umbc protocol meeting 10/01/03 universal re-encryption: for mix-nets and other applications (to...
Post on 21-Dec-2015
212 views
TRANSCRIPT
![Page 1: UMBC Protocol Meeting 10/01/03 Universal Re-encryption: For Mix-Nets and Other Applications (to appear CT-RSA ’04) Paul Syverson NRL Markus Jakobsson Ari](https://reader030.vdocument.in/reader030/viewer/2022032521/56649d5f5503460f94a3ef41/html5/thumbnails/1.jpg)
UMBC Protocol Meeting 10/01/03
Universal Re-encryption:For Mix-Nets and Other Applications
(to appear CT-RSA ’04)
Paul SyversonNRL
Markus Jakobsson Ari Juels RSA Labs
Philippe GolleStanford
(now at PARC)
![Page 2: UMBC Protocol Meeting 10/01/03 Universal Re-encryption: For Mix-Nets and Other Applications (to appear CT-RSA ’04) Paul Syverson NRL Markus Jakobsson Ari](https://reader030.vdocument.in/reader030/viewer/2022032521/56649d5f5503460f94a3ef41/html5/thumbnails/2.jpg)
Extra Acknowledgements
• Most Mix illustrations cribbed from a talk by Ari Juels
• Some RFID slides cribbed from Markus Jakobsson’s ACM WiSe’03 talk
• See their Web pages for originals
![Page 3: UMBC Protocol Meeting 10/01/03 Universal Re-encryption: For Mix-Nets and Other Applications (to appear CT-RSA ’04) Paul Syverson NRL Markus Jakobsson Ari](https://reader030.vdocument.in/reader030/viewer/2022032521/56649d5f5503460f94a3ef41/html5/thumbnails/3.jpg)
Talk Outline
• Background and Motivation for mixes and universal re-encryption
• Definitions, Security Properties• Implementation using ElGamal• Applications: Bulletin Board, RFID
Privacy• Security Arguments
![Page 4: UMBC Protocol Meeting 10/01/03 Universal Re-encryption: For Mix-Nets and Other Applications (to appear CT-RSA ’04) Paul Syverson NRL Markus Jakobsson Ari](https://reader030.vdocument.in/reader030/viewer/2022032521/56649d5f5503460f94a3ef41/html5/thumbnails/4.jpg)
What does a mix network do?
message 1
message 2
message 3
message 4
Randomly permutes and decrypts inputs
Mix network
![Page 5: UMBC Protocol Meeting 10/01/03 Universal Re-encryption: For Mix-Nets and Other Applications (to appear CT-RSA ’04) Paul Syverson NRL Markus Jakobsson Ari](https://reader030.vdocument.in/reader030/viewer/2022032521/56649d5f5503460f94a3ef41/html5/thumbnails/5.jpg)
What does a mix network do?
message 2
Key property: Adversary can’t tell which ciphertext corresponds
to a given message
?
![Page 6: UMBC Protocol Meeting 10/01/03 Universal Re-encryption: For Mix-Nets and Other Applications (to appear CT-RSA ’04) Paul Syverson NRL Markus Jakobsson Ari](https://reader030.vdocument.in/reader030/viewer/2022032521/56649d5f5503460f94a3ef41/html5/thumbnails/6.jpg)
Example application: Anonymizing bulletin board or e-mail
From Bob
From CharlieFrom Alice
![Page 7: UMBC Protocol Meeting 10/01/03 Universal Re-encryption: For Mix-Nets and Other Applications (to appear CT-RSA ’04) Paul Syverson NRL Markus Jakobsson Ari](https://reader030.vdocument.in/reader030/viewer/2022032521/56649d5f5503460f94a3ef41/html5/thumbnails/7.jpg)
From Bob
From CharlieFrom Alice
“I love
Alice”
“Nobody loves Bob”
“Ilove
Charlie”
Is it Bob, Charlie,
self-love, or other?
Example application: Anonymizing bulletin board or e-mail
![Page 8: UMBC Protocol Meeting 10/01/03 Universal Re-encryption: For Mix-Nets and Other Applications (to appear CT-RSA ’04) Paul Syverson NRL Markus Jakobsson Ari](https://reader030.vdocument.in/reader030/viewer/2022032521/56649d5f5503460f94a3ef41/html5/thumbnails/8.jpg)
A look under the hood
![Page 9: UMBC Protocol Meeting 10/01/03 Universal Re-encryption: For Mix-Nets and Other Applications (to appear CT-RSA ’04) Paul Syverson NRL Markus Jakobsson Ari](https://reader030.vdocument.in/reader030/viewer/2022032521/56649d5f5503460f94a3ef41/html5/thumbnails/9.jpg)
Basic Mix (Chaum ‘81)
Server 1 Server 2 Server 3
PK1 PK2PK3
![Page 10: UMBC Protocol Meeting 10/01/03 Universal Re-encryption: For Mix-Nets and Other Applications (to appear CT-RSA ’04) Paul Syverson NRL Markus Jakobsson Ari](https://reader030.vdocument.in/reader030/viewer/2022032521/56649d5f5503460f94a3ef41/html5/thumbnails/10.jpg)
Encryption of Message
PK1 PK2PK3
message
Ciphertext = EPK1[EPK2[EPK3[message]]]
![Page 11: UMBC Protocol Meeting 10/01/03 Universal Re-encryption: For Mix-Nets and Other Applications (to appear CT-RSA ’04) Paul Syverson NRL Markus Jakobsson Ari](https://reader030.vdocument.in/reader030/viewer/2022032521/56649d5f5503460f94a3ef41/html5/thumbnails/11.jpg)
Basic Chaumian Mix
Server 1 Server 2 Server 3
m1
m2
m3
m2
m3
m1
decrypt
and
permute
m2
m1
m3
decrypt
and
permute
decrypt
and
permute
m2
m3
m1
![Page 12: UMBC Protocol Meeting 10/01/03 Universal Re-encryption: For Mix-Nets and Other Applications (to appear CT-RSA ’04) Paul Syverson NRL Markus Jakobsson Ari](https://reader030.vdocument.in/reader030/viewer/2022032521/56649d5f5503460f94a3ef41/html5/thumbnails/12.jpg)
Basic Chaumian Mix
m1
m2
m3
m2
m3
m1
decrypt
and
permute
m2
m1
m3
decrypt
and
permute
decrypt
and
permute
m2
m3
m1
Observe: As long as one server is honest,
privacy is preserved
![Page 13: UMBC Protocol Meeting 10/01/03 Universal Re-encryption: For Mix-Nets and Other Applications (to appear CT-RSA ’04) Paul Syverson NRL Markus Jakobsson Ari](https://reader030.vdocument.in/reader030/viewer/2022032521/56649d5f5503460f94a3ef41/html5/thumbnails/13.jpg)
Basic Chaumian Mix
Server 1 Server 2 Server 3
m3?
![Page 14: UMBC Protocol Meeting 10/01/03 Universal Re-encryption: For Mix-Nets and Other Applications (to appear CT-RSA ’04) Paul Syverson NRL Markus Jakobsson Ari](https://reader030.vdocument.in/reader030/viewer/2022032521/56649d5f5503460f94a3ef41/html5/thumbnails/14.jpg)
What if one server fails?
Server 1 Server 2 Server 3
SK2
•Previous solution ideas: •Robustness: Share key among other mixes
•Twinning Splitting•Reliability: Track and use reputable mixes
![Page 15: UMBC Protocol Meeting 10/01/03 Universal Re-encryption: For Mix-Nets and Other Applications (to appear CT-RSA ’04) Paul Syverson NRL Markus Jakobsson Ari](https://reader030.vdocument.in/reader030/viewer/2022032521/56649d5f5503460f94a3ef41/html5/thumbnails/15.jpg)
What if one server fails?
Server 1 Server 2 Server 3
SK2
•New Idea: Mixing without keys•No need to depend on any server (recovery mechanism)•No need to trust servers to protect keys•No need for PKI
X
![Page 16: UMBC Protocol Meeting 10/01/03 Universal Re-encryption: For Mix-Nets and Other Applications (to appear CT-RSA ’04) Paul Syverson NRL Markus Jakobsson Ari](https://reader030.vdocument.in/reader030/viewer/2022032521/56649d5f5503460f94a3ef41/html5/thumbnails/16.jpg)
A look further under the hood
![Page 17: UMBC Protocol Meeting 10/01/03 Universal Re-encryption: For Mix-Nets and Other Applications (to appear CT-RSA ’04) Paul Syverson NRL Markus Jakobsson Ari](https://reader030.vdocument.in/reader030/viewer/2022032521/56649d5f5503460f94a3ef41/html5/thumbnails/17.jpg)
Basic Re-encryption Mixnet
• Inputs are ciphertexts• Outputs are a re-encryption of the inputs.
• ElGamal public key encryption:– Anyone can encrypt with the public key e– Those who know the secret key d can also decrypt – Malleable: can produce E2(m) from E1(m) without knowing d– Verifiable– Multiplicative homomorphism: given E(m) and E(m’) I can
produce E(mm’)
![Page 18: UMBC Protocol Meeting 10/01/03 Universal Re-encryption: For Mix-Nets and Other Applications (to appear CT-RSA ’04) Paul Syverson NRL Markus Jakobsson Ari](https://reader030.vdocument.in/reader030/viewer/2022032521/56649d5f5503460f94a3ef41/html5/thumbnails/18.jpg)
Universal Re-encryption Mixnet
• Inputs are ciphertexts• Outputs are a re-encryption of the inputs.
• ElGamal public key encryption:– Anyone can encrypt without the public key e– Those who know the secret key d can also decrypt – Messages encrypted with different keys are
indistinguishable
![Page 19: UMBC Protocol Meeting 10/01/03 Universal Re-encryption: For Mix-Nets and Other Applications (to appear CT-RSA ’04) Paul Syverson NRL Markus Jakobsson Ari](https://reader030.vdocument.in/reader030/viewer/2022032521/56649d5f5503460f94a3ef41/html5/thumbnails/19.jpg)
Talk Outline
• Background and Motivation for mixes and universal re-encryption
• Definitions, Security Properties• Implementation using ElGamal• Applications: Bulletin Board, RFID
Privacy• Security Arguments
![Page 20: UMBC Protocol Meeting 10/01/03 Universal Re-encryption: For Mix-Nets and Other Applications (to appear CT-RSA ’04) Paul Syverson NRL Markus Jakobsson Ari](https://reader030.vdocument.in/reader030/viewer/2022032521/56649d5f5503460f94a3ef41/html5/thumbnails/20.jpg)
Randomized Public-Key Cryptosystem
• (PK, SK) KG:generate key pairs• C E(m, r, PK) :encryption of m• m D(SK, C) :decryption of C
![Page 21: UMBC Protocol Meeting 10/01/03 Universal Re-encryption: For Mix-Nets and Other Applications (to appear CT-RSA ’04) Paul Syverson NRL Markus Jakobsson Ari](https://reader030.vdocument.in/reader030/viewer/2022032521/56649d5f5503460f94a3ef41/html5/thumbnails/21.jpg)
Semantic Security
• Adversary chooses (m0 , m1 )
• Messages are encrypted• (C0 , C1 ) = (E(m0, r0, PK), E(m1, r1, PK))
and randomly permuted• If adversary determines order correctly
no better than by guessing (within ) system is semantically secure
![Page 22: UMBC Protocol Meeting 10/01/03 Universal Re-encryption: For Mix-Nets and Other Applications (to appear CT-RSA ’04) Paul Syverson NRL Markus Jakobsson Ari](https://reader030.vdocument.in/reader030/viewer/2022032521/56649d5f5503460f94a3ef41/html5/thumbnails/22.jpg)
Re-encryption
• Given:• Randomized public-key cryptosystem• Ciphertexts of form C = E(m, r, PK)
• C’ Re(C, r’, PK) :Re-encryption of m
![Page 23: UMBC Protocol Meeting 10/01/03 Universal Re-encryption: For Mix-Nets and Other Applications (to appear CT-RSA ’04) Paul Syverson NRL Markus Jakobsson Ari](https://reader030.vdocument.in/reader030/viewer/2022032521/56649d5f5503460f94a3ef41/html5/thumbnails/23.jpg)
Semantic Security underRe-encryption
• Adversary chooses (C0 , C1 )
• Messages are re-encrypted• (C0’, C1’ ) = (Re(C0, r0’, PK), Re(C1, r1’, PK))
and randomly permuted
• If adversary gets order correct no better than by guessing (within ) system is semantically secure under re-encryption
![Page 24: UMBC Protocol Meeting 10/01/03 Universal Re-encryption: For Mix-Nets and Other Applications (to appear CT-RSA ’04) Paul Syverson NRL Markus Jakobsson Ari](https://reader030.vdocument.in/reader030/viewer/2022032521/56649d5f5503460f94a3ef41/html5/thumbnails/24.jpg)
Key-Privacy (Anonymity)
• Adversary chooses message m• m is encrypted under PK0 and PK1
E(m, PK0 ) = C0 E(m, PK1 ) = C1
• If adversary guesses correspondence of ciphertext with public key with negligible advantage, scheme satisfies key-privacy
• Bellare et al. (ASIACRYPT’01) showed ElGamal provides anonymity under chosen-ciphertext assuming DDH.
![Page 25: UMBC Protocol Meeting 10/01/03 Universal Re-encryption: For Mix-Nets and Other Applications (to appear CT-RSA ’04) Paul Syverson NRL Markus Jakobsson Ari](https://reader030.vdocument.in/reader030/viewer/2022032521/56649d5f5503460f94a3ef41/html5/thumbnails/25.jpg)
• Given:• Randomized public-key cryptosystem• Ciphertexts of form C = E(m, r, PK)
• C’ URe(C, r’, PK) :
Universal re-encryption of m
Universal Re-encryption
X
![Page 26: UMBC Protocol Meeting 10/01/03 Universal Re-encryption: For Mix-Nets and Other Applications (to appear CT-RSA ’04) Paul Syverson NRL Markus Jakobsson Ari](https://reader030.vdocument.in/reader030/viewer/2022032521/56649d5f5503460f94a3ef41/html5/thumbnails/26.jpg)
Universal Semantic Security under Re-encryption
• Combines semantic security and key-privacy• Given PK0 and PK1 adversary chooses
(m0, m1, r0, r1 ) to produce (C0, C1 ) • Messages are universal re-encrypted
(C0’, C1’ ) = (URe(C0, r0’), URe(C1, r1’))• Ciphertexts are randomly ordered (Cb’, C1-b’ ) • If adversary gets order correct no better than by
guessing (within ) system is universal semantically secure under re-encryption
![Page 27: UMBC Protocol Meeting 10/01/03 Universal Re-encryption: For Mix-Nets and Other Applications (to appear CT-RSA ’04) Paul Syverson NRL Markus Jakobsson Ari](https://reader030.vdocument.in/reader030/viewer/2022032521/56649d5f5503460f94a3ef41/html5/thumbnails/27.jpg)
Talk Outline
• Background and Motivation for mixes and universal re-encryption
• Definitions, Security Properties• ElGamal based Universal Re-encryption• Applications: Bulletin Board, RFID
Privacy• Security Arguments
![Page 28: UMBC Protocol Meeting 10/01/03 Universal Re-encryption: For Mix-Nets and Other Applications (to appear CT-RSA ’04) Paul Syverson NRL Markus Jakobsson Ari](https://reader030.vdocument.in/reader030/viewer/2022032521/56649d5f5503460f94a3ef41/html5/thumbnails/28.jpg)
ElGamal Encryption
• P,Q are prime, P = 2Q + 1• GQ subgroup of ZP* of order Q
• g generator of GQ
• x GQ is private key
• y = gx mod P is public key • E(m) = (gr, myr) where r GQ ,r random
• D(G,M) = M/Gx = myr /gxr = m
![Page 29: UMBC Protocol Meeting 10/01/03 Universal Re-encryption: For Mix-Nets and Other Applications (to appear CT-RSA ’04) Paul Syverson NRL Markus Jakobsson Ari](https://reader030.vdocument.in/reader030/viewer/2022032521/56649d5f5503460f94a3ef41/html5/thumbnails/29.jpg)
ElGamal with Re-encryption
• Ciphertext (G,M)• Re-encryption (G’,M’) = (Ggr’, Myr’)
• Needs public key y but not private key
• D(G’,M’) = M’/G’x = myrr’ /gxrr’ = m• Introduced for voting• Much work on efficient provable shuffles
![Page 30: UMBC Protocol Meeting 10/01/03 Universal Re-encryption: For Mix-Nets and Other Applications (to appear CT-RSA ’04) Paul Syverson NRL Markus Jakobsson Ari](https://reader030.vdocument.in/reader030/viewer/2022032521/56649d5f5503460f94a3ef41/html5/thumbnails/30.jpg)
Universal Re-encryption
• (a,b) = (E[m]; E[1]) E is ElGamal enc• (a’,b’) = (R[b,k]a; R[b,k ’])
• R[*,k] is re-encryption with random k• (E[m]’, E[1]’)= ([(myr ykr’, gr gkr’), (yr’k’, gr’k’)] • D(E[m]’) = M’/G’x = mykrr’ /gxkrr’ = m
![Page 31: UMBC Protocol Meeting 10/01/03 Universal Re-encryption: For Mix-Nets and Other Applications (to appear CT-RSA ’04) Paul Syverson NRL Markus Jakobsson Ari](https://reader030.vdocument.in/reader030/viewer/2022032521/56649d5f5503460f94a3ef41/html5/thumbnails/31.jpg)
Symmetric-hybrid Encryption
• U[k1],U[1],e[k1,m]• U[1] is universal blank
can be converted to U[mi] can be reused• e[k1,m] is symmetric encryption of m
• Final message
U[k1],U[k2],…U[kn],e[kn,e[kn-1,…e[k1,m]…]• Can also do an asymmetric hybrid
![Page 32: UMBC Protocol Meeting 10/01/03 Universal Re-encryption: For Mix-Nets and Other Applications (to appear CT-RSA ’04) Paul Syverson NRL Markus Jakobsson Ari](https://reader030.vdocument.in/reader030/viewer/2022032521/56649d5f5503460f94a3ef41/html5/thumbnails/32.jpg)
Talk Outline
• Background and Motivation for mixes and universal re-encryption
• Definitions, Security Properties• Implementation using ElGamal• Applications: Low Volume Bulletin
Board, RFID Privacy• Security Arguments
![Page 33: UMBC Protocol Meeting 10/01/03 Universal Re-encryption: For Mix-Nets and Other Applications (to appear CT-RSA ’04) Paul Syverson NRL Markus Jakobsson Ari](https://reader030.vdocument.in/reader030/viewer/2022032521/56649d5f5503460f94a3ef41/html5/thumbnails/33.jpg)
Universal Mixnet (Bulletin Board)
• Senders post messages universally encrypted for recipients• Proof of Knowledge if nonmalleability desired
• Any server can download, mix, and repost any or all messages• Servers can be dynamic• Shuffle proof if desired• No PKI and less trust of each server• No robustness/reliability issues with server failure
• No overhead or threats from replay (universal semantic security)
![Page 34: UMBC Protocol Meeting 10/01/03 Universal Re-encryption: For Mix-Nets and Other Applications (to appear CT-RSA ’04) Paul Syverson NRL Markus Jakobsson Ari](https://reader030.vdocument.in/reader030/viewer/2022032521/56649d5f5503460f94a3ef41/html5/thumbnails/34.jpg)
Low Volume Bulletin Board
• Suppose a bulletin board as above• Can mix with previous messages on board• Advantage: less delay retrieving new posts• Advantage: no need to detect replay (sort
of)• Disadvantage: Must try decrypting all
messages to find ones for you• Mitigate growth with message removal after PoK?
![Page 35: UMBC Protocol Meeting 10/01/03 Universal Re-encryption: For Mix-Nets and Other Applications (to appear CT-RSA ’04) Paul Syverson NRL Markus Jakobsson Ari](https://reader030.vdocument.in/reader030/viewer/2022032521/56649d5f5503460f94a3ef41/html5/thumbnails/35.jpg)
RFID Tags
• EZ Pass automated toll payment• Supermarket shipment tracking, stock
monitoring, theft prevention• Consumer stock monitoring, ordering• Consumer theft-protection of belongings• Implants in family pets• Monitoring cash flows (500 Euro notes)
![Page 36: UMBC Protocol Meeting 10/01/03 Universal Re-encryption: For Mix-Nets and Other Applications (to appear CT-RSA ’04) Paul Syverson NRL Markus Jakobsson Ari](https://reader030.vdocument.in/reader030/viewer/2022032521/56649d5f5503460f94a3ef41/html5/thumbnails/36.jpg)
Privacy Problems
500 Eurosin wallet
Serial numbers:597387,389473…
Wigmodel #4456
(cheap polyester)
30 items of lingerie
Das Kapital(paid with Amex card 345882299)
Pack of cigarettes(fourth pack this week)
500 Eurosin wallet
Serial numbers:597387,389473…
Wigmodel #4456
(cheap polyester)
30 items of lingerie
Das Kapital(paid with Amex card 345882299)
Pack of cigarettes(fourth pack this week)
![Page 37: UMBC Protocol Meeting 10/01/03 Universal Re-encryption: For Mix-Nets and Other Applications (to appear CT-RSA ’04) Paul Syverson NRL Markus Jakobsson Ari](https://reader030.vdocument.in/reader030/viewer/2022032521/56649d5f5503460f94a3ef41/html5/thumbnails/37.jpg)
Privacy Solutions?Method 1:Place RFID-tagsin protective meshor foil
Problem: makes locomotiondifficult… perhapsuseful for wallets
![Page 38: UMBC Protocol Meeting 10/01/03 Universal Re-encryption: For Mix-Nets and Other Applications (to appear CT-RSA ’04) Paul Syverson NRL Markus Jakobsson Ari](https://reader030.vdocument.in/reader030/viewer/2022032521/56649d5f5503460f94a3ef41/html5/thumbnails/38.jpg)
Privacy Solutions?Method 2:“Kill” RFID tags
Problem: RFID tags aremuch too useful…
![Page 39: UMBC Protocol Meeting 10/01/03 Universal Re-encryption: For Mix-Nets and Other Applications (to appear CT-RSA ’04) Paul Syverson NRL Markus Jakobsson Ari](https://reader030.vdocument.in/reader030/viewer/2022032521/56649d5f5503460f94a3ef41/html5/thumbnails/39.jpg)
Privacy Solutions?Method 2:“Put to sleep” RFID tags
Problems: • No continuous use• Complexity, key management, trust
![Page 40: UMBC Protocol Meeting 10/01/03 Universal Re-encryption: For Mix-Nets and Other Applications (to appear CT-RSA ’04) Paul Syverson NRL Markus Jakobsson Ari](https://reader030.vdocument.in/reader030/viewer/2022032521/56649d5f5503460f94a3ef41/html5/thumbnails/40.jpg)
1,2,3, …, 2023 pairs of sneakers and…(reading fails)…
1,2,3, …, 2023 pairs of sneakers and…(reading fails)…
Blocker simulates all (billions of)possible tag serial numbers!!
Privacy Solution: Blocker Tags(Juels, Rivest & Szydlo)
![Page 41: UMBC Protocol Meeting 10/01/03 Universal Re-encryption: For Mix-Nets and Other Applications (to appear CT-RSA ’04) Paul Syverson NRL Markus Jakobsson Ari](https://reader030.vdocument.in/reader030/viewer/2022032521/56649d5f5503460f94a3ef41/html5/thumbnails/41.jpg)
Universal Re-encryption for RFID Tag Privacy (Example)
• Alice at supermarket checkout.• Uses PKAlice from fidelity card.
• Cashier creates universal ciphertexts on Alice’s purchase IDs.
• As Alice walks home passes readers that re-encrypt her tags or does it herself.
• Alice enters home, tags decrypted for home use.
![Page 42: UMBC Protocol Meeting 10/01/03 Universal Re-encryption: For Mix-Nets and Other Applications (to appear CT-RSA ’04) Paul Syverson NRL Markus Jakobsson Ari](https://reader030.vdocument.in/reader030/viewer/2022032521/56649d5f5503460f94a3ef41/html5/thumbnails/42.jpg)
Security of ElGamal based BB
• Correctness: Can do shuffle proofs of correct mixing
• Communication privacy: If the universal cryptosystem is universal semantic-secure, then bulletin board construct provides communication privacy.
• For ElGamal implementation, communication privacy reduced to DDH.
![Page 43: UMBC Protocol Meeting 10/01/03 Universal Re-encryption: For Mix-Nets and Other Applications (to appear CT-RSA ’04) Paul Syverson NRL Markus Jakobsson Ari](https://reader030.vdocument.in/reader030/viewer/2022032521/56649d5f5503460f94a3ef41/html5/thumbnails/43.jpg)
Conclusions
• Universal Re-encryption: New primitive• Proven Security:
• ElGamal BB is correct (wrt mixing)• ElGamal BB reducible to DDH.
• Applications:• Reduced trust in mixes• Less complex mixnets (no PKI)• Privacy preserving RFID tags
• Future• Reduce receiver overhead in bulletin board• Meteor Mixing (with George Danezis)