160 likes | 173 Views
Reusable Anonymous Return Channels. Philippe Golle, Stanford / PARC Markus Jakobsson, RSA Labs. WPES ‘03. Mixnet. E(M). M. Anonymous Communication. Model: Parties exchange messages Goal: “keeping confidential who converses with whom, and when they converse” [Chaum]
E N D
Reusable AnonymousReturn Channels Philippe Golle, Stanford / PARC Markus Jakobsson, RSA Labs WPES ‘03
Mixnet E(M) M Anonymous Communication • Model: Parties exchange messages • Goal:“keeping confidential who converses with whom, and when they converse” [Chaum] • Global eavesdropping adversary • Solution: mix network • Alice submits EMIX(Bob || M) • Mixnet decrypts and delivers messages in random order Alice Bob How do we reply to an anonymous message?
Simple solution… • Communication protocol: • Alice submits to the mixnet a message EMIX(Bob || EBob (Alice || M)) • Bob receives EBOB (Alice || M), decrypts it and replies with EMIX(Alice || EAlice (Bob || R)) • Property: external anonymity • Alice and Bob know each other’s identity • They hide from everyone else the fact that they are communicating • In this talk • Complete anonymity: Bob does not learn Alice’s identity • Example applications: love letters, ransom notes • No straightforward solution with mixnets
Outline • Chaumian mixnets: • Processing of (forward) messages • Untraceable return address • Why return addresses can’t be reused • Replies and traffic analysis • Our new protocol • Based on a re-encryption mixnet • Allows for unlimited replies • Filtering policies
X X Y Y Bob Bob M Y Bob Bob Y X X M N P P N M Bob N N P P M M Chaumian Mixnet Alice Mix 1 Mix 2 Mix 3 Bob
Mix 1 Mix 2 Mix 3 Bob k3 k3 k1 k1 k1 k1 k1 k1 k2 k2 k2 k2 Bob Bob Bob Bob M M M M R R R R Untraceable Return Address Alice =
Return Address • Single use return envelope • Privacy compromised if a return address is reused: • Bob replies twice with same envelope • Decryption of return address is deterministic • The mixnet produces the same output in both cases • To allow for N replies, Alice must give Bob N different envelopes
Return channels and Traffic Analysis • Traffic analysis attack • Bob sends K replies in one batch and observes who picks up K messages • Bob sends one reply every hour and computes the intersection of the sets of recipients • Solutions from asynchronous mixes • Random delays • Pool mixing • Make multiple copies of some messages
Our Approach • Reusable return addresses • Alice distributes the same return address to all her correspondents (Bob, Charlie, Dave, …) • Property: cannot test whether two return addresses lead to the same person or different people • Note: cannot reuse Chaumian return addresses • Helps defeat traffic analysis attacks • If Bob sends K replies: Alice receives more than K • Intersection attack: complicated by the fact that multiple correspondents reply to Alice • Works best when combined with other defenses
ElGamal Cryptosystem • ElGamal is a randomized public-key cryptosystem: • Key generation: (SK, PK) • Encryption: m, PK, r Er (m) • Decryption: Er (m) , SK m • El Gamal allows for Re-encryption: • Re-encryption: Er(m) , PK , s Er+s(m) • Requires only public key • Given Er(m) an adversary can’t distinguish Er+s(m) from a random ciphertext.
Re-encryption Mixnet • ElGamal encrypted inputs: EMIX (M) • Mixing: each mix server • Receives a set of inputs • Re-encrypts these inputs • Gives them in random order to the next server • Outputs • Mixnet decrypts and outputs plaintext M
Protocol (outline) • Alice submits her input (Emix(Alice||PKA) ; Emix(M) ; Emix(Bob||PKB)) • Inputs are mixed and re-encrypted • Delivery of messages • Mixnet decrypts the value Bob||PKB • Converts Emix(M)into EPKB(M) • Delivers to Bob EPKB(M), Emix(Alice||PKA).
Protocol (cont’d) • Submitting a reply • Bob has received EPKB(M), Emix(Alice||PKA) • Bob submits to the mixnet the reply (Emix(Bob||PKB) ; Emix(R) ; Emix(Alice||PKA)) Note: the return envelope Emix(Alice||PKA) can be reused multiple times, for multiple correspondents
Properties • Reusable:multiple replies possible • Composable:allows for replies to replies, etc… • Transferable:anyone can reply • Compatible:replies and messages are processed in almost the same way • Efficient:4 times as expensive as normal re-encryption mixnet • Filtering policies: specifies which replies are allowed
Input Filtering • Submission of messages (Emix(Alice||PKA) ; E(M) ; Emix(Bob||PKB) ; E(FM)) • Mixing and delivery: as before • Reply: (Emix(Bob||PKB) ; E(R) ; Emix(Alice||PKA) ; E(FM))
Conclusion • Reusable return channels based on re-encryption mixnets • Helps defend against traffic analysis • Thanks to Ari Juels and Paul Syverson!