Anonymity – Generalizing Mixes R. Newman

Topics Defining anonymity Need for anonymity Defining privacy Threats to anonymity and privacy Mechanisms to provide anonymity Applications of anonymity technology

Mix Generics Mix must make input messages unlinkable with output messages Messages must all be same length Messages must all be encrypted so as to appear random Can't hide source/destination addresses along a single hop in path, but must hide sender and receiver, as well as distance along path Mix must randomize order of output Batching Strategy How does Mix collect messages for mixing How does Mix select and forward messages

Mix Triggers Timed mix Threshold mix Hybrid mix Pool mix Mix gathers messages for period T, then sends Threshold mix Mix gathers N messages, then sends Classic Chaum Mix Hybrid mix Mix sends when N messages or period T reached Pool mix Mix keeps pool of messages of size P, when pool reaches size N+P, N randomly chosen messages are sent Continuous mix Mix attaches random delay D from some distribution to each msg M, sends M when delay is reached

Mix Generics Function p: N -> [0,1] Threshold mix Timed mix p depends on number of messages, outputs fraction of messages that mix flushes When to execute p? Threshold mix Mix runs p when N messages are in batch p always returns 1 (all messages are sent) Timed mix Mix runs p every T seconds p(n) = 1 always (flush all messages)

Mix Generics Function p: N -> [0,1] Threshold Pool mix p depends on number of messages, outputs fraction of messages that mix flushes When to execute p? Threshold Pool mix Mix runs p when pool reaches size n = N+P p(n) = N/(N+P) = 1 – P/(N+P) (always leave P messages in pool) Timed Pool mix Mix runs p every T seconds p(n) = (n-P)/n = 1 – P/n

Measuring Anonymity Anonymity Set Size = number of input messages that could correspond to a given output message Threshold Mix: Anonymity set size is always N (threshold) Timed Mix: Anonymity set size depends on batch size Pool Mix: Message may remain in pool for some time Anonymity set size = number of messages that ever entered Mix! Not a good model!

Measuring Anonymity Anonymity Set Size = number of input messages that could correspond to a given output message Change to ”effective” AS size Use Entropy as measure H = - Sum [pi log pi ], pi is probability of ith item If N items, all have prob p = 1/N, then H = log N i.e., number of bits to specify which item out of N Here, pi is the probability that a particular input message i corresponds to an output message Effective AS size is 2H

Measuring Anonymity Timed Pool Mix Mix fires every T seconds ni msgs in pool in ith round ni – P messages are randomly selected Prob(msg is flushed) = pi = (ni–P)/ni Prob(msg that arrived in round r leaves in round i) = pr P [j = i to r-1] (1 – pj)

Measuring Anonymity Threshold Pool Mix Mix fires whenever n = N+P N messages are randomly selected Prob(msg is flushed) = N/(N+P) = 1 – P/(N+P) Prob(msg that arrived in round r leaves in round i) = [N/(N+P)] Prod [j = i to r-1] [N/(N+P)] Gain anonymity at cost of increasing delay Delay increased probabilistically according to exponential distribution

Binomial Mix Treat p(n) not as a (hard) fraction Treat as a probability instead Bias for coin to toss for each message in pool Decide whether to flush that message or not Now size of pool varies Let s = number of messages flushed On average, s = n p(n) But follows binomial distribution Variance = n p (1-p) Attacker gains less info about size of pool Practically can’t guess n with prob > 15%

Mix Padding In addition to padding messages to some constant length (and segmenting longer messages), mix may introduce dummy messages into traffic Dummy messages especially useful in timed mixes (may not have many messages to send) Strong resistance from network guys Increased network load! Research question: how much does this form of padding help, and what is the relationship between increase in anonymity and cost of padding?

Next Attacks on Mix networks Cost measures of Optimization Rerouting Message padding Optimization How to preserve anonymity at low (least?) cost Information leakage How much information is revealed? How? How to prevent? Treat as (covert) communication channel