1. Privacy and Anonymity Using Mix Networks* Slides borrowed from Philippe Golle, Markus Jacobson

2. Contents Mix Network (Mixnet) Mixnet Applications Mixnet Requirements Robustness of Mixnets Checking a Mixnet’s Robustness

3. Definition: Mix Server A mix server: Receives inputs Produces “related” outputs The relationship between inputs and outputs is secret InputsOutputs ? Mix Server

4. Definition: Mix Network Mix network A group of mix servers that operate sequentially. Server 1Server 2Server 3 InputsOutputs ???

5. Applications Hide:  “who voted for whom?”  “who paid whom?”  “who said what?” Good for protecting privacy for election and communication Used as a privacy building block

6. 1.“Who do you like best?” 2.Put your ballot into an WHITE envelope and put again in a RED one and sign on it Electronic Voting Demonstration Jerry  Washington  Lincoln  Roosevelt

7. Administrators will 1.Verify signatures together 2.1 st Admin. shuffles and opens RED envelopes 3.Send them to 2 nd Admin. 4.2 nd Admin. shuffles again and opens WHITE envelopes 5.Count ballots together Electronic Voting Demo. (Cont’d)

8. Jerry Sign voter 1 (encr(encr (vote 1 ))) Sign voter 2 (encr(encr (vote 2 ))). Sign voter n (encr(encr (vote n ))) A real system for elections vote 1 vote 2 vote 3. vote n Mix Net  Washington  Lincoln  Roosevelt Mix Net

9. “Choose one person you like to pay $5” Put your ballot into an WHITE envelope and put again in a RED one and sign on it Jerry Name of the person ( ___________ ) Electronic Payment Demo.

10. Electronic Voting Demo. (Cont’d) Administrators will 1.Verify signatures together 2.Deduct $5 from each account 3.1 st Admin. shuffles and opens RED envelopes 4.Send them to 2 nd Admin. 5.2 nd Admin. shuffles again and opens WHITE envelopes 6.Credit $5 to recipients

11. For paymentspayments Sign payer 1 (encr(encr (payee 1 ))) Sign payer 2 (encr(encr (payee 2 ))). Sign payer n (encr(encr (payee n ))) payee 1 payee 2 payee 3. payee n DEDUCTDEDUCT Credit Jerry Name (________ ) Mix Net

12. For email communication encr (email 1, addressee 1 ) encr (email 2, addressee 2 ). encr (email n, addressee n )...... Mix Net Deliver To: Jerry Don’t forget to have lunch.

13. Other uses Anonymous web browsing (LPWA Anonymizer)LPWAAnonymizer From LPWA homepage

14. Other uses (Cont’d) Location privacy for cellular devices – Location-based service is GOOD ! Landline-phone calling to 911 in the US, 112 in Europe All cellular carrier by December 2005 – RISK ! Location-based spam Harm to a reputation

15. Other uses (Cont’d) Anonymous bulletin boards From A. Juels at WOTE’01 Mix

16. Other uses (Cont’d) Sometimes abuses Avoid legislation (e.g., piracy)

17. Other Used RFID Privacy

18. Principle Chaum ’81 Message 1 Message 2 server 1server 2server 3 Privacy Efficiency Trust Robustness Issues :

19. But what about robustness? encr(Berry) encr(Kush) Kush STOP I ignore his output and produce my own There is no robustness!

20. Requirements 1.Privacy Nobody knows who said what 2.Efficiency Mixing is efficient (= practically useful) 3.Trust How many entities do we have to trust? 4.Robustness Will replacement cheaters be caught?

21. Zoology of Mix Networks Decryption Mix Nets [Cha81,…]: –Inputs: ciphertexts –Outputs: decryption of the inputs. Re-encryption Mix Nets[PIK93,…]: –Inputs: ciphertexts –Outputs: re-encryption of the inputs InputsOutputs ?

22. First Solution Chaum ’81, implemented by Syverson, GoldschlagSyverson, Goldschlag Not robust (or: tolerates  cheaters for correctness) Requires every server to participate (and in the “right” order!)

23. Re-encryption Mixnet 0.Setup: mix servers generate a shared ElGamal key 1. Users encrypt their inputs: Input Pub-key 3. A quorum of mix servers decrypts the outputs Output Priv-key Server 1Server 2Server 3 re-encrypt & mix re-encrypt & mix re-encrypt & mix 2. Encrypted inputs are mixed: Proof

24. Recall: El Gamal encryption Public parameters: q is a prime p = 2 k q+1is a prime ggenerator of G p Secret key of a user: x (where 0 < x < q) Public key of this user: y = g x mod p

25. El Gamal Encryption (encrypt m using y) For message (or “plaintext”) : m 1.Pick a number k randomly from [0…q-1] 2.Compute a = y k. m mod p b = g k mod p 3.Output (a,b) Decryption technique (to decrypt (a,b) using x) Compute m a / b x (= y k. m = g xk. m) (g k ) x g kx

26. Re-encryption technique Input: a ciphertext (a,b) wrt public key y 1.Pick a number  randomly from [0…q-1] 2.Compute a’ = y . a mod p b’ = g . b mod p 3.Output (a’, b’) Same decryption technique! Compute m a’ / b’ x (= y k. y . m = g x (k+ . m) (g k. g  ) x g (k+  x

27. A simple mix (a 1, b 1 ) (a 2, b 2 ). (a n, b n ) RE-ENCRYPTRE-ENCRYPT RE-ENCRYPTRE-ENCRYPT (a’ 1,b’ 1 ) (a’ 2,b’ 2 ). (a’ n,b’ n ) (a’’ 1,b’’ 1 ) (a’’ 2,b’’ 2 ). (a’’ n,b’’ n ) Note: different cipher text, different re-encryption exponents!

28. And to get privacy… permute, too! (a 1, b 1 ) (a 2, b 2 ). (a n, b n ) (a’’ 1,b’’ 1 ) (a’’ 2,b’’ 2 ). (a’’ n,b’’ n )

29. Problem Mix servers must prove correct re-encryption –Given n El Gamal ciphertexts E(m i )as input –and n El Gamal ciphertexts E(m’ i ) as output –Compute: E(  mi) and E(  =m’i) –Ask Mix for ZK proof that these ciphertexts decrypt to same plaintexts