CS 6204, Spring 2005 Dining Cryptographers, Glenn Fink1 Dining Cryptographers Paper by David Chaum (1988) Presentation by Glenn Fink

CS 6204, Spring 2005 Dining Cryptographers, Glenn Fink2 Dining Cryptographers: Overview  Who says all the tough papers are at the end of the semester? –Anyone know what the Frobenius automorphism of the Galois group GF(p n ) is?  But apart from this, there is still much of practical utility in the paper.

CS 6204, Spring 2005 Dining Cryptographers, Glenn Fink3 Dining Cryptographers “Same” Result: #Diffs: 0 (Even) NSA Pays Act I: Three of a kind Flip Coins Make Observations Count Observations

CS 6204, Spring 2005 Dining Cryptographers, Glenn Fink4 Dining Cryptographers “Same”“Different” Result: #Diffs: 2 (Even) NSA Pays Act II: Two of a kind Flip Coins Make Observations Count Observations

CS 6204, Spring 2005 Dining Cryptographers, Glenn Fink5 Dining Cryptographers “Different” * Inverted * “Different” Result: #Diffs: 3 (Odd) Some Cryptographer Pays Act III: Two of a kind + Inversion I’m paying, but no one knows it’s me! Flip Coins Make Observations Count Observations

CS 6204, Spring 2005 Dining Cryptographers, Glenn Fink6 Proof Sketch (By Induction)  All heads or all tails: 0 Diffs  One tail, rest heads: 2 Diffs –On each side of tail  Two tails, rest heads: 2 cases: I.Two tails are adjacent: 2 Diffs II.Two tails nonadjacent: 4 Diffs  N+1 tails, rest heads: three cases: I.New tail is adjacent to one string of tails: No change II.New tail is nonadjacent to any string of tails: Two more diffs III.New tail connects two strings of tails: Two fewer diffs H H T H T H Diffs H H T T H H H H H H H H H H T H H H Result: If everyone tells the truth, there will always be an even number of differences H H T T H H Diffs T T T

CS 6204, Spring 2005 Dining Cryptographers, Glenn Fink7 Anonymity Set 0 Anonymity Set 1 Anonymity Set Graph Theory Interpretation  Persons=Nodes  Keys=Edges –Shared by nodes  Anonymity Set: –The set of nodes whose transmissions are indistinguishable  Collusion –Sharing keys to expose another person’s transmissions Partial Collusion: Not all keys shared

CS 6204, Spring 2005 Dining Cryptographers, Glenn Fink8 SharedKeysSharedKeys Keys and Compromises  A “key” is really just a history of all the quarters that will ever be flipped between two participants. –E.g., a string of bits  Key compromise means that a third party also knows the results of each flip.

CS 6204, Spring 2005 Dining Cryptographers, Glenn Fink9 Practical Considerations  Key Generation –Generate a true one-time pad via a physical random process –Generate a short key and expand it via pseudo-random process  Key Distribution –Covertly: in person or via pre-shared symmetric cipher –Publicly: via a public-key-enabled key exchange  Key Usage –Everyone sees the stream of bits from the message –Everyone sees the sum of the outputs of all the nodes –Comparing the sum at each round tells whether someone is transmitting, but… –… No one knows the originator of the message

CS 6204, Spring 2005 Dining Cryptographers, Glenn Fink10 Transmission Example   0 = 1 0   0 = 0 1   0 = 1 y  1=x x  1=y y  1=x y  0=y x  1=y y  0=y y Round 1 yx Flip Coins Make Observations Count Observations

CS 6204, Spring 2005 Dining Cryptographers, Glenn Fink11 Transmission Example   0 = 0 1   0 = 1  0 1   1 = 0 0   1 = 1 “yx” y  0=y x  0=x y  1=x x  0=x yx Round 2 yx Flip Coins Make Observations Count Observations

CS 6204, Spring 2005 Dining Cryptographers, Glenn Fink12 Transmission Example   0 = 1 1   1 = 0 1   1 = 0  1 0   1 = 1 0   0 = 0 “yx” x  1=y y  0=y y  1=x x  0=x x  1=y yx Round 3 y yx Flip Coins Make Observations Count Observations

CS 6204, Spring 2005 Dining Cryptographers, Glenn Fink13 Transmission Example   1 = 0 0   1 = 1 0   0 = 0 1   0 = 1 y  0=y x  0=x y  1=x x  1=y yx Round 4 yx yx Flip Coins Make Observations Count Observations

CS 6204, Spring 2005 Dining Cryptographers, Glenn Fink14 Transmission Example yx Summary yx yx yxyx  0110 “ ” yx Anonymous Transmission

CS 6204, Spring 2005 Dining Cryptographers, Glenn Fink15 Attacking the Dining Cryptographers “1” By partitioning a non-fully-connected network Sum = 1; Someone transmitted. Sum = 1; Transmitter is on this side. Sum = 0; Transmitter is not on this side. Ring network can be attacked in n log n rounds Fully-connected network requires n-1 attackers!

CS 6204, Spring 2005 Dining Cryptographers, Glenn Fink16 Conclusion  Chaum’s protocol allows parties to transmit anonymous messages in public.  The protocol is highly resistant to collusion attacks. –But attacks are possible because anonymity degrades with time. –Protocol does not protect physical path tracing. –Protocol does not provide for message confidentiality.  Communication via this protocol is four times less efficient on average than traceable transmission protocols.  Protocol forms the basis for Chaum’s DC-Net.

CS 6204, Spring 2005 Dining Cryptographers, Glenn Fink17 Other References  Good source of information on all sorts of anonymity schemes: –  Tutorial presentation given at ACM CCS 2004 on anonymity: – anon.ppt