Re: [ANNOUNCE] contrib/hashcash.el spam fighter

[Stainless Steel Rat <ratinox@peorth.gweep.net>]

* David Masterson <dsm@rawbw.com>  on Sat, 22 Jun 2002
| Interesting.  Is this technique any better than TMDA (tmda.sf.net)?

No.

The way hashcash works is quite simple.  Your MTA contacts my MTA because
you want to deliver mail to me.  Me (my MTA) picks two random numbers,
multiplies them, and mashes the result through MD5.  That gives me 128 bits
of fairly random data.  I say, "you must find two numbers that when
multiplied together and have their product mashed through MD5 generate a
hash that has 70 bits in common with this hash.  Give me those numbers."
You go through the effort of picking random numbers, multiplying them,
mashing them through MD5, and comparing the hashes.  As I understand it, 64
bits of match is a 50% chance of a hit the first attempt, and each increase
of 1 bit of match approximately doubles the number of iterations.

The hashcash system works at the MTA level becuase the recipient can say,
"this is your postage due".  Hashcash can be tuned, adjusting the number of
matched bits based on whatever criteria the server manager wants, such as a
scoring algorithm that uses the DCC.  The system needs everyone to adopt
it, or it will not work.

Hashcash cannot work at the MUA level because the receiving MUA cannot tell
the sender, "this is your price of doing business with me".  The sender
sets whatever "postage" rate he wants, which can be as negligible as using
the same data again and again, or simply incrementing a number by 1 and
hashing it, or picking data randomly from a pregenerated table, and make
any claims it wants about the postage it is paying.

-- 
Rat <ratinox@peorth.gweep.net>    \ If Happy Fun Ball begins to smoke, get
Minion of Nathan - Nathan says Hi! \ away immediately. Seek shelter and cover
PGP Key: at a key server near you!  \ head.
       That and five bucks will get you a small coffee at Starbucks.