Provable UnlinkabilityAgainst Traffic AnalysisAmnon Ta-Shma

Joint work with Ron Berman and Amos Fiat

School of Computer Science, Tel-Aviv University

Problem definition

M senders S=s1…sM and M receivers R=r1…rM. N nodes in a complete synchronous communication

network. A public key infrastructure (PKI).

We assume some of the links are honest, and some are dishonest.

We look for a protocol such that the messages arrive at their destination, yet the adversary knows very littleabout the matching Π:SR.

A very basic problem

A tremendous amount of work. Many practical systems and protocols. Relevant in peer to peer data exchange. Forms a basis to many other protocols,

such as electronic cash systems and voting schemes.

Chaum’s work (1979)

Chaum (1979) showed that using onion-routing, one can assume the adversary is restricted to traffic analysis.

Unlinkability was never proven. In fact, Chaum’s protocol is insecure.

Chaum’s work is the basis for most later work.

Chaumian-MIX (1979) Unproven security (in fact: insecure). Requires dummy traffic.

RS (1993) Proven security. Not efficient (all players play all time). Requires secure computation.

Many FUZZY attempts.

First Attempt (1993)

Dining Cryptographers Proven security. Not efficient (all players must play all time). Requires shared randomness. Requires broadcast.

Crowds Proven (very) weak security.

Busses Proven security. Not efficient (all players play all time).

Entirely Different Attempts

Our Contribution

A set of simple equivalent measures of unlinkability. A connection with Information Theory. Rigorous proof. We can extend the proof to realistic adversaries that

have prior knowledge.

We rely on Chaum’s ideas, but

We replace FUZZY security with proven security.

What is Unlinkability?

What is unlinkability?

Π - actual permutation that took place during communication.

C - information the adversary has. 0/1 matrix, with 1 indicating a communication line being used.

We would like to formalize:

Almost always: Π does not carry information about C.

1.

2.

3.

Mutual information - I(X:Y) =H(X) + H(Y) - H(X,Y)How much info does one RV convey on another.

All definitions are equivalent.

What is unlinkability?

1

Pr | 93C C RS

1

Pr |c C C c

( : )I C

The Protocol

The Protocol (almost Chaum)

Forward: Alice chooses v1…vt-1 , v0=Alice, vT=Bob.

Alice randomly chooses r1…rT return keys. Each onion layer i contains:

Address of next node en route (vi+1). Return key ri saved by node i. Unique identifier zi. Encrypted onion part sent to vi+1.

Example

1

2

3

4

5

1

2

3

4

5

1

2

3

4

5

1

2

3

4

5

1

2

3

4

5

1 2 3 40

Our Protocol

Chaum vs. Us

1. Chaum assumes the adversary controls all links, we assume the adversary controls only most links.

2. In Chaum, honest messages mix within a honest node (and so every vertex waits until it receives at least two messages).

In our scheme, honest messages mix in honest links.

3. Chaum’s protocol is insecure, unless all honest players play all the time. Ours is secure even if honest players play only when required.

The Proof

We show the communication pattern contains many honest crossovers:

And these crossovers hide enough information.

1

2 2’

1’

3 3’

Proof Idea

Honest Crossovers are Abundant

No matter how the adversary chooses its links:

Lemma [Alo01]: Let G=(V,E) be a graph and

assume:

then:

| || |

2

VE f

4

, , ,Pr ( , ), ( , ), ( , )( , )

a b c d Va c a d b c b d E f

So what do we do with a honest crossover?

We would like to:

First, prove that every single player is protected. Second, prove that no information is leaked

about the group behavior.

The chain rule becomes handy:

I(П:C)= I(П(1):C)+ I(П(2):C|П(1))+…

Obscurant Networks Crossover Network – Each vertex has in-degree

and out-degree one or two. Oi – The probability distribution of output when a

pebble is put on starting vertex i.

0.5

0.5 1

0.5

0.5

0.5

0.5

A network is ε-obscurant if |Oi-UM|≤ε.

For a power of two: the butterfly is 0-obscurant. For other input lengths, We give a construction.

B4 P4

Simple Obscurant Networks Exist.

We look for an embedding of an obscurant network.

1

2

3

4

5

1

2

3

4

5

1

2

3

4

5

1

2

3

4

5

1

2

3

4

5

Theorem

Assume our protocol runs in a network with N nodes, N(N-1)/2 communication links, some constant fraction of which are honest.

Then the protocol is α(n)-unlinkable when run

T≥Ω(log(N)log2(N/α(n))

steps.

Prior Information

The Question

Does the security proof hold when the adversary has extensive, a-priori information? E.g.,

People like to correspond with people speaking their language…

Much mail goes within organizations..

A very realistic concern.

Link each vertex vi(t) with its corresponding

vertex at level T-t, and reveal all data to the adversary if either link is curious.

We prove the adversary still does not get much information about the middle layer.

We conclude from that the adversary does not learn much information about the permutation.

We can handle even Prior Information!

We have a folding of the network:

1

2

3

4

5

3

1

4

5

2

1

2

3

4

5

5

2

4

1

3

4

5

1

3

2

Folding

And we return to the original problem with f2!!

Extensions and Open Questions

Extensions

More realistic approach – a link is honest some of the time.

Donor privacy – the ability to donate items and answer requests, without being identified.

Open Questions

Incomplete network graph.

Malicious behavior.

Multi-shot games.

Dynamic network topology changes.

The END

Example NetworkProof Sketch

Init Repeat t=log(M)+log(ε-1) times

Z=4

M=5

k=M-Z=1