Traditional methods for evaluating the amount of anonymity a orded by v arious Mix con gurations have depended on either measuring the size of the set of possible senders of a particular message the anonymity set size, or by measuring the entropy associated with the probability distribution of the messages possible senders. This paper explores further an alternative way of assessing the anonymity o f a Mix system by considering the capacity of a covert channel from a sender behind the Mix to an

more »

... observer of the Mix's output. Initial work considered a simple model 5 , with an observer Eve restricted to counting the number of messages leaving a Mix con gured as a rewall guarding an enclave with one malicious sender Alice and some other naive senders Cluelessi's. Here, we consider the case where Eve can distinguish between multiple destinations, and the senders can select to which destination their message if any is sent each clock tick. ? Research supported by the O ce of Naval Research. Report Documentation Page Form Approved OMB No. 0704-0188 Public reporting burden for the collection of information is estimated to average 1 hour per response, including the time for reviewing instructions, searching existing data sources, gathering and maintaining the data needed, and completing and reviewing the collection of information. Send comments regarding this burden estimate or any other aspect of this collection of information, including suggestions for reducing this burden, to Washington Headquarters Services, Directorate for Information Operations and Reports, 1215 Jefferson Davis Highway, Suite 1204, Arlington VA 22202-4302. Respondents should be aware that notwithstanding any other provision of law, no person shall be subject to a penalty for failing to comply with a collection of information if it does not display a currently valid OMB control number.