Nowadays we see that countries like China and Iran detect and block all encrypted connections as a way to prevent their citizens from communicating over the Internet freely. Although encryption provides the highest level of data protection, still we can't hide the fact that the communication is encrypted due to the randomness introduced by the encryption. Rivest wrote a paper in 1996 titled "Chaffing and Winnowing: Confidentiality without Encryption". The basic idea is that Alice and Bob share an encryption key for MAC not encryption. When Alice construct a packet, a MAC is calculated on the packet and a secret key. The MAC is appended to the packet and is send to Bob. Communication is in cleartext so anyone observing the channel can sniff the data. Now if another stream of data from two other persons (mentioned as David and Elien in the paper) is mixed with the stream of Alice and Bob, only Alice and Bob can recover their own packets because only these two entities know the MAC key. The same goes for the other parties David and Elien.

My question is, is their any practical implementation of the above scheme because reading the paper, it is clear that if sufficiently large streams are multiplexed together, it would be impossible for anyone to recover the exact packets of a stream without knowning the MAC key and hence for any government it would be impossible to block any network traffic if a large number of volunteers join and multiplex this theoritical network.

  • I am reminded of Mix-Master email relays.
    – lynks
    May 3, 2013 at 9:41
  • @lynks if I understand correctly, in mixmaster the person sniffing the traffic can still read the email since it is all in one big chunk. Only the attacker won't be able to relate the email to the sender. In the Rivest paper above, the attacker can't recover the plaintext (from the plaintext) because there will be so much noise in it and without the MAC key the attacker don't know which one is noise and which one isn't.
    – void_in
    May 3, 2013 at 9:59
  • Yep you're about right, some mixmasters did fragment the emails into a storm of fragments (the whole point is to get a lot of users), but it is not quite the same which is why I only commented, rather than answered :P
    – lynks
    May 3, 2013 at 10:01

1 Answer 1


You don't actually need other users for this to work, it just makes it more reasonable. You can perform chaffing by merely creating pseudorandom packets and MACs and mixing them in with yours.

The problem with chaffing and winnowing is that each message must be so small as to convey no useful information to the attacker. Otherwise, attackers can use redundant information and knowledge of formats and protocols to assist in rebuilding the original message. Compression prior to chaffing would probably help some, but I'm not sure to what degree.

I'm not aware of any networks like Tor or Mix masters using Chaffing and Winnowing. There is an implementation in PyCrypto, among others.

  • thank you very much for your answer. That PyCrypto implementation is very useful. Compression is definitely be very useful because the compressed data itself will depend on the contents of the actual data.
    – void_in
    May 3, 2013 at 16:36

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .