R. Newman Anonymity - Background

Defining anonymity Defining anonymity Need for anonymity Need for anonymity Defining privacy Defining privacy Threats to anonymity and privacy Threats to anonymity and privacy Mechanisms to provide anonymity Mechanisms to provide anonymity Applications of anonymity technology Applications of anonymity technologyTopics

Early (pre-computer) uses for social reasons (ability to act more freely, have work accepted without prejudice, etc.) Early (pre-computer) uses for social reasons (ability to act more freely, have work accepted without prejudice, etc.) Traffic analysis an issue prior to computers (e.g., Bodyguard of Lies) Traffic analysis an issue prior to computers (e.g., Bodyguard of Lies) Computer TAP solvable with cryptography Computer TAP solvable with cryptography With public-key cryptography, theoretical possibility for anonymity and pseudonymity With public-key cryptography, theoretical possibility for anonymity and pseudonymity Anonymity - Beginnings

Traffic Analysis Prevention Traffic Analysis Prevention Sender, Recipient, Message Anonymity Sender, Recipient, Message Anonymity Voter Anonymity Voter Anonymity Pseudonymity Pseudonymity Revokable anonymity Revokable anonymity Data anonymity Data anonymity Forms of Anonymity

Cryptography Cryptography Steganography Steganography Traffic Analysis Prevention (TAP) Traffic Analysis Prevention (TAP) Mixes, crowds Mixes, crowds Data sanitization/scrubbing Data sanitization/scrubbing k-anonymity k-anonymity Anonymity Mechanisms

Global vs. Restricted Global vs. Restricted All links vs. some links All links vs. some links All network nodes vs. some or no nodes All network nodes vs. some or no nodes Passive vs. Active Passive vs. Active Passive – listen only Passive – listen only Active – remove, modify, replay, or inject new messages Active – remove, modify, replay, or inject new messages Cryptography Assumptions Cryptography Assumptions All unencrypted contents are observable All unencrypted contents are observable All encrypted contents are not, without key All encrypted contents are not, without keyAdversaries

One key, K ab, associated with entities A and B One key, K ab, associated with entities A and B Same key used for encryption and decryption: C=E(M,K ab ), M=D(C,K ab )=D(E(M,K ab )K ab ) Same key used for encryption and decryption: C=E(M,K ab ), M=D(C,K ab )=D(E(M,K ab )K ab ) For message M, ciphertext C = {M}K For message M, ciphertext C = {M}K Anyone with K ab can form ciphertext Anyone with K ab can form ciphertext Anyone with K ab can decrypt C Anyone with K ab can decrypt C For message M, MIC or MAC uses hash fcn For message M, MIC or MAC uses hash fcn If only A and B have K ab, then MAC If only A and B have K ab, then MAC If group key, then MIC If group key, then MIC Depending on E, may require crypto hash fcn Depending on E, may require crypto hash fcn Symmetric Key Cryptography

Two keys, K and K -1, associated with entity A Two keys, K and K -1, associated with entity A K is public key, K -1 is private key K is public key, K -1 is private key Keys are inverses: {{M}K}K -1 = {{M}K -1 }K = M Keys are inverses: {{M}K}K -1 = {{M}K -1 }K = M For message M, ciphertext C = {M}K For message M, ciphertext C = {M}K Anyone can send A ciphertext using K Anyone can send A ciphertext using K Only A has K -1 so only A can decrypt C Only A has K -1 so only A can decrypt C For message M, signature S = {M}K -1 For message M, signature S = {M}K -1 Anyone can verify M,S using K Anyone can verify M,S using K Only A can sign with K -1 Only A can sign with K -1 Public Key Cryptography

Limit on size of M, based on size of K in PKC Limit on size of M, based on size of K in PKC Need to format M to avoid attacks on PKC Need to format M to avoid attacks on PKC Use confounder to foil guessed ptxt attacks Use confounder to foil guessed ptxt attacks Typical use of one-way hash H to distill large M to reasonable size for signing Typical use of one-way hash H to distill large M to reasonable size for signing Typical use of PKC to distribute symmetric key for actual encryption/decryption of larger messages Typical use of PKC to distribute symmetric key for actual encryption/decryption of larger messages See for standards See for standardshttp:// Details we omit

Wish to receive anonymously, but Wish to receive anonymously, but Be able to link new messages with past ones Be able to link new messages with past ones Respond to the sender Respond to the sender Do not trust single authority (e.g., Paypal) Do not trust single authority (e.g., Paypal) Underlying message delivery system is untrusted Underlying message delivery system is untrusted Global active adversary Global active adversary Chaum – Untraceable Mail

Mix is like a special type of router/gateway Mix is like a special type of router/gateway It has its own public key pair, K 1 and K 1 -1 It has its own public key pair, K 1 and K 1 -1 Recipient A also has public key pair, K a and K a -1 Recipient A also has public key pair, K a and K a -1 Sender B prepends random confounder R a to message M, encrypts for A: C a = {R a |M}K a Sender B prepends random confounder R a to message M, encrypts for A: C a = {R a |M}K a B then prepends confounder for mix to C and encrypts for mix: C 1 = {R 1 |A|C a }K 1 B then prepends confounder for mix to C and encrypts for mix: C 1 = {R 1 |A|C a }K 1 B sends C 1 to mix, which later send C a to A B sends C 1 to mix, which later send C a to A Chaum Mix 1

Mix simply decrypts and strips confounder from message to A Mix simply decrypts and strips confounder from message to A Incoming message and outgoing message do not appear related Incoming message and outgoing message do not appear related Use padding to ensure same length (some technical details here) Use padding to ensure same length (some technical details here) Gather a batch of messages from different sources before sending them out in permuted order Gather a batch of messages from different sources before sending them out in permuted order Chaum Mix 2

As long as messages are not repeated, adversary can't link an incoming message with an outgoing one (anonymous within the batch) As long as messages are not repeated, adversary can't link an incoming message with an outgoing one (anonymous within the batch) Mix can discard duplicate messages Mix can discard duplicate messages B can insert different confounder in repeats B can insert different confounder in repeats B can use timestamps – repeats look different B can use timestamps – repeats look different Mix signs message batchs, sends receipt to senders Mix signs message batchs, sends receipt to senders This allows B to prove to A if a message was not forwarded This allows B to prove to A if a message was not forwarded Chaum Mix

If one mix is good, lots of mixes are better! If one mix is good, lots of mixes are better! B prepares M for A by selecting sequence of mixes, 1, 2, 3, …, n. B prepares M for A by selecting sequence of mixes, 1, 2, 3, …, n. Message for A is prepared for Mix 1 Message for A is prepared for Mix 1 Message for Mix 1 is prepared for Mix 2 Message for Mix 1 is prepared for Mix 2 … Message for Mix n-1 is prepared for Mix n … Message for Mix n-1 is prepared for Mix n Layered message is sent to Mix n Layered message is sent to Mix n Each mix removes its confounder, obtains address of next mix (or A), and forwards when batch is sent in permuted order Each mix removes its confounder, obtains address of next mix (or A), and forwards when batch is sent in permuted order Cascading Mixes 1

Mix in cascade that fails to forward a message can be detected as before (the preceding mix gets the signed receipt) Mix in cascade that fails to forward a message can be detected as before (the preceding mix gets the signed receipt) Any mix in cascade that is not compromised can provide unlinkability Any mix in cascade that is not compromised can provide unlinkability This gets us anonymous message delivery, but does not allow return messages This gets us anonymous message delivery, but does not allow return messages Cascading Mixes 2

B generates a public key K b for the message B generates a public key K b for the message B seals its true address and another key K using the mix's key K 1 : RetAddr = ({K,B}K 1, K b ) B seals its true address and another key K using the mix's key K 1 : RetAddr = ({K,B}K 1, K b ) A encrypts reply M and confounder R 0 with message key K b and sends to mix along with return address: Reply = {K,B}K 1, {R 0 |M}K b A encrypts reply M and confounder R 0 with message key K b and sends to mix along with return address: Reply = {K,B}K 1, {R 0 |M}K b Mix decrypts address and key, uses key K to re-encrypt reply: {{R 0 |M}K b }K and sends to B Mix decrypts address and key, uses key K to re-encrypt reply: {{R 0 |M}K b }K and sends to B Return Addresses 1 Return Addresses 1

B must generate new return address keys for each message (K and K b ) so there are no duplicates B must generate new return address keys for each message (K and K b ) so there are no duplicates Mix must remove duplicates if found Mix must remove duplicates if found Symmetric cryptography may be used for both K and K b here (but not for mix key!) Symmetric cryptography may be used for both K and K b here (but not for mix key!) – How? Cascade can return messages by building the return address in reverse order, then peeling off layers as the reply is forwarded (and encrypted) along the return path Cascade can return messages by building the return address in reverse order, then peeling off layers as the reply is forwarded (and encrypted) along the return path Return Addresses 2 Return Addresses 2

For cascaded mixes, must build return address for the whole path For cascaded mixes, must build return address for the whole path Receiver uses built-up return address and return key to send reply Receiver uses built-up return address and return key to send reply Each mix on return path unwraps its portion of return address, re-encrypts, and forwards to next address Each mix on return path unwraps its portion of return address, re-encrypts, and forwards to next address Sender had all the keys (it built the return address) so it can decrypt reply Sender had all the keys (it built the return address) so it can decrypt reply Return Addresses 3 Return Addresses 3

Mix must make input messages unlinkable with output messages Mix must make input messages unlinkable with output messages – Messages must all be same length – Messages must all be encrypted so as to appear random – Can't hide source/destination addresses along a single hop in path, but must hide sender and receiver, as well as distance along path – Mix must randomize order of output Mix may have any number of triggers Mix may have any number of triggers Mix Generics

Timed mix Timed mix – Mix gathers messages for period T, then sends Threshold mix Threshold mix – Mix gathers N messages, then sends Hybrid mix Hybrid mix – Mix sends when N messages or period T reached Pool mix Pool mix – Mix keeps pool of messages of size P, when pool reaches size N+P, N randomly chosen messages are sent Continuous mix Continuous mix – Mix attaches random delay D from some distribution to each msg M, sends M when delay is reached Mix Triggers

In addition to padding messages to some constant length (and segmenting longer messages), mix may introduce dummy messages into traffic In addition to padding messages to some constant length (and segmenting longer messages), mix may introduce dummy messages into traffic Dummy messages especially useful in timed mixes (may not have many messages to send) Dummy messages especially useful in timed mixes (may not have many messages to send) Strong resistance from network guys Strong resistance from network guys Research question: how much does this form of padding help, and what is the relationship between increase in anonymity and cost of padding? Research question: how much does this form of padding help, and what is the relationship between increase in anonymity and cost of padding? Mix Padding