:: Privacy Pass :: Bypassing internet challenges anonymously Alex - - PowerPoint PPT Presentation

▶
privacy pass bypassing internet challenges anonymously
SMART_READER_LITE
LIVE PREVIEW

:: Privacy Pass :: Bypassing internet challenges anonymously Alex - - PowerPoint PPT Presentation

Mar 15, 2023 41 likes •594 views

:: Privacy Pass :: Bypassing internet challenges anonymously Alex Davidson 1,3 Ian Goldberg 2 Nick Sullivan 3 George Tankersley 4 Filippo Valsorda 4 1 Royal Holloway, University of London 2 University of Waterloo 3 Cloudflare 4 Independent PETS

slide-1
SLIDE 1

:: Privacy Pass :: Bypassing internet challenges anonymously

Alex Davidson 1,3 Ian Goldberg 2 Nick Sullivan 3 George Tankersley 4 Filippo Valsorda 4

1Royal Holloway, University of London 2University of Waterloo 3Cloudflare 4Independent

PETS 2018, Barcelona July 25, 2019 https://privacypass.github.io alex.davidson.2014@rhul.ac.uk // @alxdavids

slide-2
SLIDE 2

Background Anonymous authentication protocol Privacy Pass Summary

2

slide-3
SLIDE 3

Content delivery networks

User CDN W’ W W’’

3

slide-4
SLIDE 4

Content delivery networks

User CDN W’ W W’’ W W

3

slide-5
SLIDE 5

Content delivery networks

User CDN W’ W W’’ W W

3

slide-6
SLIDE 6

Content delivery networks

User CDN W’ W W’’ ⊥ ?

e.g. DDoS, spam filtering, content scraping etc...

3

slide-7
SLIDE 7

IP reputation

User 27.2.187.41 CDN 27.2.187.41 W

4

slide-8
SLIDE 8

IP reputation

User 27.2.187.41 CDN 27.2.187.41 ⊥

4

slide-9
SLIDE 9

Is this a good system?

::false negatives:: User 27.2.187.41 particularly users of static, shared IP addresses

5

slide-10
SLIDE 10

Is this a good system?

::affected users::

5

slide-11
SLIDE 11

Is this a good system?

::worst case:: User 27.2.187.41 CDN ⊥

5

slide-12
SLIDE 12

Is this a good system?

::average case:: User 27.2.187.41 CDN

5

slide-13
SLIDE 13

Is this a good system?

::average case:: User 27.2.187.41 CDN

5

slide-14
SLIDE 14

Is this a good system?

::average case:: User 27.2.187.41 CDN W

5

slide-15
SLIDE 15

Problems with challenges (aka CAPTCHAs)

::: Heavily JS reliant ::: Potentially block access ::: Annoying/hard ::: Slow ::: Questionable protection ::: More round trips

6

slide-16
SLIDE 16

Possible solutions

::no blocking:: User CDN W

7

slide-17
SLIDE 17

Possible solutions

::cookies?:: User CDN W

7

slide-18
SLIDE 18

Possible solutions

::cookies?:: User CDN problem: linkability

7

slide-19
SLIDE 19

Contributions

::: Anonymous authentication protocol

:: based on elliptic curves and oblivious prfs :: combination of prior techniques [JKK14, Hen14]

::: Client-side implementation in browser extension ::: Server-side deployment in Cloudflare edge servers ::: Empirical survey of results

8

slide-20
SLIDE 20

Background Anonymous authentication protocol Privacy Pass Summary

9

slide-21
SLIDE 21

Oblivious pseudorandom function (OPRF)

C PRF(K, ·) hello

10

slide-22
SLIDE 22

Oblivious pseudorandom function (OPRF)

C PRF(K, ·) [x] x is hidden from the PRF evaluator

10

slide-23
SLIDE 23

Oblivious pseudorandom function (OPRF)

C PRF(K, ·)

PRF(K, x)

K is not revealed to C

10

slide-24
SLIDE 24

Verifiable OPRF (VOPRF)

C PRF(K, ·) y π π is a NIZK proof that y ← PRF(K, x)

11

slide-25
SLIDE 25

Elliptic curve VOPRF (EC-VOPRF)

[x] H(x)r = y [x]k = π DLEQ = H hashes x to an elliptic curve π is a discrete log equivalence (DLEQ) proof

12

slide-26
SLIDE 26

DLEQ proofs

::summary:: public commitments: g, h = gk signed token pair: x, y show that logg(h) = logx(y) = k without revealing k

13

slide-27
SLIDE 27

Anonymous authentication protocol

::signing:: C Server [x] gg

14

slide-28
SLIDE 28

Anonymous authentication protocol

::signing:: C Server y π

H(x)k

gg

14

slide-29
SLIDE 29

Anonymous authentication protocol

::redemption:: C Server x

MACH(x)k(x, . . .) H(x)k

server verifies MAC to authenticate C

14

slide-30
SLIDE 30

Anonymous authentication protocol

::multiple tokens:: C Server {[xi]}i gg

14

slide-31
SLIDE 31

Anonymous authentication protocol

::multiple tokens:: C Server {yi}i {πi}i similar design to [JKK14]

14

slide-32
SLIDE 32

Anonymous authentication protocol

::multiple tokens:: C Server {yi}i π batched DLEQ proofs! [Hen14]

14

slide-33
SLIDE 33

Security properties

::unlinkability:: ::: any x should be unlinkable from any signing phase ::: prevents server from linking authentication sessions ::: H(x)r uniformly blinds x from Server

15

slide-34
SLIDE 34

Security properties

::one-more-token security:: ::: for N signed tokens, hard to create N + 1 signed tokens ::: prevents client from forging signed tokens ::: reduction from one-more-decryption security of El Gamal

15

slide-35
SLIDE 35

Security properties

::Key consistency:: ::: ensures that all tokens are signed by one key k ::: prevent server deanonymisation using different keys ::: soundness of batch DLEQ proof [Hen14]

15

slide-36
SLIDE 36

Background Anonymous authentication protocol Privacy Pass Summary

16

slide-37
SLIDE 37

Privacy Pass

::browser extension::

17

slide-38
SLIDE 38

Privacy Pass

::Cloudflare:: ::: CDN serves 10% of internet traffic ::: use CAPTCHAs to prevent bots accessing origins ::: use IP reputation to decide challenging or not

17

slide-39
SLIDE 39

Privacy Pass

::acquiring signed tokens::

{xi}i k

17

slide-40
SLIDE 40

Privacy Pass

::acquiring signed tokens::

{xi}i k {[xi]}i

17

slide-41
SLIDE 41

Privacy Pass

::acquiring signed tokens::

{xi}i k

W

{yi}i

π

{H(xi)k}i

17

slide-42
SLIDE 42

Privacy Pass

::bypassing challenges::

{xi}i k

{H(xi)k}i

17

slide-43
SLIDE 43

Privacy Pass

::bypassing challenges::

{xi}i k

{H(xi)k}i

xi MACi xi

17

slide-44
SLIDE 44

Privacy Pass

::bypassing challenges::

{xi}i k

{H(xi)k}i

W

SDC xi

17

slide-45
SLIDE 45

Specifics

::: Elliptic curve: NIST P256 ::: Public commitments (g, gk) for DLEQ verification ::: Batch DLEQ PRNG: SHAKE-256 ::: Default # of signed tokens (client-side): 30 ::: Max signed tokens (server-side): 300 ::: Triggers: {status codes, headers} ::: Code:

:: https://github.com/privacypass/challenge-bypass-extension :: https://github.com/privacypass/challenge-bypass-server :: https://privacypass.github.io/protocol (protocol summary)

18

slide-46
SLIDE 46

Benchmarks

::Timings (ms)::

Operation Timings Client Token generation 120 + 64 · N Verify DLEQ 220 + 110 · N Total signing request 340 + 180 · N Total redeem request 57 Server Signing 0.04 + 0.20 · N DLEQ generation 0.32 + 0.55 · N Total signing 1.48 + 0.87 · N Total redemption 0.8

N = # of tokens batch signed

19

slide-47
SLIDE 47

Benchmarks

::Request size (bytes):: Operation Size (bytes) Signing request (U → CDN) 57 + 63 · N Signing response (CDN → U) 295 + 121 · N Redemption request (U → CDN) 396

N = # of tokens batch signed

19

slide-48
SLIDE 48

Cloudflare deployment (Nov 2017)

::Release:: ::: Extension released: 8 Nov 2017 ::: Downloads (28 Nov 2017)

:: Chrome extension: 8499 :: Firefox add-on: 3489

::: Downloads (Jul 2018)

:: Chrome extension: 61578 :: Firefox add-on: 16375

20

slide-49
SLIDE 49

Cloudflare deployment (Nov 2017)

Metric Global Tor Total requests (per week) 1.6 trillion 700 million Total challenged requests 1.04% 17% Signs (peak per hour) ∼600 ∼100 Redeems {Nov 2017} (peak per hour) ∼2000 ∼200 Redeems {Jul 2018} (peak per hour) ∼3300 ∼600 Single-domain cookies (Nov 2017) 515 million 34 million

20

slide-50
SLIDE 50

Background Anonymous authentication protocol Privacy Pass Summary

21

slide-51
SLIDE 51

Conclusion and links

::: Privacy Pass extension is still in beta ::: Further analysis of protocol/code would be welcome!

22

slide-52
SLIDE 52

Conclusion and links

::: Privacy Pass extension is still in beta ::: Further analysis of protocol/code would be welcome! ::: Protocol spec:

:: https://tinyurl.com/pp-protocol

::: Website:

:: https://privacypass.github.io

::: Code (contribute!):

:: https://github.com/privacypass/challenge-bypass-extension :: https://github.com/privacypass/challenge-bypass-server

::: Support:

:: privacy-pass-support@cloudflare.com

22

slide-53
SLIDE 53

Final notes

::: See paper for:

{ more analysis of out-of-band attacks, comparison with existing research, security proofs, implementation details }

::: EC-VOPRF IETF standardisation

:: https://github.com/chris-wood/draft-sullivan-cfrg-voprf

::: Future work:

{ DLEQ update, more integrations, better documentation, PQ VOPRF }

23

slide-54
SLIDE 54

Final notes

::: See paper for:

{ more analysis of out-of-band attacks, comparison with existing research, security proofs, implementation details }

::: EC-VOPRF IETF standardisation

:: https://github.com/chris-wood/draft-sullivan-cfrg-voprf

::: Future work:

{ DLEQ update, more integrations, better documentation, PQ VOPRF }

Thanks for listening!

https://privacypass.github.io

23

slide-55
SLIDE 55

References

[Hen14] Henry, Ryan. Efficient Zero-Knowledge Proofs and Applications. PhD thesis, University of Waterloo, 2014. http://hdl.handle.net/10012/8621. [JKK14] Stanislaw Jarecki, Aggelos Kiayias, and Hugo Krawczyk. Round-optimal password-protected secret sharing and T-PAKE in the password-only model. In Palash Sarkar and Tetsu Iwata, editors, ASIACRYPT 2014, Part II, volume 8874 of LNCS, pages 233--253. Springer, Heidelberg, December 2014.

24