[freehaven-cvs] yet more cleaning

[arma@seul.org (Roger Dingledine)]

Update of /home/freehaven/cvsroot/doc/fc03
In directory moria.seul.org:/home/arma/work/freehaven/doc/fc03

Modified Files:
	econymics.tex 
Log Message:
yet more cleaning


Index: econymics.tex
===================================================================
RCS file: /home/freehaven/cvsroot/doc/fc03/econymics.tex,v
retrieving revision 1.14
retrieving revision 1.15
diff -u -d -r1.14 -r1.15
--- econymics.tex	15 Sep 2002 20:16:33 -0000	1.14
+++ econymics.tex	15 Sep 2002 21:10:46 -0000	1.15
@@ -393,7 +393,7 @@
 ..\right) a_{i}^{d}-c_{r}\left( ..\right) a_{i}^{r}-c_{n}\right) 
 \end{equation*}
 
-where $u,\theta ,\gamma $, and $\partial $ are unspecified functional forms.
+where $u, \theta, \gamma$, and $\partial$ are unspecified functional forms.
 The payoff function $u$ includes the costs and benefits for all the possible
 actions of the agents, including \textit{not} using the mix-net and
 instead sending the messages through a non-anonymous channel. We can
@@ -418,7 +418,7 @@
 distinct from the costs and benefits from keeping the \emph{information}
 anonymous. For example, when Alice anonymously contacts a merchant
 to purchase a book, she will gain a profit equal to the difference
-between her evaluation of the good and its price. But if her anonymity
+between her valuation of the good and its price. But if her anonymity
 is compromised during the process, she will incur losses completely
 independent from the price of the book or her valuation of it. The payoff
 function $u_{i}$ above allows us to represent the duality implicit in
@@ -465,31 +465,35 @@
 plus the expected losses for losing anonymity after the investment are less
 than the expected losses from not sending the message at all.
 
-\section{Applications}
+\section{Applying the model}
 
 \label{sec:application}
 
-In this section we apply the above framework to simple scenarios. To make
-the framework workable we propose a number of assumptions. These assumptions
-let us model the behavior of the participants to mix-net systems as players
-in a repeated-game, simultaneous-move game theoretical framework. Thus we
-are able to analyze the economic justifications for the various choices of
-the participants, and compare different implementations of mix-net systems.
+In this section we apply the above framework to simple scenarios. We make
+a number of assumptions to let us model the behavior of the participants
+as players in a repeated-game, simultaneous-move game theoretical
+framework. Thus we are able to analyze the economic justifications for
+the various choices of the participants, and compare design approaches
+to mix-net systems.
 
 Consider a set of $n_{s}$ agents interested in sending anonymous
 communications. Imagine that there is only one system which can be used to
-send anonymous messages, and one another system to send non anonymous
+send anonymous messages, and one other system to send non-anonymous
 messages. Each user has three options: only send her own messages through
-the mix-net, or send her messages but also act as node forwarding other
-users' messages, or not using the system at all (by sending a message
-without using the mix-net, or by not sending the message at all). This means
-that initially we do not consider the strategy of choosing to be a bad node
+the mix-net; send her messages but also act as a node forwarding
+messages from other users; or not use the system at all (by sending a message
+without using the mix-net, or by not sending the message at all). Thus
+initially we do not consider the strategy of choosing to be a bad node
 or additional honest strategies like creating and receiving dummy traffic.
 We represent the game as a simultaneous-move, repeated-game because the
-large number of participants and the limited commmitment produced to earlier
-actions suggest against using a sequential approach \textit{a la }%
-Stackleberg. With a large group size there might be no discernable nor
-agreeable order for the actions of all participants, hence actions can be
+large number of participants, plus the fact that earlier actions indicate
+only a weak commitment to future actions,
+% did my changes just make this statement incorrect?
+suggest against using a sequential approach \textit{a la }
+Stackleberg.
+%cite?
+With a large group size there might be no discernable nor
+agreeable order for the actions of all participants, so actions can be
 considered simultaneous. The limited commitment produced by earlier actions
 allow us to consider a repeated-game scenario. We also imagine that the need
 to send a message at each period is high enough that a ``war of attrition''
@@ -497,26 +501,23 @@
 
 \subsection{Adversary}
 
-We do not consider our strategic agents as potentially choosing to be bad
-nodes; nonetheless we do consider that there may be a percentage of bad
-nodes and that agents respond to this possibility. Specifically we assume a
-global passive adversary (GPA) that can observe all traffic on all links
+Strategic agents cannot choose to be bad nodes in this simplified
+scenario. But we do assume there is a percentage of bad nodes and that
+agents respond to this possibility. Specifically we assume a global
+passive adversary (GPA) that can observe all traffic on all links
 (between users and nodes, between nodes, and between nodes or users and
 recipients). Additionally, we also study the case when the adversary
 includes some percentage of mix-nodes. In choosing strategies agents will
-attach a subjective probability to arbitrary nodes being compromised, i.e.,
+attach a subjective probability to arbitrary nodes being compromised ---
 all nodes not run by the agent are assigned the same probability of being
-compromised by that agent. This will be a factor in their assessment of the
-probability of the anonymity of messages they send. For our purposes, it
-will not matter whether the set of compromised nodes is static or dynamic
-(as in \cite{syverson_2000}). In general, we assume that all agents will
-attach the same probability of compromise to all nodes (except for nodes
-that an agent herself owns). A purely passive adversary is unrealistic in
-most settings, e.g., it assumes that hostile users never selectively send
-messages at certain times or routes, and neither nodes nor links ever
-selectively trickle or flood messages \cite{trickle02}. Nonetheless, a \emph{%
-global} passive adversary is still quite strong, indeed unrealistically so,
-and a typical starting point of anonymity analyses.
+compromised. This factor influences their assessment of the anonymity of
+messages they send. For our purposes, it will not matter whether the set
+of compromised nodes is static or dynamic (as in \cite{syverson_2000}). A
+purely passive adversary is unrealistic in most settings, e.g., it assumes
+that hostile users never selectively send messages at certain times or
+routes, and nodes and links never selectively trickle or flood messages
+\cite{trickle02}. Nonetheless, a \emph{global} passive adversary is still
+quite strong, and thus a typical starting point of anonymity analyses.
 
 \subsection{(Honest) Agents}
 

***********************************************************************
To unsubscribe, send an e-mail to majordomo@seul.org with
unsubscribe freehaven-cvs       in the body. http://freehaven.net/