A Brief Introduction to Mix Networks Ari Juels RSA Laboratories © 2001, RSA Security Inc.

Slides:

Advertisements

Similar presentations

Mix and Match: A Simple Approach to General Secure Multiparty Computation + Markus Jakobsson Bell Laboratories Ari Juels RSA Laboratories.

Advertisements

Simple and Practical Anonymous Digital Coin Tracing

Public Key Cryptosystem

Efficient Zero-Knowledge Argument for Correctness of a Shuffle Stephanie Bayer University College London Jens Groth University College London.

Atomic Transactions CS523 - Spring Brian Schmidt.

RPC Mixing: Making Mix-Nets Robust for Electronic Voting Ron Rivest MIT Markus Jakobsson Ari Juels RSA Laboratories.

David Evans CS588: Cryptography University of Virginia Computer Science Lecture 17: Public-Key Protocols.

Talk by Vanessa Teague, University of Melbourne Joint work with Chris Culnane, James Heather & Steve Schneider at University of.

Electronic Voting Ronald L. Rivest MIT CSAIL Norway June 14, 2004.

Civitas Verifiability and Coercion Resistance for Remote Voting University of South Alabama August 15, 2012 Michael Clarkson The George Washington University.

Civitas Security and Transparency for Remote Voting Swiss E-Voting Workshop September 6, 2010 Michael Clarkson Cornell University with Stephen Chong (Harvard)

Efficient Zero-Knowledge Proof Systems Jens Groth University College London.

Auditable Privacy: On Tamper-Evident Mix Networks Jong Youl Choi Dept. of Computer Science Indiana University at Bloomington Philippe Golle Palo Alto Research.

Lecture 7.1: Privacy and Anonymity Using Anonymizing Networks - I CS 436/636/736 Spring 2012 Nitesh Saxena Some slides borrowed from Philippe Golle, Markus.

1 Introduction CSE 5351: Introduction to cryptography Reading assignment: Chapter 1 of Katz & Lindell.

Lect. 18: Cryptographic Protocols. 2 1.Cryptographic Protocols 2.Special Signatures 3.Secret Sharing and Threshold Cryptography 4.Zero-knowledge Proofs.

Data Encryption Standard (DES)

Receipt-free Voting Joint work with Markus Jakobsson, C. Andy Neff Ari Juels RSA Laboratories.

Reusable Anonymous Return Channels

Research & development A Practical and Coercion-resistant scheme for Internet Voting Jacques Traoré (joint work with Roberto Araújo and Sébastien Foulle)

Jens Groth BRICS, University of Aarhus Cryptomathic

Session 5 Hash functions and digital signatures. Contents Hash functions – Definition – Requirements – Construction – Security – Applications 2/44.

Applying Cryptography --lottery, anonymous authentication, and voting-- Kazue Sako

Privacy and Anonymity Using Mix Networks* Nitesh Saxena CS392/6813 Some slides borrowed from Philippe Golle, Markus Jacobson.

10/25/20061 Threshold Paillier Encryption Web Service A Master’s Project Proposal by Brett Wilson.

J. Håstad J. Jakobsson A. Juels M. Yung Funkspiel Schemes: An Alternative to Conventional Tamper Resistance Royal Inst. of Technology, Stockholm RSA Laboratories.

Parallel Mixing Philippe Golle, PARC Ari Juels, RSA Labs.

Symmetric Key Distribution Protocol with Hybrid Crypto Systems Tony Nguyen.

Receipt-freeness and coercion-resistance: formal definitions and fault attacks Stéphanie Delaune / Steve Kremer / Mark D. Ryan.

The Current State of Cryptographic Election Protocols Josh Benaloh Microsoft Research.

ITIS 6200/8200. time-stamping services Difficult to verify the creation date and accurate contents of a digital file Required properties of time-stamping.

Electronic Voting Schemes and Other stuff. Requirements Only eligible voters can vote (once only) No one can tell how voter voted Publish who voted (?)

UMBC Protocol Meeting 10/01/03 Universal Re-encryption: For Mix-Nets and Other Applications (to appear CT-RSA ’04) Paul Syverson NRL Markus Jakobsson Ari.

A (Brief) Comparison of Cryptographic Schemes for Electronic Voting

Remarks on Voting using Cryptography Ronald L. Rivest MIT Laboratory for Computer Science.

How Elections Should Really Be Run Josh Benaloh Senior Cryptographer Microsoft Research.

Computer Science Public Key Management Lecture 5.

Introduction to Public Key Cryptography

Civitas Toward a Secure Voting System AFRL Information Management Workshop October 22, 2010 Michael Clarkson Cornell University.

31.1 Chapter 31 Network Security Copyright © The McGraw-Hill Companies, Inc. Permission required for reproduction or display.

Provable Unlinkability Against Traffic Analysis Amnon Ta-Shma Joint work with Ron Berman and Amos Fiat School of Computer Science, Tel-Aviv University.

Untraceable Electronic Mail, Return Addresses, and Digital Pseudonyms David Chaum CACM Vol. 24 No. 2 February 1981 Presented by: Adam Lee 1/24/2006 David.

Optimistic Mixing for Exit-Polls Philippe Golle, Stanford Sheng Zhong, Yale Dan Boneh, Stanford Markus Jakobsson, RSA Labs Ari Juels, RSA Labs.

Cryptographic Voting Systems (Ben Adida) Jimin Park Carleton University COMP 4109 Seminar 15 February 2011.

Symmetric versus Asymmetric Cryptography. Why is it worth presenting cryptography? Top concern in security Fundamental knowledge in computer security.

6. Esoteric Protocols secure elections and multi-party computation Kim Hyoung-Shick.

Chapter 31 Cryptography And Network Security Copyright © The McGraw-Hill Companies, Inc. Permission required for reproduction or display.

1 Information Security Practice I Lab 5. 2 Cryptography and security Cryptography is the science of using mathematics to encrypt and decrypt data.

R. Newman Anonymity - Background. Defining anonymity Defining anonymity Need for anonymity Need for anonymity Defining privacy Defining privacy Threats.

Evoting using collaborative clustering Justin Gray Osama Khaleel Joey LaConte Frank Watson.

An Analysis of Parallel Mixing with Attacker-Controlled Inputs Nikita Borisov formerly of UC Berkeley.

31.1 Chapter 31 Network Security Copyright © The McGraw-Hill Companies, Inc. Permission required for reproduction or display.

Lecture 2: Introduction to Cryptography

Privacy and Anonymity Using Mix Networks* Slides borrowed from Philippe Golle, Markus Jacobson.

Secure Messenger Protocol using AES (Rijndael) Sang won, Lee

Almost Entirely Correct Mixing With Applications to Voting Philippe Golle Dan Boneh Stanford University.

 5.1 Zero-Knowledge Proofs  5.2 Zero-Knowledge Proofs of Identity  5.3 Identity-Based Public-Key Cryptography  5.4 Oblivious Transfer  5.5 Oblivious.

Cryptographic Shuffles Jens Groth University College London TexPoint fonts used in EMF. Read the TexPoint manual before you delete this box.: AAAAAAAAAAAAA.

Recipt-free Voting Through Distributed Blinding

Secure and Insecure Mixing

Some slides borrowed from Philippe Golle, Markus Jacobson

Untraceable Electronic Mail, Return addresses, and Digital Pseudonyms

Helger Lipmaa University of Tartu, Estonia

Privacy and Anonymity Using Mix Networks* Nitesh Saxena CS392/6813

Privacy and Anonymity Using Mix Networks* Nitesh Saxena CS392/6813

Anonymous Communication

Cryptography and Digital Transformation

How to Use Charm Crypto Lib

Presentation transcript:

A Brief Introduction to Mix Networks Ari Juels RSA Laboratories © 2001, RSA Security Inc.

What does a mix network do? message 1 message 2 message 3 message 4 Randomly permutes and decrypts inputs Mix network

What does a mix network do? message 2 Key property: We can’t tell which ciphertext corresponds to a given message ?

Example application: Anonymizing bulletin board or From Bob From Charlie From Alice

From Bob From Charlie From Alice “I love Alice” “Nobody loves Bob” “I love Charlie” Is it Bob, Charlie, self-love, or other? Example application: Anonymizing bulletin board or

Another application: Voting Digitally signed by Eve Digitally signed by Charlie Digitally signed by Charlie Digitally signed by Bob Digitally signed by Alice A vote for Al G re A vote for G.W. Bush A vote for Al Gore A vote for G.W. Bush Final Tally: Bush 2 Gore 1

A look under the hood

Basic Mix (Chaum ‘81) Server 1 Server 2 Server 3 PK 1 PK 2 PK 3

Encryption of Message PK 1 PK 2 PK 3 message Ciphertext = E PK1 [E PK2 [E PK3 [message]]]

Basic Chaumian Mix Server 1 Server 2 Server 3 m1 m2 m3 m2 m3 m1 decrypt and permute m2 m1 m3 decrypt and permute decrypt and permute m2 m3 m1

Basic Chaumian Mix m1 m2 m3 m2 m3 m1 decrypt and permute m2 m1 m3 decrypt and permute decrypt and permute m2 m3 m1 Observe: As long as one server is honest, privacy is preserved

Basic Chaumian Mix Server 1 Server 2 Server 3 m3 ?

What if one server fails? Server 1 Server 2 Server 3 SK 2 Privacy now requires a majority of honest servers Tolerance of failure is called robustness Solution idea: Share key among others

ballot BUSH What if one server cheats? Solution idea: Have each server prove that it permuted and decrypted correctly Proof may be digitally signed and carried along with ciphertexts

Robust Mix Server 1 Server 2 Server 3 m1 m2 m3 m2 m3 m1 decrypt, permute, and prove correct m2 m1 m3 decrypt, permute, and prove correct decrypt, permute, and prove correct m2 m3 m1

History of Robust Mixing u Park, Itoh, Kurosawa (EC ‘93) u Ogata, Kurosawa, Sako, Takatani (ICICS ‘97) u Abe (EC ‘98) u Jakobsson (EC ‘98) u Desmedt and Kurosawa (EC ‘00)

History of Robust Mixing u Jakobsson “Flash Mix” (PODC ‘99) –Secure only for large input sizes –Idea: Employ “dummy” inputs to check correctness u Mitomo and Kurosawa (AC ‘00) –Repair weakness in Jakobsson ‘99

Publicly verifiable mixing u Idea: Ensure that proofs are legitimate even if all servers try to cheat u Abe (AC ‘99), Jakobsson and Juels (DIMACS-TR ‘99) –Idea: Use “swap” as atomic unit; prove correctness of “swap” –Efficient only on small input sizes u Sako (Crypto ‘01) (renamed “shuffling”) u Neff (ACM CCS ‘01)

Hybrid mixing u Idea: Use symmetric and asymmetric crypto to achieve efficiency on long messages u Ohkuba and Abe (AC ‘00) u Jakobsson and Juels (PODC ‘01)

Asynchronous mixing Alice Preserves traffic routing privacy Examples: Crowds (AT&T), ZK Systems, CIA, etc. Ecoterrorism server U.S. England Finland Mix network ?

Some other applications of mixes u Anonymous payment schemes u Secure multiparty computation u Privacy-preserving content retrieval (A weak but efficient form of PIR)

What properties are desirable for voting? u Privacy: YES u Robustness: YES u Long messages: NO u Public verifiability: MAYBE –NO: Jakobsson’s “Flash Mix” (for large mixes) –YES: Mix by Neff

Can we improve with different modeling? u Voter can collaborate with server to change vote in mid-mix -- prior to seeing other votes –“Beauty flaw” in JJ ‘01 u Very efficient asymmetric mix can probably be designed if we accept this “flaw” u What other modeling changes are permissible?

Questions?