\section{Possible Attacks}

In implementing the above goals, the system is going to come under a
variety of attacks.  We have have attemped to consider most of these
in advance.  There are three primary modes of attack: on the Mixnet,
on the Servnet, and on individual files.  We have considered all three
of these, and take appropriate countermeasures.  In particular, we
expect the following sorts of attacks:

\begin{enumerate}
\item{Attacks on the Communications Medium}
\begin{enumerate}
\item The communications medium is either vulnerable to traffic
analysis or involves a high degree of latency -- and thus requires a
great deal of space.  
\item Traffic Analysis Attacks are normally difficult.  They can be
made easier by volunteering to become part of the communications
medium.  This shortens the eventual path-length considerably.
\item Attack the time-synchronization protocol to reduce the latency
of the system and ease traffic analysis. %We rely on the inherent security of the time-synchronization protocol for protection against this attack.
\end{enumerate}

\item{Attacks on the Servnet}
\begin{enumerate}
\item Go find a physical servnet node, and prosecute the owner based
on its contents.
\item Physically destroy a servnet node.  This attacks the
trust-system as well as the integrity of the data in the network.
\item Become part of the Servnet.  Earn trust, then betray it.  We need an analysis of how much trust (in megabyte-days or comparable units) you need to betray in order to do real damage.
\item Attack the time-synchronization protocol to make files expire
earlier than expected.  %We rely on the inherent security of the time-synchronization protocol for protection against this attack.
\item Make it appear that a servnet node has violated the protocols in
such a way as to reduce trust in it.
\item Appear to violate the protocols.  When someone points this out,
show him wrong and accuse him of the above attack.
\item Claim that the servnet or mixnet concept is patented or
otherwise illegal.  Sue the Free Haven Project and any node
administrators.
\item Trade garbage into the servnet, gain trust, then delete what you
get before it expires.  %We rely on the redundancy of the servnet to protect against this attack, and on the trust protocols to attempt to get useful work out of the attacker in proportion to the amount of damage he can do.  
We need an analysis of how much damage can be
done per unit of useful work.
\item Attack the generosity of individuals: increase the personal cost
of running a servnet or mixnet node, either by adding a monetary cost
to moving large quantities of data around, or by adding a bad
reputation such as ``harboring terrorist data and kiddie porn''.  %We
%rely on the strength of our comrades revolutionary consciousness for
%protection against this attack.
\end{enumerate}

\item{Attacks on a File}
\begin{enumerate}
\item Attack to find the publisher (or shepherd) of a document.
\item Attack to find people interested in a particular document.
Claim to have one, and see who requests it.%  We rely on the Mixnet for protection from this attack.
\item Swap until you have enough fragments of a file you object to,
then destroy them.  %We rely on the quantity of data in the servnet to make this infeasible.
\item Conspire to make a cause ``unpopular''.  Convince servnet node
administrators that they don't want to be hosting data for these
unpopular causes, and that they should manually prune their data.  %We rely on the content-blindness of the system for protection against this attack.
\item Insert false fragments into the servnet.  %We rely on the cryptographic signatures which identify file fragments for protection against this attack.
\end{enumerate}
\end{enumerate}

In order to counter the above attacks, we have evolved a number of defenses:
\begin{enumerate}
\item{Physical Security:} This is the responsibility of individual servnet node owners.  In the event of failure here, we fallback on the robustness of the data storage system. \emph{2a, 2b}
\item{The Trust System:} This serves two functions.  First, it ensures that anybody entering the servnet provides useful work in proportion to the amount of damage they can do.  Second, it provides a measure of accountability.  Those who do good things are trusted to do good things again, and those who do bad things are trusted to do bad things again. \emph{2c,2e,2f,2h}
\item{The Mixnet:} This preserves the essential anonymity and untracability of the service.  Its latency also protects against traffic analysis. \emph{1a, 1b, 2b, 3a, 3b}
\item{Cryptographic Signatures of Fragments:}  Strong cryptography protects us against spoofing of fragments, as well as providing a convenient tagging mechanism. \emph{3e}
\item{Data Duplication:} By dividing a file into many fragments, not
all of which are needed to reconstruct it, we gain protection against
the destruction or duplicity of Servnet nodes. \emph{2c,2b,2h, 3c}
\item{Legal Protections:} Information illegal in one place is
frequently legal in others.  Global oppression of a piece of
information is very rare.  The content-blindness of the system also
makes it difficult to prosecute. \emph{2a,2g}
\item{The Time-Synchronization Protocol:} We rely on its security as
an abstracted object. \emph{1c,2d}
\item{Volunteerism and the Hacker Ethic:} Owning a node of this
service is still going to put an administrator in a potentially tricky
situation.  We rely on the Hacker ethic and a commitment to free
information flow to provide volunteers \emph{2i, 3d}
\end{enumerate}
