kHi! On 17:54 Tue 19 Mar , Michael Kafka wrote:
ohai metalab, (not an official security by candlelight, just feeling a little bit like intelligent distraction)
i'll be in the lab around 19:00
Sorry, I was not there - your announcement was way too late.
i would like to get in contact with some people who can spare time on implementing a protocol i stumbled upon a few years ago: Drac: An Architecture for Anonymous Low-Volume Communications (i think i already talked a few heads off in the recent months about this, but i'm convinced it's worth a shot) ... some papers can be found here: http://research.google.com/pubs/archive/36335.pdf ...
I have read part of the paper, but it did not really excite me. Some of the flaws: - It assumes you have a number of friends that everybody can know about and some contacts which should be secret. This sounds flawed. If you care about anonymity, you probably do not want to reveal who your friends are. Also, your real world friends are probably very unlikely to use this program. Many users will just use irc or something else to find "friends". - The entry point selection is flawed. Your entry points are on average x hops away from you. This does not apply to anybody else. If your attacker can link the IDs to the entry points (which he can, since the private presence server is not trusted), he will be able to link each ID to physical identities. And even if he cannot link the IDs to the entry points, he can probably still create a network map he watches the network closely enough. Because most of your friends are likely in same country you are in, a "global" passive observer is very likely. - Passive observers are scary. Defeating simple end to end timing attacks is the real challange. So far you can either choose between high latency and high overhead. Globally synchronizing epochs sounds like an interesting padding scheme, but it might be hard to implement. Also you still need a lot of padding and you probably do not even know how much. -Michi -- programing a layer 3+4 network protocol for mesh networks see http://michaelblizek.twilightparadox.com