It was requested by people from all over the world and shared its - - PowerPoint PPT Presentation

it was requested by people from
SMART_READER_LITE
LIVE PREVIEW

It was requested by people from all over the world and shared its - - PowerPoint PPT Presentation

HE DATA KRAKEN is an ancient oracle of wisdom and knowledge. It was requested by people from all over the world and shared its knowledge. Bu But t th the e or orac acle le became hungry for information


slide-1
SLIDE 1

HE DATA KRAKEN is an ancient oracle of wisdom and knowledge. It was requested by people from all over the world and shared its knowledge. Bu But t th the e or

  • rac

acle le became hungry for information…

http://www.fubiz.net/wp-content/uploads/2012/03/the-kraken-existence2.jpg

slide-2
SLIDE 2

Practical Mix Network Design

Jeff Burdges David Stainton 27.12.2017

slide-3
SLIDE 3

“Encryption works. Properly implemented strong crypto systems are one of the few things that you can rely on.” –Edward Snowden (2013)

slide-4
SLIDE 4

“We kill people based on metadata” –Michael Hayden (Ex-NSA Director)

slide-5
SLIDE 5

Time to resist traffic analysis!

slide-6
SLIDE 6

Existing solutions?

slide-7
SLIDE 7

Five years ago the NSA considered Tor effective, at least against mass location tracking.

slide-8
SLIDE 8

Tor is not enough “[Tor does not] protect against an attacker who can see .. both traffic going into [and] coming out of the Tor network .. as simple statistics let you decide whether [both flows] match up.” –Roger Dingledine, “One cell is enough ..” See: Johnson, Wacek, Jansen, Scherr, Syverson. Users Get Routed: Traffic Correlation on Tor By Realistic Adversaries. (CCS 2013)

slide-9
SLIDE 9

You only need one side if the other side behaves predictably, like a website. Admit defeat on the web for now..

slide-10
SLIDE 10

Can we message our friend’s over Tor?

slide-11
SLIDE 11

How can we keep messaging metadata private?

slide-12
SLIDE 12

What is a mix network?

  • 1. Message oriented
  • 2. Unreliable packet switching network
  • 3. Layered encryption in a single packet
  • 4. Added latency per hop, aka they mix
slide-13
SLIDE 13

What is a mix network?

PKI Mix Nodes Clients

slide-14
SLIDE 14

Mix networks are among the oldest anonymity tools, dating back to David Chaum. Untraceable electronic mail, return addresses, and digital pseudonyms, Comm. ACM, 24, 2 (Feb. 1981); 84-90 We know other anonymity system designs, like

◮ Dining cryptographer’s networks (DC-nets) ◮ Private Information Retrieval (PIR)

but they all scale poorly.. most need quadratic bandwidth per user.

slide-15
SLIDE 15

Attack: Epistemic

PKI Mix Nodes Clients

slide-16
SLIDE 16

Topology: Cascade

Mix Nodes Clients

slide-17
SLIDE 17

Topology: Free route

slide-18
SLIDE 18

Topology: Stratified

Diaz, Murdoch, Troncoso. Impact of Network Topology on Anonymity and Overhead in Low-Latency Anonymity Networks PETs 2010

slide-19
SLIDE 19

Topology: Stratified

slide-20
SLIDE 20

Isn’t this just Tor?

No: Onion routers provde cryptographic unlinkability, .. but they do not mix! Mix strategies delay packets to reduce correlation between incoming and outgoing packets.. adding latency. See: Claudia Diaz & Andrei Serjantov. Generalising Mixes. PET 2003

slide-21
SLIDE 21
slide-22
SLIDE 22
slide-23
SLIDE 23
slide-24
SLIDE 24

Attack: Blending aka n-1

slide-25
SLIDE 25

Attack: Statistical disclosure

Mix Nodes Clients

slide-26
SLIDE 26

Attack: Statistical disclosure Mix Nodes Clients

slide-27
SLIDE 27

Loopix Achitecture

Ania Piotrowska, Jamie Hayes, Tariq Elahi, Sebastian Meiser, and George Danezis. The Loopix Anonymity System Usenix 26, 2017.

slide-28
SLIDE 28

Loopix Provider to Client traffic padding

slide-29
SLIDE 29

Anonymity Trilemma (Das, Meiser, Mohammadi, Kate (2017))

Anonymity cannot scale better than |cover traffic| · |latency| Take aways: Tor’s situation: |cover traffic| ∗ 0 = 0 Anonymity cost still looks quadratic too.. but not in users. –

slide-30
SLIDE 30

“The universe believes in encryption” –Julian Assange (2012) Encryption is free, but you must pay for anonymity.

slide-31
SLIDE 31

Don’t roll your own packet format!

Sphinx is a remarkably compact and secure packet format designed by George Danezis and Ian Goldberg. Security proof in the universal composability model, using on earlier work by Camenisch & Lysyanskaya 2005.

slide-32
SLIDE 32

Don’t roll your own packet format!

Sphinx is a remarkably compact and secure packet format designed by George Danezis and Ian Goldberg. Security proof in the universal composability model, using on earlier work by Camenisch & Lysyanskaya 2005. Header Body

slide-33
SLIDE 33

A Sphinx packet is a tuple (α, β, γ, δ) where α is an elliptic curve point, β is routing data onion encrypted with a stream cipher, γ is a MAC for β, and    header δ is the packet body onion encrypted with a wide-block cipher. (α, β, γ, δ) (α′, β′, γ′, δ′) n n′ n′ H(xα) H(aX) X = xG α = aG

slide-34
SLIDE 34

Attack: Tagging

Question: Why is the body δ not MACed? (α, β, γ, δ) (α′, β′, γ′, ?) An unMACed stream cipher is dangerous ? = δ′ ⊕ ”Hello Eve, This is Alice′s message.” but a wide-block cipher admits only a fractional bit tagging attack

slide-35
SLIDE 35

Single-use Reply Blocks (SURBs)

Anonymous receivers matter: Journalistic sources Services: CENO, money, etc. Protocol ACKs! (α, β, γ, δ) δ = ”... My SURB is (n, date, α, β, γ)...” n H(xα) H(aX) X = xG α = aG δ

slide-36
SLIDE 36

Attack: Compromise

We want protocols to be forward-secure, aka have key erasure. Problem: α is ephemeral, but the node’s key X is not! Uh oh! Idea 1: Replay attacks necessitate a Bloom filter, which necessitates key rotation.. so rotate faster?

  • Meh. Don’t stress the PKI.

SURB lifetime = Node key lifetime Can we do better?

slide-37
SLIDE 37

Attack: Compromise

We want protocols to be forward-secure, aka have key erasure. Problem: α is ephemeral, but the node’s key X is not! Uh oh! Idea 1: Replay attacks necessitate a Bloom filter, which necessitates key rotation.. so rotate faster?

  • Meh. Don’t stress the PKI.

SURB lifetime = Node key lifetime Idea 2: Tor is forward-secure.. so use more packets but not like Tor? George Danezis (2003): Use packets in different key epochs. Jeff: First use a loop to get an answer.. and then double ratchet.

  • Meh. This is cheating. Not all hops.
slide-38
SLIDE 38

Sphinx’ opinions on key exchanges

Long-term keys Blinding Key erasure Post-quantum Hybrid PQ Performance ECC ✓ ✓ ✗ good Pairing ✓ ✓ ⇒ ✗ O(|packets|) LWE ✓ ? ? ✓ ✗ elephant SIDH ? ✓ ? ✓ ✗ snail cheat ✓ ✓ ⇔ ✓ ✓ good

FS PQ Sphinx Conjecture

There is a fast-ish efficient LWE key exchange with fast efficient blinding and punctures, but no scheme with hybrid blinding.

slide-39
SLIDE 39

The case of the lost packet The case of the lost ACK

receiver Packet 0

ACK 0

* dropped Timeout sender Packet 1 Packet 1

ACK 1

* dropped Timeout Packet 1 Time

ACK 1

slide-40
SLIDE 40

Katzenpost: crypto layers

Link Layer

Mix Network Cryptographic Protocol Layers

Sending Client

Client end to end messaging

Client Client Client Mix Mix Mix

Mixnet Packet Layer: Sphinx

Provider Provider

Mix Mix Mix

Provider Provider

Client

slide-41
SLIDE 41

Loopix: Alice sends a message to Bob

slide-42
SLIDE 42

Loopix: Bob retreives message from his Provider.

slide-43
SLIDE 43

Stronger location hiding properties.

slide-44
SLIDE 44

Lake Proposal

Can both sender and receiver be protected by the mixnet? Yes!

slide-45
SLIDE 45

Application: Money

Taler’s RSA blind signatures have information theoretically secure blinding. Zcash requires at least inverting hash functions

slide-46
SLIDE 46

Application: Web-ish

slide-47
SLIDE 47

Application: Relax!

We want to design applications so that users experience the latency as a benefit.. as productive disengagement. “Work at a different speed” –Brian Eno, Oblique Strategies (1974)

slide-48
SLIDE 48

Thanks to the following people: Yawning Angel George Danezis Claudia Diaz Christian Grothoff Ania Piotrowska

slide-49
SLIDE 49

Katzenpost project page: design docs, specifications and mailing lists https://katzenpost.mixnetworks.org/