Re: chaffing and winnowing

Rickard:
>> If chaffing and winnowing become widely used, any government that
>> already has laws against non-government sanctioned encryption
>> would easily outlaw this too [...]

clemens:
> if an ISP (or the user) adds mock datastreams for conceiling what
> he's really communicating, you're right.  but there's no need for
> that:  the ISP just appends hundreds of messages to form millions of
> data packets, each with its own MAC.  there's no conceiling taking
> place, it would be up to the spies to pick out the streams he's
> interested in and verify their MACs.

I think you are underestimating the legal system. Even if you had a
working solution, there is no problem to rule that your protocol is
illegal for being designed to conceal message content, regardless of
most of us thinking that such a descision would be unfair.

That said, the biggest flaw in the solution you mention is that the
hypotetical government has no problem getting permission to tap
individual customer <-> ISP communication.

> then when users send voice audio together with important other
> documents like faxes and PDF documents, who's to accuse him of
> conceiling anything?

He has to send a lot at the same time to hide the contents from
someone tapping the line to his ISP, and note that to stay on the
right side of my proposed possible law, this must be *real content
transfer* with a true purpose of communicating with someone (anything
else being an attempt to conceal information on purpose). The same
argument also makes illegal any extra effort from his software to
make multiple real datastreams transmitting at the same time. And the
death blow: "Hey, why don't we just pass a law that makes it illegal
to multiplex not-externally-identifiable streams from one ISP user?
It will only hinder users of that pesky new non-tappable im2000 email
system; not any serious bussniess." Eat that :-) ...

In fact; going too far with approaches like this may instead lead to
laws that makes the society less free. Just like using bogus
"solutions" to spam makes the email system at large less reliable.

//Rickard