Provable Unlinkability Against Traffic Analysis Amnon Ta-Shma Joint work with Ron Berman and Amos Fiat School of Computer Science, Tel-Aviv University

Problem definition M senders S={s 1 …s M } and M receivers R={r 1 …r M }. N nodes in a complete synchronous communication network. A public key infrastructure (PKI). We assume some of the links are honest, and some are dishonest. We look for a protocol such that the messages arrive at their destination, yet the adversary knows very little about the matching Π:S  R.

A very basic problem A tremendous amount of work. Many practical systems and protocols. Relevant in peer to peer data exchange. Forms a basis to many other protocols, such as electronic cash systems and voting schemes.

Chaum’s work (1979) Chaum (1979) showed that using onion- routing, one can assume the adversary is restricted to traffic analysis. Unlinkability was never proven. In fact, Chaum’s protocol is insecure. Chaum’s work is the basis for most later work.

Chaumian-MIX (1979)  Unproven security (in fact: insecure).  Requires dummy traffic. RS (1993)  Proven security.  Not efficient (all players play all time).  Requires secure computation. Many FUZZY attempts. First Attempt (1993)

Dining Cryptographers  Proven security.  Not efficient (all players must play all time).  Requires shared randomness.  Requires broadcast. Crowds  Proven (very) weak security. Busses  Proven security.  Not efficient (all players play all time). Entirely Different Attempts

Our Contribution A set of simple equivalent measures of unlinkability. A connection with Information Theory. Rigorous proof. We can extend the proof to realistic adversaries that have prior knowledge. We rely on Chaum’s ideas, but We replace FUZZY security with proven security. with proven security.

What is Unlinkability?

What is unlinkability? Π - actual permutation that took place during communication. C - information the adversary has. 0/1 matrix, with 1 indicating a communication line being used. We would like to formalize: Almost always: Π does not carry information about C.

Mutual information - I(X:Y) =H(X) + H(Y) - H(X,Y) How much info does one RV convey on another. All definitions are equivalent. What is unlinkability?

The Protocol

The Protocol (almost Chaum) Forward: Alice chooses v 1 …v t-1, v 0 =Alice, v T =Bob. Alice randomly chooses r 1 …r T return keys. Each onion layer i contains:  Address of next node en route (v i+1 ).  Return key r i saved by node i.  Unique identifier z i.  Encrypted onion part sent to v i+1.

Example Our Protocol

Chaum vs. Us 1.Chaum assumes the adversary controls all links, we assume the adversary controls only most links. 2.In Chaum, honest messages mix within a honest node (and so every vertex waits until it receives at least two messages). In our scheme, honest messages mix in honest links. 3.Chaum’s protocol is insecure, unless all honest players play all the time. Ours is secure even if honest players play only when required.

The Proof

We show the communication pattern contains many honest crossovers: And these crossovers hide enough information. 1 22’ 1’ 33’ Proof Idea

Honest Crossovers are Abundant No matter how the adversary chooses its links: Lemma [Alo01]: Let G=(V,E) be a graph and assume: then:

So what do we do with a honest crossover? We would like to: First, prove that every single player is protected. Second, prove that no information is leaked about the group behavior. The chain rule becomes handy: I(П:C)= I(П(1):C)+ I(П(2):C|П(1))+ …

Obscurant Networks Crossover Network – Each vertex has in-degree and out-degree one or two. O i – The probability distribution of output when a pebble is put on starting vertex i A network is ε-obscurant if |O i -U M |≤ε.

For a power of two: the butterfly is 0-obscurant. For other input lengths, We give a construction. B4B4 P4P4 Simple Obscurant Networks Exist.

We look for an embedding of an obscurant network

Theorem Assume our protocol runs in a network with N nodes, N(N-1)/2 communication links, some constant fraction of which are honest. Then the protocol is α(n)-unlinkable when run T≥Ω(log(N)log 2 (N/α(n)) steps.

Prior Information

The Question Does the security proof hold when the adversary has extensive, a-priori information? E.g., People like to correspond with people speaking their language… Much mail goes within organizations.. A very realistic concern.

Link each vertex v i (t) with its corresponding vertex at level T-t, and reveal all data to the adversary if either link is curious. We prove the adversary still does not get much information about the middle layer. We conclude from that the adversary does not learn much information about the permutation. We can handle even Prior Information!

We have a folding of the network: Folding And we return to the original problem with f 2 !!

Extensions and Open Questions

Extensions More realistic approach – a link is honest some of the time. Donor privacy – the ability to donate items and answer requests, without being identified.

Open Questions Incomplete network graph. Malicious behavior. Multi-shot games. Dynamic network topology changes.

The END

Example Network Proof Sketch InitRepeat t=log(M)+log(ε -1 ) times Z=4 M=5 k=M-Z=1