For the past four years I've been working on a project to analyze Alt.Anonymous.Messages, and it was finally getting to a point where I thought I should show my work. I just finished presenting it at Defcon, and because a lot of the people I know are interested in this were not able to make it, I'm making the slides, and more importantly the speaker notes, available for download. This kind of kills the chance anyone will actually watch the video, but that's all right.

The slides cover the information-theoretic differences between SSL, Onion Routing, Mix Networks, and Shared Mailboxes. It talks about the size of the dataset I analyzed, and some broad percentages of the types of messages in it (PGP vs Non-PGP, Remailed vs Non-Remailed). Then I go into a large analysis of the types of PGP-encrypted messages there are. Messages encrypted to public keys, to passwords and passphrases, and PGP messages not encrypted at all!

For messages encrypted to a public key, I can draw communication graphs, and there are some interesting graphs - some very symmetrical ones where everyone talks to everyone else, and some less structured ones that may model a larger community where not everyone knows everyone else. I also perform brute force attacks against password-encrypted messages, using GPU-powered crackers I had to develop myself. These usually crack into messages encrypted to public keys and are sent from a Type I nymserv.

On the statistical analysis-like side of things, I correlate subjects that are in plaintext and hexadecimal (including cracking hsubs using more custom GPU code). I also look at message headers, including several unique ones added on the client (such as distinguishing ones like unique Newsgroups headers, and misspellings of X-No-Archive). Several Type I remailer directives made their way into AAM, even though they shouldn't have - Type I remailers are pretty difficult to use. And there are some very interesting message patterns such as redundant messages and off response patterns.

Summing up, I talk about Nymservs (and Pynchon Gate), the current status of the Mixmaster and Mixminion networks and software (and the path forward for Mixminion), and finally wax poetically about the need for a high-bandwidth, high-latency... something to securely leak and share large files.

For more on this and related topics like remailers, I slowly write about them over at crypto.is (and copy the blogs posts here), and on IRC in OFTC #cryptodotis

if 1 * 2 < 3:
    print "hello, world!"