Traffic Analysis

I'm curious about traffic analysis capability.  While I don't know the
exact figures involved, I'd say that Cracker throws away about 10% of the
messages it receives.  Admittedly, these are probably not encrypted
messages (I don't know.  Humans do not get to read the messages.)  Does
this make traffic analysis more difficult?

On the other side, if Cracker were to send out more messages that it takes
in, or just replace these thrown away messages with random noise messages,
perhaps encrypted, would this foil traffic analysis?

Or suppose Redneck sent each nym an encrypted message each day, or more
often?  This would be a pure nonsense message just sent out to foil traffic
analysis.  Since the server generated the nonsense message internally,
there would be no matching incoming message for Redneck.


  -- Robert Costner                  Phone: (770) 512-8746
     Electronic Frontiers Georgia    mailto:pooh@efga.org  
     http://www.efga.org/            run PGP 5.0 for my public key

At 11:28 PM 10/02/1997 -0400, you wrote:
>On the other side, if Cracker were to send out more messages that it takes
>in, or just replace these thrown away messages with random noise messages,
>perhaps encrypted, would this foil traffic analysis?

All those things help, but Eric Hughes and Raph Levien are doing some work
that looks like it's possible to do traffic analysis as long as you can
tell when messages begin and end.  I don't know if their analysis depends on
the fact that messages get smaller as they go through the remailer chain,
or whether it will also affect Mixmaster-style remailers, which split their
messages into constant-sized blocks and mix blocks from different messages.

Some things that could be done include having each remailer add 
random-sized padding and re-encrypting before sending to another remailer,
but once you get into that level of work it probably makes sense just to
switch to Mixmaster for most uses.

				Thanks!
					Bill
Bill Stewart, stewarts@ix.netcom.com
Regular Key PGP Fingerprint D454 E202 CBC8 40BF  3C85 B884 0ABE 4639