We evaluate the anonymity provided by two popular email mix implementations, Mixmaster and Reliable, and compare their effectiveness
through the use of simulations which model the algorithms used by these mixing applications. Our simulations are based on
actual traffic data obtained from a public anonymous remailer (mix node). We determine that assumptions made in previous literature
about the distribution of mix input traffic are incorrect: in particular, the input traffic does not follow a Poisson distribution.
We establish for the first time that a lower bound exists on the anonymity of Mixmaster, and discover that under certain circumstances
the algorithm used by Reliable provides no anonymity. We find that the upper bound on anonymity provided by Mixmaster is slightly
higher than that provided by Reliable.
We identify flaws in the software in Reliable that further compromise its ability to provide anonymity, and review key areas
that are necessary for the security of a mix in addition to a sound algorithm. Our analysis can be used to evaluate under
which circumstances the two mixing algorithms should be used to best achieve anonymity and satisfy their purpose. Our work
can also be used as a framework for establishing a security review process for mix node deployments.