Re: [Endymail] Onion Routing over SMTP.. impossible by design?

[Tom Ritter <[e-mail]>]

On 5 October 2014 10:57, carlo von lynX <[e-mail]> wrote:
> Onion routing works by letting the sender pack up the crypto
> layers for each inbetween node up to the final recipient. If
> SMTP were to allow that, it would re-introduce relaying which
> used to be its favorite backdoor for SPAM.

Indeed, when Onion Routing (well, Mix Networks, similar but different)
were built for SMTP, they were used for spam and abuse. As well as
legitimate traffic of course.

> The only way for an MDA to receive a message from somewhere,
> decrypt it, then find out it needs to forward it to another MDA,
> would be to have a large view of the social graph of users and
> .. erm.. servers.. in order to know that if the message came
> from eris it is probably safe to forward on to tolsun.

You need a directory of servers, yes.  Users, no.

> To me this sounds like a catastrophe waiting to happen since
> SMTP by default has no trust architecture, thus any onion
> routing would open up large windows of opportunity for spammers
> since once the SPAM has arrived at destination, the recipient
> can no longer figure out where it originated from - thus there
> is no way of protecting yourself.

Spam detection does not _have_ to rely on originating source, although
obviously that's a large input to a spam detection system.  The
popularity of the system also affects it's spam rate.  In the
existing, small, unpopular SMTP-onion-routing systems deployed today
(again, technically mix networks), I receive a very high degree of
signal-to-noise-ratio of messages, because they are not in popular
use.


> All Tor-and PK-routing based systems have solved this by requiring
> pubsub relationships, thus making SPAM at worst annoying, but
> ineffective at its primary intent.

I'm not clear what you mean here.  In my mind, Tor is not set up as a
publisher-subscriber relationship at all, but perhaps you mean
something different.


> If I'm not mistaken, it is impossible to implement metadata
> protection on top of SMTP while also maintaining compatibility
> to its subscription-free transmission model.
>
> Any mistakes in my reasoning?

I feel like you've made an assertion: "it is impossible to implement
metadata protection on top of SMTP..." but not supported it very
strongly.  One, you talk only of Onion Routing - but that is merely
one mechanism of metadata protection.  There is also Broadcast
Transmission, Mix Networks, and other more complicated systems like
PIR.  Two: It is impossible to prove a negative, that something must
not exist or not be possible.  I think there are a multitude of
systems that have been designed or could be designed that would feed
into this debate.  If you want to make an assertion that something is
impossible, I would expect a more descriptive exploration of the
problem space, and attempting to address several potential ideas and
why they do not work.

For example: Mix Networks for SMTP (remailers) have existed since the
late 90s, with one network still deployed and being developed (slowly)
- Mixmaster. A second more sophisticated one was also built and
deployed (Mixminion).  nymservs, allowing anonymous email recipient
(instead of delivery) have also evolved over the years, with several
deployments, versions, and academic papers written about them (like
Pynchon Gate).  And shared mailboxes (alt.anonymous.messages) is a
reasonably well workable system for certain types of communication,
absent easy-to-use tooling for it that leads to various security
failures.  Finally, systems like Persona and Pond provide metadata
protection in related situations that may inform a new evolution of
email, existing side-by-side traditional SMTP.

I think it's entirely reasonable to say "I don't see a way this would
work" - indeed there are some hard problems in the space, followed by
the additional problems of developing robust codebases and large-scale
deployment.  But there are multitude of architectures out there and
I'm hopeful that by learning and borrowing from each, we can find a
system that provides the protections people want to achieve,
indistinguishable as possible, allocating the burden appropriately.

-tom