It's interesting, for certain, but still requires all clients to dedicate an identical amount of bandwidth (n.b.: this is very probably required for traffic-ana

It's interesting, for certain, but still requires all clients to dedicate an identical amount of bandwidth (n.b.: this is very probably required for traffic-analysis-resistant anonymity): 'Moreover, each message needs to be padded to a fixed length to prevent privacy leakage through the size of the message,' (pg.23) and 'To be fully traffic analysis resistant, all users are required to upload a message, even if they do not wish to communicate that round' (pg. 25). Granted, the second sentence leaves open the possibility that perhaps all users aren't required to upload a message, at the cost of increased susceptibility to analysis, but I don't think that's really intended: worst-case, there's one client message per round, which provides no real anonymity against the client's primary server. I'm not putting it down, really: Riffle is a remarkable achievement. Sadly, it appears that anonymity is really, really hard to do truly efficiently.