Distributed Verification of Mixing - Local Anonymity Forking Proofs - PowerPoint PPT Presentation

Local Forking Proofs Cicho´ n, Klonowski, Kutyłowski Distributed Verification of Mixing - Local Anonymity Forking Proofs Model mixing applications Building blocks de- & re-encryption proofs of knowledge Jacek Cicho´ n, Marek Klonowski, Mirek Kutyłowski Standard techniques Wrocław University of Technology RPC verifiable mixing Institute of Mathematics and Computer Science Forking proofs local verifiability ACISP’2008, Woolongong, 7.07.2008 process analysis

Reaching anonymity typical scenario Local Forking Proofs Cicho´ n, Klonowski, Kutyłowski Input Anonymity a batch of encrypted messages/documents mixing applications the authors for each message is (more of less) known Building blocks de- & re-encryption proofs of knowledge Output Standard techniques plaintexts RPC verifiable mixing no link between the authors and the plaintexts Forking proofs local verifiability process analysis

MIX David Chaum Local Forking Proofs Cicho´ n, Klonowski, Steps executed by a mix Kutyłowski 1 get a set of ciphertexts Anonymity mixing 2 decrypt and/or re-encrypt them applications Building 3 permute the results at random blocks de- & re-encryption 4 output them proofs of knowledge Standard techniques RPC a perfect anonimizer as long as: verifiable mixing Forking proofs cryptographic part does not leak information, local verifiability process the mix is honest. analysis

Cascades of mixes protocol Local Forking Anonymization process with k parties Proofs Cicho´ n, each party holds a mix, Klonowski, Kutyłowski processing: 1 the input goes to mix 1, Anonymity mixing 2 mix i gets the input from mix i − 1 (for i > 1) and sends applications its output to mix i + 1 (for i < k ), Building blocks 3 mix k gives the output of the cascade. de- & re-encryption proofs of knowledge Standard techniques RPC verifiable mixing Forking proofs ? ? ? ? local verifiability process analysis

Cascades of mixes anonymity Local Forking Proofs Cicho´ n, Klonowski, perfect anonymity if at at least one mix can be trusted Kutyłowski Alice may trust a different mix than Bob! Anonymity mixing applications Building blocks de- & re-encryption proofs of knowledge Standard ? techniques RPC verifiable mixing Forking proofs local verifiability process analysis

Correctness Local Forking Proofs Cicho´ n, Klonowski, Problem Kutyłowski How do we know that no mix Anonymity mixing modifies the messages? applications Building removes message? blocks de- & re-encryption inserts own messages? proofs of knowledge Standard techniques RPC verifiable mixing Forking proofs local verifiability process analysis

Correctness Local Forking Proofs Cicho´ n, Klonowski, Problem Kutyłowski How do we know that no mix Anonymity mixing modifies the messages? applications Building removes message? blocks de- & re-encryption inserts own messages? proofs of knowledge Standard techniques RPC It does not suffice that at least one mix can be trusted. verifiable mixing Forking proofs If at least one mix is cheating, then the plaintexts local verifiability can be manipulated process analysis

Applications Local Forking Proofs Cicho´ n, Klonowski, Kutyłowski Anonymous communication in Internet Anonymity mixing messages sent to an Anonymizer encrypted with its applications public key, Building blocks protocols for processing through many hops (e.g. TOR) de- & re-encryption proofs of knowledge Standard techniques RPC we admit that a message can be removed or modified, verifiable mixing since it may occur anyway on the way to/from mixes Forking proofs local verifiability process analysis

E-voting Local Forking Proofs Cicho´ n, Klonowski, Kutyłowski requirements Anonymity mixing the encrypted votes need to be mixed so that: applications Building anonymity is guaranteed blocks de- & re-encryption a ballot cast must neither be modified nor replaced proofs of knowledge Standard techniques RPC verifiable mixing achieving correctness is the critical issue Forking proofs local verifiability process analysis

E-auctions Local Forking Proofs Cicho´ n, Klonowski, Kutyłowski Requirements (for certain auctions) Anonymity mixing offers come through anonymous communication channels: applications Building anonymity must be guaranteed: nobody should be able blocks to say who is participating, de- & re-encryption proofs of knowledge an offer will neither be modified or replaced Standard techniques RPC verifiable mixing Forking proofs achieving correctness is the critical issue local verifiability process analysis

Re-encryption with ElGamal Local Forking Proofs Cicho´ n, Klonowski, Kutyłowski Modifying a ciphertext without decryption Anonymity ciphertext ( a , b ) = ( m · β k , g k ) mixing applications re-encryption: Building blocks de- & re-encryption ( a , b ) := ( a · β k ′ , b · g k ′ ) proofs of knowledge Standard techniques for a random k ′ RPC verifiable mixing ( a , b ) becomes ( m · β k + k ′ , g k + k ′ ) Forking proofs local verifiability process analysis

Universal re-encryption with ElGamal Local Forking Proofs Cicho´ n, Klonowski, Kutyłowski Modifying a ciphertext without knowing public key Anonymity ciphertext ( a , b , c , d ) = ( m · β k , g k , β m , g m ) mixing applications Building re-encryption: blocks de- & re-encryption ( a , b , c , d ) := ( a · c k ′ , b · d k ′ , c k ′′ , d k ′′ ) proofs of knowledge Standard techniques for random k ′ , k ′′ RPC verifiable mixing ( a , b , c , d ) becomes ( m · β k + mk ′ , g k + mk ′ , β mk ′′ , g mk ′′ ) Forking proofs local verifiability process analysis

Partial decryption ElGamal Local Forking Proofs Cicho´ n, Klonowski, Kutyłowski Forcing decryption by many parties Anonymity ciphertext ( a , b ) = ( m · ( β 1 β 2 . . . β t ) k , g k ) mixing applications partial decryption: Building blocks de- & re-encryption ( a , b ) := ( a / b x 1 , b ) proofs of knowledge Standard techniques where g x 1 = β 1 RPC verifiable mixing Forking proofs ( a , b ) becomes ( m · ( β 2 . . . β t ) k , g k ) . local verifiability process analysis

Proofs of knowledge tools for showing correctness of re-encryption, decryption Local Forking Proofs ZKP of correct re-encryption Cicho´ n, Klonowski, Kutyłowski given a , b and c , d , show that you know some k so that a = c · β k , b = d · g k Anonymity mixing or: log β ( a / c ) = log g ( b / d ) , i.e. equality of discrete applications logarithms Building blocks de- & re-encryption proofs of knowledge Standard techniques RPC verifiable mixing Forking proofs local verifiability process analysis

Proofs of knowledge tools for showing correctness of re-encryption, decryption Local Forking Proofs ZKP of correct re-encryption Cicho´ n, Klonowski, Kutyłowski given a , b and c , d , show that you know some k so that a = c · β k , b = d · g k Anonymity mixing or: log β ( a / c ) = log g ( b / d ) , i.e. equality of discrete applications logarithms Building blocks de- & re-encryption proofs of knowledge ZKP of correct re-encryption Standard techniques given ( a 1 , b 1 ) , . . . , ( a s , b s ) and c , d , show that you know RPC verifiable mixing some k so that for some (unrevealed) i : Forking proofs a i = c · β k , b i = d · g k local verifiability process or: log β ( a i / c ) = log g ( b i / d ) , i.e. equality of discrete analysis logarithms with some pair

RPC anonymization Local Forking Proofs Cicho´ n, Klonowski, Kutyłowski Anonymity mixing applications Building blocks de- & re-encryption proofs of knowledge Standard techniques RPC verifiable mixing Forking proofs local verifiability process analysis

RPC anonymization Local Forking Proofs Cicho´ n, Klonowski, Kutyłowski Anonymity mixing applications Building blocks de- & re-encryption proofs of knowledge Standard techniques RPC verifiable mixing Forking proofs local verifiability process analysis

RPC anonymization Local Forking Proofs Cicho´ n, Klonowski, Kutyłowski Anonymity mixing applications Building blocks de- & re-encryption proofs of knowledge Standard techniques RPC verifiable mixing Forking proofs local verifiability process analysis

RPC anonymization Local Forking Proofs Cicho´ n, Klonowski, Kutyłowski Anonymity mixing applications Building blocks de- & re-encryption proofs of knowledge Standard techniques RPC verifiable mixing Forking proofs local verifiability process analysis

RPC Local Forking Proofs Cicho´ n, Klonowski, Kutyłowski Anonymity Properties mixing applications 50% of links for each mix revealed Building blocks no path of consecutive links revealed de- & re-encryption proofs of knowledge good properties in terms of probability distribution after Standard techniques O ( 1 ) mixes RPC verifiable mixing Forking proofs local verifiability process analysis