We present a design for a system of anonymous storage which resists the attempts of powerful adversaries to find or destroy any stored data. We enumerate distinct notions of anonymity for each party in the system, and suggest a way to classify anonymous systems based on the kinds of anonymity provided. Our design ensures the availability of each document for a publisher-specified lifetime. A reputation system provides server accountability by limiting the damage caused from misbehaving servers. We identify attacks and defenses against anonymous storage services, and close with a list of problems which are currently unsolved.

tack at the Information Hiding Workshop 2001. Other more esoteric proposals for anonymous communications were usually either variations of mix networks (such as onion routing) [15,16] or masqueraded D.C. networks (usually by using addition modulo n instead of XOR) [12,13,14]. 1 3.1 Chanch. During Lent term I collaborated with Richard Clayton and designed \Chanch" a communication channel that provides its users with secrecy and plausible deniability. The design was inspired by Rivest's Chang and Windowing [18] but was extended to be made ecient and practical. As the original proposal it only uses integrity primitives to oer con dentiality but has also the feature that the existence of some of the hidden information can be plausibly denied. Special care has also been taken to make it resistant to legal attacks under the RIP Act in UK law. While designing it I read a great deal about cipher construction (especially the use of permutations) and block ciphers' modes of operation as wel