on the design dilemma in dining cryptographer networks

On the Design Dilemma in Dining Cryptographer Networks

Institute for IT-Security and Security LawComputer Networks & Communications GroupUniversity of PassauGermany

Jens Oberender Hermann de Meer

TrustBus 2008

Turin, Italy

5. September 2008

partly supported byEuroNGI Design and Engineering of the Next Generation Internet (IST-028022)EuroNF Anticipating the Network of the Future (IST-216366)

Motivation

Connection-level anonymity

Establish communication privacy

Hides relationship between initiator and receiver of a message

Being undistinguishable within the anonymity set

Anonymity evolves in a non-cooperative game

Strategies := cooperate | defect

Node strategies -> anonymity set -> anonymity grade

Nash equilibria indicate best strategy

Does rational behavior have impact on the anonymity?

How can rationality protect reachability?

2On the Design Dilemma in DC-nets

Overview

Does rational behavior have impact on the anonymity?

1) Modeling rational behavior

2) Taxonomy of anonymity techniques

3) Accessible information in Dining Cryptographer (DC) networks

How can rationality protect availability?

4) Parameterizing games during design


Rational acting in Anonymity Networks

1. What benefit is received ?

Sender anonymity

Anonymity set enhances grade of anonymity

Challenges for design of anonymity systems Impact of strategic behavior on anonymity

Novel attacks targeting economy of anonymity

2. What cost is involved in participation?

Effective Throughput

Increase of message delay

Increase of traffic


on purpose to counter traffic analysis

Requirements of strategic behavior in anonymity networks

Enable senders to determine anonymity

1) Rely on trustworthy entities

No abuse of collected system-wide entropy

Trust into computing anonymity grade

2) Neighborhood–based approaches (first-hand experience)

Limited credibility – eclipse attack

Anonymity grade in near future

1) Based on prediction

2) Policy enforced


Determine anonymity grade

Strategic users consider anonymity of a message in advance

Decentralization: limited system view


Predicted Depdendable

Without

Pre-

requisites

Relies

on

Trust

Perceived anonymity

• broadcast responses in a DC-net

Assured anonymity

• queue state in a mixer node

Reported anonymity

• reported number of participants

e.g. AN.ON

Policy-enforced anonymity

• mixer policy in high-latency

mixers, no forwarding,

before anonymity guaranteed

Dining Cryptographer (DC) networks

Round-based

Sender broadcasts message or empty packet

Disruption: message collisions require retransmission

Security objective: reachability

Coding schemes

Cost in bandwidth, computation effort

Robustness against collisions

Countermeasure to disrupters


Apply game theory to Dining Cryptographer (DC) networks

Sequential game

Incomplete information Adversaries strategy unknown

Perfect information Time order

Non-cooperative game

Complete Information Payoff functions public

Imperfect information Concurrency


Design dilemma: efficient or robust

Designer Efficient Robust design

Participate Leave

Conforming Disrupt

User

Adversary

/

/

/

Random disruptions

Disrupter identification removes attacker from network

Disrupt without being identified as disrupter

Rational behavior, possible to formulate as utility function

Resolving dilemma games

Iterated Prisoner’s Dilemma (IPD) -> Mixed strategy solution

Nash Equilibria in iterated games

Probability distributions

Different strategies

p>80% disrupting in non-cooperative game

Ability to identify disrupters (>18%)prevents misbehavior in sequential game


Ability to identify disrupterUser’s preference for anonymity

0

0.2

0.4

0.6

0.8

1

0 0.2 0.4 0.6 0.8 1

Non-cooperative

Dis

rupt

pro

bab

ility

Sequential

Conclusions

Modeling of strategic behavior

Grade of anonymity relies on behavior of all participants

For design of anonymity systems

Risk-prevention of malicious participants

Dilemma games

Influence rational players through system parameters

Incomplete knowledge restrict the designer’s payoff,but parameters hinder malicious collisions

User perspective on future anonymity: more research ongoing


DC Coding Schemes

Bitwise XOR [Chaum88]

Not robust against collisions

Low computation overhead

Bilinear Maps [Golle04]

Robust against collisions

Medium computation overhead

Identification of Disrupters [Bos89]

Robust against collisions

High computation overhead

Identifies a disrupter


Dining Cryptographers network

Figure out, whether the meal has been paid by either one at the table

Protocol provides sender anonymity

Communication Anonymity

Anonymity := do not disclose communication relationship between sender and recipient

Technically: being indistinguishable within the anonymity set,i.e. all current communication participants

Level of anonymity scales with size of anonymity set

If a user leaves system degrades anonymityEspecially in small systems

DC net

Coding superimposes messages

Simultaneous slot occupation communication is disrupted

Effort to receive/decode broadcasts


Game Theory and Dilemmas

Models strategic behavior, e.g. in cooperative systems

Game defines players, strategy sets, and utility

Outcome defined by strategies of all users

Pay off: effective utility depending on the outcome of the game

Strategic behavior

Rationally acting, i.e. maximize payoff

Predict strategy of other players (Non-cooperative game)

Minimize own losses (Sequential game, incomplete knowledge)

Dilemma: strategic behavior does not increase payoff for any of the players


Stake holders of a DC-net

Dining Cryptographers network

Communicating subjects (=users)

Anonymous communication with reasonable cost

Adversary

Disrupt anonymous communications (increase user costs), but remain unidentified

DC-net designer

Facilitate high level of anonymity

Decreasing participation degrades anonymity (for small sizes)


Send M1

Send M2 Send M3

Broadcast

1) Robust design against malicious attacks

Design parameters

α none – collision robustness full

β no –disrupter identificationpossible

User (single instance)

γ low – anonymity preferencehigh

Compute Nash equilibria , i.e. best strategy for specified parameters

Probability for efficient (0) or robust (1) algorithm


0

1

0

1

0

1 0

0.2

0.4

0.6

0.8

1

0 0.2 0.4 0.6 0.8 1

Desig

ne

r S

tra

teg

y s

1

Sequential

Non-Coop.

=0

>0

References

Pfitzmann, A., Hansen, M.: Anonymity, unlinkability, undetectability, unobservability, pseudonymity, and identity management - a consolidated proposal for terminology. (2008) Draft

Dingledine, R., Mathewson, N.: Anonymity loves company: Usability and the network effect. In: Workshop on the Economics of Information Security. (2006)

Acquisti, A., Dingledine, R., Syverson, P.: On the economics of anonymity. In Financial Cryptography. Number 2742 in LNCS, Springer (2003)

Golle, P., Juels, A.: Dining cryptographers revisited. In: EUROCRYPT. Volume 3027 of LNCS, Springer (2004) 456-473

Bos, J.N., den Boer, B.: Detection of Disrupters in the DC Protocol. In: Workshop on the theory and application of cryptographic techniques on Advances in cryptology. (1989) 320-327


on the design dilemma in dining cryptographer networks

Technology