problem in 3.2 "Replies"

[Zooko <zooko@zooko.com>]

Folks:

I've finally had a look at the paper.  It's impressively complete and 
well-written.  I have concentrated on section 3.2 "Replies".

It ends with "Even the crossover point cannot know if it's processing a reply 
or forward message."

Is this really true?  As far as I can see it is impossible for a sender who 
uses a reply block to generate a useful H2, because it is going to be 
encrypted by the contents of H1's which the sender does not know.  So it 
appears to me that if your node opens a header and finds a "swap" instruction 
therein, then he knows that this is a sender-anonymous ("forward") message.

Perhaps I am confused about the distinction between the "two legs" of the 
header swap technique and the "two legs" that get generated if both the sender 
and the receiver desire anonymity.  Perhaps the difference between these 
concepts should be spelled out explicitly at the beginning of this section.

Regards,

Zooko

Zooko.Com -- Security and Distributed Systems Engineering