Subject: [Endymail] Concealing the email address of the subscriber.

From: Phillip Hallam-Baker <[email-masked]>
Date: Fri, 29 Aug 2014 11:22:01 -0400

Problem: Allow an email sender who knows an email address to locate a
record giving key information without disclosing address to an
attacker.

To simplify the argument we are only considering this part of the
puzzle here and hypothesizing that there is a separate infrastructure
whose sole purpose is matching email addresses to records.

Obviously if we are using CT with this then any information that goes
into this infrastructure has to be validated in CT but that can be via
a hash of the data which is non-disclosing.

Approach 1:

Let email address be aç
Locator is H( "[email-masked]" )
Service maps Locator to record.

Strength: Simple
Weakness: Attacker can derive the email address by brute force.

Approach 2:

We have two locators each of which contain only part of the email address.

Locator1 is H( "[email-masked]" )
Locator2 is H( "[email-masked]" )

Each locator is presented to a service which returns a set of opaque
locators V1, V2. There is a possibility of collisions here.

Final locator is the XOR of V1, V2...

Nah, combinatorics would be horrendous.

Approach 3:

Anyone got something better that does not allow the brute force attack
- other than simply increasing the linear work factor for the
attacker?

---

From: Natanael <[email-masked]>
Date: Fri, 29 Aug 2014 17:50:28 +0200

> a hash of the data which is non-disclosing.

Bitcoin SPV clients which need servers / trusted nodes for blockchain
lookups to verify the balance at its own addresses are using bloom filters
for privacy (intentionally high false positive rate). Isn't all too costly
in most cases.