I haven't carefully looked at the current source code (if it's available) for things like "Type II Mixmaster" remailers, things which offer reply-blocks.
The source is available for mixmaster. However, Type II does not offer reply blocks.
Certainly for the canonical Cypherpunks remailer, the store-and-forward-after-mixing remailer, the fact that the nested encryption is GENERATED BY THE ORIGINATOR means that interception is useless to a TLA. The most a TLA can do is to a) not forward as planned, resulting in a dropped message, or b) see where a particular collection of random-looking (because of encryption) bits came from and where they are intended to next go.
Not necessarily. You don't have to be able to read a message to determine what it is. In the case of an amphibian remailer operator (who shall remain nameless) revealing the identity of someone using his remailer, this remop ran 2 of the three remailers being used. The chain went:
A -> B -> C -> D -> E
where A is the sender, E the recipient, and B and D are the remailers controlled by the same person. Also, if the message to E had been encrypted it wouldn't have mattered much in identifing who what sending something to whom.
The remop could tell that a message from A coming in through B always resulted in a message going to C, and that such messages always had a corresponding message from D to E. The fact that the messages were encrypted to each remailer's key, and that the middle remailers was not compromised, did not protect the user.
There were a some special circumstances to this, the biggest one being that A was sending a ton of messages, all of similar size, through the exact same chain. But it does show the problem with Type I reply blocks in use by the current system.
In particular, a TLA or interceptor or corrupted or threatened remailer operator CANNOT insert new text or new delivery instructions into packets received by his node BECAUSE HE CANNOT OPEN ANY PAYLOAD ENCRYPTED TO THE NEXT NODE. Anything he adds to the payload bits (which he can see of course, though not decrypt or make sense of) will of course make the next node see only garbage when he tries to decrypt the payload.
Of course they can't alter the encrypted text, but it may be possible to add text after the pgp-encrypted block to make tracking the messages easier. There's also the issue of taking a reply block and replaying it with new text in order to watch where it goes.
[snip]
And if even a fraction of the remailers are compromised, then with collusion they can map inputs to outputs, in many cases. (How many they can and how many they can't are issues of statistics and suchlike.)
Exactly. This is the case I was mentioning above. It shows that the "if one remailer is legit your messages are safe" line of thinking is not necessarily true.
[snip]
Adding reply-block capability significantly raises the risks for traceability, in my opinion. I am not casting doubt on the Anonymizer and on Mixmaster Type N (whatever is current), but I have not seen much detailed discussion here on the Cypherpunks list, and I am unaware of peer-reviewed papers on the cryptographic protocols being used. (If they exist, pointers here would be great to have!)
Type II is the current, though cypherpunk (Type I) are in use. II does not allow for reply blocks. Type III (mixminion) is in active development and allows for SURBs - Single Use Reply Blocks -- that will allow for nyms without having to store a set number of reply blocks that can be replayed (a la the current type I pseudonym setup)
Anyway, just a few thoughts. I'm far from an expert on this so take everything with a large grain of salt.
--B
