Echolot and Leuchtfeuer Measuring the Reliability of Unreliable Mixes

In a mix-net, information regarding the network health and operational behavior of the individual nodes must be made available to the client applications so they may select reliable nodes to use in each message’s path through the mix-net. We introduce the concept of a pinger, an agent which tests the reliability of individual mixes in the mix-net, and publishes results for the mix clients to evaluate. We discuss the security concerns regarding pingers, including the issues regarding anonymity set preservation, information disclosure, and node cheating. We present our software Echolot, the most comprehensive and widely adopted pinger for the Mixmaster anonymous remailer network. To address a serious anonymity weakness potentially introduced by the careless deployment of pingers, we present Leuchtfeuer, a new protocol enhancement for mix-nets. Leuchtfeuer eliminates the active and passive intersection attacks that are possible when different users obtain conflicting reliability statistics about the mix-net.