One problem I see with Karl's suggestion (if I understand it) is that there needs to be some pre-arrangement between sender and receiver in order for the receiver to know what "tag" will be used to identify the next message. That way he knows to download it after scanning all the tags (plus, he downloads a certain number of other messages as cover). (In other words, every day he downloads five messages from the message haven. He does this whether he has anything there or not. An eaves- dropper doesn't know how many of the five are for him and how many are just random.) I think it should be possible to have a way of marking a messages as being for a particular user without any pre-arragement, and without any outsider being able to determine which messages are for which user. Simply encrypting some standard constant number with the user's public key would be close to right, although you'd have to find a way to keep the modulus size from leaking out. The main down side to this is that the decryption and tag check might take too long, while Karl's pre-arranged tag idea could be very fast. Perhaps both concepts would be useful in different contexts. Hal