[freehaven-cvs] Tighten conclusion; hunt more orphans

[nickm@seul.org (Nick Mathewson)]

Update of /home/freehaven/cvsroot/doc/e2e-traffic
In directory moria.mit.edu:/tmp/cvs-serv26553

Modified Files:
	e2e-traffic.tex 
Log Message:
Tighten conclusion; hunt more orphans

Index: e2e-traffic.tex
===================================================================
RCS file: /home/freehaven/cvsroot/doc/e2e-traffic/e2e-traffic.tex,v
retrieving revision 1.47
retrieving revision 1.48
diff -u -d -r1.47 -r1.48
--- e2e-traffic.tex	2 May 2004 22:23:49 -0000	1.47
+++ e2e-traffic.tex	2 May 2004 22:40:20 -0000	1.48
@@ -148,8 +148,8 @@
 The attacks in this paper fail to work when:
 \begin{tightlist}
 \item Alice's behavior is not consistent over time.  If Alice does not
-  produce enough traffic with the same group of regular recipients,
-  the attacker cannot learn Alice's behavior.
+  produce enough traffic with the same recipients,
+  the attacker cannot learn her behavior.
   %%We will quantify what `enough' means below.
     % if it's true that we will, we should probably shout it louder
     % in the abstract. guess we'll wait to see if we do. -RD
@@ -592,10 +592,10 @@
 On the other hand, if Alice's behavior $\V{v}$ remains consistent
 while the behavior of the background traffic $\V{u}$ changes slowly, the
 attacker still has some hope.  Rather than estimating a single $\B{U}$
-from observations to which Alice does not contribute, the attacker
+from rounds to which Alice does not contribute, the attacker
 estimates a series of successive $\B{U_i}$ values based on the
 average behavior of the network during comparatively shorter
-durations of time.  Now the attacker observes $\V{o_i}$ as before and
+durations of time.  The attacker observes $\V{o_i}$ and
 computes the average of $\V{o_i} - \B{U_i}$, as before.  Now,
 \[ \V{v} \propto \frac{1}{t}\sum_{i=1}^t \V{o_i} - \B{U_i}
 \]
@@ -642,11 +642,11 @@
 messages in the same class are likelier to come from the same sender than two
 messages chosen at random.
 
-The easiest scenario for partitioning is pseudonymity: in a typical
+For example, in a typical
 pseudonym service, each sender has one or more pseudonyms and each
 delivered messages is associated with a pseudonym.
 To link senders and recipients, an attacker only needs to link senders to
-their pseudonyms.  To do so, he can treat
+their pseudonyms.  He can do so by treating
 pseudonyms as virtual message
 destinations: instead of collecting observations $\V{o_i}$ of
 recipients who receive messages in round $i$, the attacker now
@@ -1021,10 +1021,9 @@
 %intersection attacks can be considered a closed problem.
 Our model differs most from reality in four ways: First, real user behavior
 is more complex than we have assumed. Second, user behavior changes over
-time.  Third, real messages often exhibit full or partial linkability (as
-described in section~\ref{subsec:strenghtening}), which we have not
-simulated.  Fourth, real attackers are not limited to passive observation.
-We each of these points before.
+time.  Third, real messages often exhibit full or partial linkability, which
+we have not simulated.  Fourth, real attackers are not limited to passive
+observation.  We consider each of these points below.
 % These need to get re-ordered. -NM
 
 Although real social networks behave more like scale-free networks than like
@@ -1089,26 +1088,24 @@
 
 \subsubsection{Implications for mix network design:}
 %\label{subsubsec:implications}
-If we were to design a mix network based on our findings here, what steps
-should we take to frustrate intersection attack?
+What steps
+should mix-net designers take to frustrate intersection attacks?
 
-The first lesson is this: {\bf high variability} in message delays is
-essential.  By `spreading' the effects of each incoming message over several
-output rounds, variability in delay increases each message's anonymity set, and
-amplifies the effect of padding.
+First, {\bf high variability} in message delays is essential.  By `spreading'
+the effects of each incoming message over several output rounds, variability
+in delay increases each message's anonymity set, and amplifies the effect of
+padding.
 
 {\bf Padding} seems to slow traffic analysis, especially when the padding is
 consistent enough to prevent the attacker from gaining a picture of the
 network in Alice's absence.  On the other hand, significant padding volumes
 may be too cumbersome for most users, and perfect consistency (sending
-padding messages from the moment a network goes online to the moment it shuts
+padding from the moment a network goes online until it shuts
 down) is similarly difficult.
 
-Users should be educated about the effects of their chosen {\bf message
-volume}: sending infrequently is safe, especially if the user doesn't
-repeat the same traffic pattern long enough for the attacker to identify
-it. Conversely, sending ``almost always'' is comparatively safe.
-But users in between appear vulnerable to intersection attacks.
+Users should be educated about the effects of {\bf message volume}: sending
+infrequently is relatively safe, especially if the user doesn't repeat the
+same traffic pattern for long.
 
 %The threat of non-global observers must not be ignored.
 Mix networks should take steps to {\bf minimize the proportion of observed
@@ -1136,7 +1133,6 @@
 towards quantification of risk for given parameters of
 adversaries, senders, and mixes.
 
-
 % We said that fixed entry/exit might help too, but I now think it
 % wouldn't.  Suppose the attacker observes c nodes out of n.  If I
 % choose random paths, the attacker sees (c/n)^2 of my traffic with

***********************************************************************
To unsubscribe, send an e-mail to majordomo@seul.org with
unsubscribe freehaven-cvs       in the body. http://freehaven.net/