1. Anonymity Analysis of Onion Routing in the Universally Composable Framework Joan Feigenbaum Aaron Johnson Paul Syverson Yale University U.S. Naval Research Laboratory Provable Privacy Workshop July 9, 2012

2. Problem ● [FJS07a] - Onion-routing I/O-automata model - Possibilistic anonymity analysis ● [FJS07b] - Onion-routing abstract model - Probabilistic anonymity analysis ● […] - How do we apply results in standard cryptographic models? ● [CL05] - “Onion routing” formalized with Universal Composability (UC) - No anonymity analysis ● [BGKM12] - Onion routing formalized with UC - Our work will provide anonymity

3. Solution ● Formalize abstract (black-box) model of onion routing in UC framework ● Focus on information leaked ● Anonymity analysis on earlier abstract model is inherited by UC version

4. Problem ● [FJS07a] - Onion-routing I/O-automata model - Possibilistic anonymity analysis ● [FJS07b] - Onion-routing abstract model - Probabilistic anonymity analysis ● […] - How do we apply results in standard cryptographic models? ● [CL05] - “Onion routing” formalized with Universal Composability (UC) - No anonymity analysis ● [BGKM12] - Onion routing formalized with UC - Our work will provide anonymity

5. I/O-automata model u 12 3 4 5 d User u running client Internet destination d Onion routing relays Adversary controls relays Encrypted onion-routing hop Unencrypted onion-routing hop

6. I/O-automata model u 12 3 4 5 d Main theorem: Adversary can only determine parts of a circuit it controls or is next to. u12

7. I/O-automata model u12 3 4 5 d 1. 2. 3. 4. v w e f

8. I/O-automata model u12 3 4 5 d 1.First router compromised 2. 3. 4. v w e f

9. I/O-automata model u12 3 4 5 d 1.First router compromised 2.Last router compromised 3. 4. v w e f

10. I/O-automata model u12 3 4 5 d 1.First router compromised 2.Last router compromised 3.First and last compromised 4. v w e f

11. I/O-automata model u12 3 4 5 d 1.First router compromised 2.Last router compromised 3.First and last compromised 4.Neither first nor last compromised v w e f

12. Problem ● [FJS07a] - Onion-routing I/O-automata model - Possibilistic anonymity analysis ● [FJS07b] - Onion-routing abstract model - Probabilistic anonymity analysis ● […] - How do we apply results in standard cryptographic models? ● [CL05] - “Onion routing” formalized with Universal Composability (UC) - No anonymity analysis ● [BGKM12] - Onion routing formalized with UC - Our work will provide anonymity

13. Black-box Abstraction ud v w e f

14. ud v w e f 1. Users choose a destination

15. Black-box Abstraction ud v w e f 1. Users choose a destination 2.Some inputs are observed

16. Black-box Abstraction ud v w e f 1. Users choose a destination 2.Some inputs are observed 3.Some outputs are observed

17. Black-box Anonymity ud v w e f The adversary can link observed inputs and outputs of the same user.

18. Black-box Anonymity ud v w e f The adversary can link observed inputs and outputs of the same user. Any configuration consistent with these observations is indistinguishable to the adversary.

19. Black-box Anonymity ud v w e f The adversary can link observed inputs and outputs of the same user. Any configuration consistent with these observations is indistinguishable to the adversary.

20. Black-box Anonymity ud v w e f The adversary can link observed inputs and outputs of the same user. Any configuration consistent with these observations is indistinguishable to the adversary.

21. Probabilistic Black-box ud v w e f

22. ud v w e f Each user v selects a destination from distribution p v pupu

23. Probabilistic Black-box ud v w e f Each user v selects a destination from distribution p v Inputs and outputs are observed independently with probability b pupu

24. Problem ● [FJS07a] - Onion-routing I/O-automata model - Possibilistic anonymity analysis ● [FJS07b] - Onion-routing abstract model - Probabilistic anonymity analysis ● […] - How do we apply results in standard cryptographic models? ● [CL05] - “Onion routing” formalized with Universal Composability (UC) - No anonymity analysis ● [BGKM12] - Onion routing formalized with UC - Our work will provide anonymity

25. Problem ● [FJS07a] - Onion-routing I/O-automata model - Possibilistic anonymity analysis ● [FJS07b] - Onion-routing abstract model - Probabilistic anonymity analysis ● [FJS12] – Onion-routing UC formalization - “Free” probabilistic anonymity analysis ● [CL05] - “Onion routing” formalized with Universal Composability (UC) - No anonymity analysis ● [BGKM12] - Onion routing formalized with UC - Our work will provide anonymity

26. Onion-Routing UC Ideal Functionality u with probability b ø with probability 1-b x y Upon receiving destination d from user U d with probability b ø with probability 1-b Send (x,y) to the adversary. F OR

27. Black-box Model ● Ideal functionality F OR ● Environment assumptions – Each user gets a destination – Destination for user u chosen from distribution p u ● Adversary compromises a fraction b of routers before execution

28. UC Formalization ● Captures necessary properties of any crytographic implementation ● Easy to analyze resulting information leaks ● Functionality is a composable primitive ● Anonymity results are valid in probabilistic version of I/O-automata model

29. Anonymity Analysis of Black Box ● Can lower bound expected anonymity with standard approximation: b 2 + (1-b 2 )p u d ● Worst case for anonymity is when user acts exactly unlike or exactly like others ● Worst-case anonymity is typically as if √b routers compromised: b + (1-b)p u d ● Anonymity in typical situations approaches lower bound

30. Future Extensions ● Compromised links ● Non-uniform path selection ● Heterogeneous path selection ● Anonymity over time

31. Problem ● [FJS07a] - Onion-routing I/O-automata model - Possibilistic anonymity analysis ● [FJS07b] - Onion-routing abstract model - Probabilistic anonymity analysis ● [FJS12] – Onion-routing UC formalization - “Free” probabilistic anonymity analysis ● [CL05] - “Onion routing” formalized with Universal Composability (UC) - No anonymity analysis ● [BGKM12] - Onion routing formalized with UC - Our work will provide anonymity

32. [BGKM12] Ideal Functionality ● Functionality can actually send messages ● Needs wrapper to hide irrelevant circuit-building options ● Shown to UC-emulate F OR

33. References [BGKM12] Provably Secure and Practical Onion Routing, by Michael Backes, Ian Goldberg, Aniket Kate, and Esfandiar Mohammadi, in CSF12. [CL05] A Formal Treatment of Onion Routing, by Jan Camenisch and Anna Lysyanskaya, in CRYPTO 05. [FJS07a] A Model of Onion Routing with Provable Anonymity, by Joan Feigenbaum, Aaron Johnson, and Paul Syverson, in FC07. [FJS07b] Probabilistic Analysis of Onion Routing in a Black-box Model, id., in WPES07. [FJS12] A Probabilistic Analysis of Onion Routing in a Black-box Model, id. in TISSEC (forthcoming)