HashCash

I recently came across an interesting approach to combating spam. HashCash lets an email sender demonstrate that they committed a certain amount of computing time in order to send an email. A common amount of CPU time might be a few seconds. Unlike most other attempts at spam prevention, this idea might work.

A few seconds isn't a lot of time for most end-users sending email. Their email client could perform the operation in the background and they likely wouldn't even notice. For a spammer however, this is a major burden. It would limit the maximum number of messages they could send from a single PC down to "only" a few thousand.

Major companies sending large numbers of legitimate messages could employ server farms to send their email. Spammers however also use server farms. They are networks of hacked computers known as botnets. Still, the technology could curtail the amount of spam a given number of computers could send in a certain period.

The idea is very similar to that outlined in the SpamButcher article - Paying for Email with Computational Time. HashCash is frankly a better thought out implementation though. Specifically, it manages to bypass several server transactions by using two commonly known "seeds" for the mathematical operations. In this case, the recipients email address and the current date are used.

HashCash relies on the notion of a "one-way" mathematical operation. For example, it's very easy to multiply two prime numbers. Reversing the operation without knowledge of either of the primes is much more time consuming.

HashCash or a similar technology could be deployed without significant modification to the existing SMTP protocol. It would simply be an additional header field generated by clients that support it. Initially most users or system administrators would use it to augment their existing spam filtering technology. Messages with a HashCash signature could bypass spam software, while other messages would be scrutinized more rigorously.

If however, all major email clients were to begin supporting the technology, almost all legitimate messages would have a HashCash signature within a few years. At that point, users could configure their email clients to simply reject all messages lacking a the required signature.

Back