, I will join the state of sin by proposing a mechanism which
will allow Alice to receive a reply from Bob, but change her mind at any
time.  The basic idea is to have a one-time reply block which either Bob or
Alice can send to.  If Alice thinks that too much time has elapsed, and
powerful enemies are walking down her reply block chain, she can send
herself a reply and break the chain.  (She might send a reply thru each
link in the chain to break all the links.)

It also occurs to me that since email addresses are about the same size as
secure symmetric keys, it would be attractive to use real one time pads
instead of symmetric key cyphers for encrypting them.


-------------------------------------------------------------------------
Bill Frantz       | "Lone Star" - My personal  | Periwinkle -- Consulting
(408)356-8506     |  choice for best movie of  | 16345 Englewood Ave.
frantz@netcom.com |  1996                      | Los Gatos, CA 95032, USA

At 4:19 PM -0700 9/9/96, Bill Frantz wrote:
>On Sun, 8 Sep 1996, Lance Cottrell wrote:
>
>> Mixmaster prevents replay, so flooding multiple copies of a single message
>> will not work. This is the reason Mixmaster has no reply block feature. I
>> can see two ways in which replies can work safely.
>
>To paraphrase John Von Neumann, any system which uses reply blocks is in a
>state of sin.  By this I mean that if there is a chain pointing at you, a
>sufficiently powerful attacker can walk down that chain and find you.
>
>Given that, I will join the state of sin by proposing a mechanism which
>will allow Alice to receive a reply from Bob, but change her mind at any
>time.  The basic idea is to have a one-time reply block which either Bob or
>Alice can send to.  If Alice thinks that too much time has elapsed, and
>powerful enemies are walking down her reply block chain, she can send
>herself a reply and break the chain.  (She might send a reply thru each
>link in the chain to break all the links.)

The reason the message is not resendable is that the remailers keeps track
of the serial number of that header. If forced, the log of serial numbers
could be deleted, and the operator would process the message.

Unless you are assuming some key archived by each remailer for the reply
block, then I think it will be possible to repair the chain.

	-Lance

----------------------------------------------------------
Lance Cottrell   loki@obscura.com
PGP 2.6 key available by finger or server.
Mixmaster, the next generation remailer, is now available!
http://www.obscura.com/~loki/Welcome.html or FTP to obscura.com

"Love is a snowmobile racing across the tundra.  Suddenly
it flips over, pinning you underneath.  At night the ice
weasels come."
                        --Nietzsche
----------------------------------------------------------