Privacy and Anonymity Using Mix Networks* Nitesh Saxena CS392/6813 Some slides borrowed from Philippe Golle, Markus Jacobson 5/5/2019

Course Admin Midterm is being graded; solution will be posted soon HW4 solution will be posted HW4 will be graded after mid-term is graded HW5 will be posted soon 5/5/2019

AOL Search Query Log AOL's disturbing glimpse into users' lives, CNET News, August 7, 2006 21 million search queries posed over a 3-month long period; 650,000 users No user identification information released per se, but?? Search Log still available: http://www.gregsadetsky.com/aol-data/ 5/5/2019

Outline Mix Network (Mixnet) Mixnet Applications Mixnet Requirements Robustness of Mixnets Types of Mixnets Decryption based (Onion Routing) Re-encryption based 5/5/2019

Definition: Mix Server (or Relay) ? Inputs Outputs A mix server: Receives inputs Produces “related” outputs The relationship between inputs and outputs is secret a mix server receives a set of inputs and produces related outputs so that the relationship between inputs and outputs can not be learned by anyone but the mix server. 5/5/2019

Definition: Mix Network A group of mix servers that operate sequentially. Server 1 Server 2 Server 3 Inputs Outputs ? ? ? a mix server receives a set of inputs and produces related outputs so that the relationship between inputs and outputs can not be learned by anyone but the mix server. 5/5/2019

Applications Hide:  “who voted for whom?”  “who paid whom?”  “who communicated with whom?”  “what is the source of a message?” Good for protecting privacy for election and communication Used as a privacy building block 5/5/2019

Electronic Voting Demonstration “Who do you like best?” Put your ballot into a WHITE envelope and put again in a RED one and sign on it Washington Lincoln Roosevelt Jerry 5/5/2019

Electronic Voting Demo. (Cont’d) Administrators will Verify signatures together 1st Admin. shuffles and opens RED envelopes Send them to 2nd Admin. 2nd Admin. shuffles again and opens WHITE envelopes Count ballots together 5/5/2019

A real system for elections Sign voter 1 (encr(encr (vote1))) Sign voter 2 (encr(encr (vote2))) . Sign voter n (encr(encr (voten))) vote1 vote2 vote3 . voten Mix Net Mix Net Jerry Washington Lincoln Roosevelt 5/5/2019

Electronic Payment Demo. “Choose one person you like to pay $5” Put your ballot into an WHITE envelope and put again in a RED one and sign on it Name of the person ( ___________ ) Jerry 5/5/2019

Electronic Voting Demo. (Cont’d) Administrators will Verify signatures together Deduct $5 from each account 1st Admin. shuffles and opens RED envelopes Send them to 2nd Admin. 2nd Admin. shuffles again and opens WHITE envelopes Credit $5 to recipients 5/5/2019

For payments payee1 payee2 payee3 . payeen Sign payer 1 (encr(encr (payee1))) Sign payer 2 (encr(encr (payee2))) . Sign payer n (encr(encr (payeen))) D E U C T Mix Net Jerry Credit Name (________ ) 5/5/2019

For email communication . encr (email1, addressee1) encr (email2, addressee2) . encr (emailn, addresseen) Mix Net To: Jerry Don’t forget to have lunch. Deliver 5/5/2019

Other uses Anonymous web browsing; web searching (Anonymizer) 5/5/2019 From LPWA homepage 5/5/2019

Other uses (Cont’d) Location privacy for cellular devices Location-based service is GOOD ! Landline-phone calling to 911 in the US, 112 in Europe All cellular carrier by December 2005 RISK ! Location-based spam Harm to a reputation 5/5/2019

Other Uses Anonymous VoIP calls Anonymous patch aquisition 5/5/2019

Other uses (Cont’d) Sometimes abuses Avoid legislation (e.g., piracy) P2P sharing of copyright content Terrorism: communication with media Mumbai attacks 5/5/2019

Principle Issues : Chaum ’81 Message 1 Message 2 Privacy Efficiency server 1 server 2 server 3 Issues : Privacy Efficiency Trust Robustness 5/5/2019

But what about robustness? I ignore his output and produce my own STOP encr(Berry) encr(Kush) Kush There is no robustness! 5/5/2019

Requirements Privacy Nobody knows who said what Efficiency Mixing is efficient (= practically useful) Trust How many entities do we have to trust? Robustness Will replacement cheaters be caught? What if a certain number of mix servers fail? 5/5/2019

Zoology of Mix Networks Inputs Outputs ? Decryption Mix Nets [Cha81,…]: Inputs: ciphertexts Outputs: decryption of the inputs. Re-encryption Mix Nets[PIK93,…]: Outputs: re-encryption of the inputs 5/5/2019

First Solution Chaum ’81, implemented by Syverson, Goldschlag Not robust (or: tolerates 0 cheaters for correctness) Requires every server to participate (and in the “right” order!) 5/5/2019

Re-encryption Mixnet 0. Setup: mix servers generate a shared ElGamal key 1. Users encrypt their inputs: Input Pub-key Server 1 Server 2 Server 3 re-encrypt & mix 2. Encrypted inputs are mixed: Proof 3. A quorum of mix servers decrypts the outputs Output Priv-key 5/5/2019

Recall: Discrete Logarithm Assumption p, q primes such that q|p-1 g is an element of order q and generates a group Gq of order q x in Zq, y = gx mod p Given (p, q, g, y), it is computationally hard to compute x No polynomial time algorithm known p should be 1024-bits and q be 160-bits x becomes the private key and y becomes the public key 5/5/2019

ElGamal Encryption Encryption (of m in Gq): Decryption of (k,c) Choose random r in Zq k = gr mod p c = myr mod p Output (k,c) Decryption of (k,c) M = ck-x mod p Secure under discrete logarithm assumption 5/5/2019

ElGamal Example: dummy Let’s construct an example KeyGen: p = 11, q = 2 or 5; let’s say q = 5 2 is a generator of Z11* g = 22 = 4 x = 2; y = 42 mod 11 = 5 Enc(3): r = 4  k = 44 mod 11 = 3 c = 3*54 mod 11 = 5 Dec(3,5): m = 5*3-2 mod 11 = 3 5/5/2019

Re-encryption technique Input: a ciphertext (k,c) wrt public key y Pick a number r’ randomly from [0…q-1] Compute k’ = kgr’ mod p c’ = cyr’ mod p Output (k’, c’) Same decryption technique! Compute m k’c’-x 5/5/2019

A simple mix (k1, c1) (k2, c2) . (kn, cn) (k’1,c’1) (k’2,c’2) . R E - N C Y P T R E - N C Y P T (k1, c1) (k2, c2) . (kn, cn) (k’1,c’1) (k’2,c’2) . (k’n,c’n) (k’’1,c’’1) (k’’2,c’’2) . (k’’n,c’’n) Note: different cipher text, different re-encryption exponents! 5/5/2019

And to get privacy… permute, too! (k1, c1) (k2, c2) . (kn, cn) (k’’1,c’’1) (k’’2,c’’2) . (k’’n,c’’n) 5/5/2019

Problem Mix servers must prove correct re-encryption Given n El Gamal ciphertexts E(mi)as input and n El Gamal ciphertexts E(m’i) as output Compute: E( mi) and E(=m’i) Ask Mix for ZK proof that these ciphertexts decrypt to same plaintexts 5/5/2019

Mix Network in practice: Tor A low-latency anonymizing network http://www.torproject.org/ Currently 1000 or so routers distributed all over in the internet Can run any SOCKS application on top of Tor Peer-based: a client can choose to be a router A request is routed to/fro a series of a circuit of three routers A new circuit is chosen every 10 minutes 5/5/2019