(FWD) Re: Remop inbreeding, or, the 'kidnap Len' attack

[Roger Dingledine <arma@mit.edu>]

I tend to agree with Adam's last statement. But for completeness, here's
a better response to my game theory question.
--Roger

----- Forwarded message from owner-mixminion-dev@freehaven.net -----

Date: Wed, 5 Mar 2003 12:05:19 -0800 (PST)
From: Alessandro Acquisti <acquisti@SIMS.Berkeley.EDU>
To: Len Sassaman <rabbi@abditum.com>
Cc: mixminion-dev@freehaven.net, <acquisti@SIMS.Berkeley.EDU>,
	<raph@levien.com>
Subject: Re: Remop inbreeding, or, the 'kidnap Len' attack

> (As a side note, there's an interesting prisoner's dilemma here. If we
> believe in the security of our batching strategies, then as long as a few
> people resist, the rest of them can yield the information without any
> harm. That is, if the threat is "we ruin your life", then *most* remailers
> can give in, knowing that the bad guy won't get enough information to
> track his victim. I've cc'ed Alessandro on this because it sounds like

This is an interesting twist. It sounds like an n-player version of the
game where if many "defect" (and give the kidnapper their keys), but a few
resist (do not release their keys), everybody will be better off except
the kidnapper himself. The kidnapper's threat will become empty, Len's
life will be saved (well, iff the kidnapper decides to act according to
game theory. More on this below...), and each type of remailer will have
done what they believed it was most ethical/right to do. So, just
following one's personal insticts may be optimal for all (iff indeed there
are "hard-core" types a la Len in the mix-net).
But then, the main difference from the vanilla prisoner's dilemma is
precisely that payoffs are not symmetric and presumably not common
knowledge. In other words: some remailers may claim they put more weight
on the integrity of the system, some on the lives of their friends - and
it may not be possible for the kidnapper to know which is which and which
is telling the truth. Hence this scenario for me is actually closer to a
signaling game (the "beer or quiche," or "wimpy and tough" type of games),
with "wimpy" nodes ready to give away their keys to save Len, and "tough"
nodes committed to save the integrity of the system at any cost. Each type
may send different signals - it may even be that all remailers in this
particular mix-net are actually "wimpy," but some are trying to playing
"tough" to impress the kidnapper, until their bluff is called.
Now, if there is a constant share of "tough" types in the system that the
kidnapper is aware of, then, even if that share is small (ie, the "tough"
types are rare compared to the wimpies), the likelihood that the kidnapper
will face at least one tough type increase with the size of the mix-net
(whether just one tough type is enough to technically "defend" the system,
I do not know). So I would say that it should not matter if the mix-net is
composed of networks of friends, or not. Rather, what matters is how
credible the "toughness" of the tough type is. This is where the problem
lies: how credible a certain node's toughness is maybe difficult to
ascertain without a prior (and, uh, quite bloody) test through which that
node/remailer gains his reputation. So if I were Len, I would not lose my
sleep on this, iff I were not the first going through the kidnapping
process...
(Then again, I would not bet my life on the fact that the kidnapper is
knowledgeable about cooperative and non-cooperative game theory)
alessandro

----- End forwarded message -----