Reducing Metadata Leakage from Encrypted Files and Communication - - PowerPoint PPT Presentation

▶
reducing metadata leakage from encrypted files and
SMART_READER_LITE
LIVE PREVIEW

Reducing Metadata Leakage from Encrypted Files and Communication - - PowerPoint PPT Presentation

Dec 01, 2023 319 likes •999 views

Reducing Metadata Leakage from Encrypted Files and Communication with PURBs Kirill Nikitin * , Ludovic Barman * , Wouter Lueks, Matthew Underwood, Jean-Pierre Hubaux, and Bryan Ford cole polytechnique fdrale de Lausanne (EPFL) @ni_kirill

slide-1
SLIDE 1

Reducing Metadata Leakage from Encrypted Files and Communication with PURBs

Kirill Nikitin*, Ludovic Barman*, Wouter Lueks, Matthew Underwood, Jean-Pierre Hubaux, and Bryan Ford

École polytechnique fédérale de Lausanne (EPFL)

*Shared first authorship

@ni_kirill @lbarman_ch

slide-2
SLIDE 2

❖ Reducing Metadata Leakage with PURBs @ PETS 2019

!2 Kirill Nikitin

[Dog video]

slide-3
SLIDE 3

❖ Reducing Metadata Leakage with PURBs @ PETS 2019

Ciphertexts Expose Metadata in Clear

!3 Kirill Nikitin

Metadata Ciphertext Encrypted Payload

! "

⚙

⚙

To whom Algorithms used Message size …

slide-4
SLIDE 4

❖ Reducing Metadata Leakage with PURBs @ PETS 2019

OpenPGP Packet Format

!5 Kirill Nikitin

Packet Type

8502 0c01 9497 608d d051 8f79 010f ff46 bd7f 1821 27a9 42c4 01b4 7ecd 433e 7f90 . . . . . 74b8 139c a802 6678 ba0d 1abd d264 014b 6a5a f586 e3fa b98e 92d1 6759 7186 2ccc ac50 3db7 fa03 4f31 dcd7 fa40 . . . . . 4b09 d9b4 1654 972d 5c22 47db

Session Key Part Data Part

Recipient Key ID Public-Key Algorithm Encrypted Data Format version

Credit for the picture of the attacker here and graphics afterwards is to Vecteezy.com

slide-5
SLIDE 5

❖ Reducing Metadata Leakage with PURBs @ PETS 2019

OpenPGP Packet Format

!5 Kirill Nikitin

Packet Type

8502 0c01 9497 608d d051 8f79 010f ff46 bd7f 1821 27a9 42c4 01b4 7ecd 433e 7f90 . . . . . 74b8 139c a802 6678 ba0d 1abd d264 014b 6a5a f586 e3fa b98e 92d1 6759 7186 2ccc ac50 3db7 fa03 4f31 dcd7 fa40 . . . . . 4b09 d9b4 1654 972d 5c22 47db

Session Key Part Data Part

Recipient Key ID Public-Key Algorithm Encrypted Data Format version

A message to the King of Sweden encrypted with RSA-512 using an outdated OpenPGP format??

Small key? Outdated format? I might crack it!

Credit for the picture of the attacker here and graphics afterwards is to Vecteezy.com

slide-6
SLIDE 6

❖ Reducing Metadata Leakage with PURBs @ PETS 2019

OpenPGP Packet Format

!5 Kirill Nikitin

Packet Type

8502 0c01 9497 608d d051 8f79 010f ff46 bd7f 1821 27a9 42c4 01b4 7ecd 433e 7f90 . . . . . 74b8 139c a802 6678 ba0d 1abd d264 014b 6a5a f586 e3fa b98e 92d1 6759 7186 2ccc ac50 3db7 fa03 4f31 dcd7 fa40 . . . . . 4b09 d9b4 1654 972d 5c22 47db

Session Key Part Data Part

Recipient Key ID Public-Key Algorithm Encrypted Data Format version

A message to the King of Sweden encrypted with RSA-512 using an outdated OpenPGP format??

Small key? Outdated format? I might crack it!

Is exposing metadata necessary?

Credit for the picture of the attacker here and graphics afterwards is to Vecteezy.com

slide-7
SLIDE 7

❖ Reducing Metadata Leakage with PURBs @ PETS 2019

What If We Stripped Off All the Metadata?

!6 Kirill Nikitin

“Black Square”, 1915, by Kazimir Malevich

slide-8
SLIDE 8

❖ Reducing Metadata Leakage with PURBs @ PETS 2019

It Is Possible But Challenging

1. Efficient decoding

  • 2. When addressing multiple recipients
  • 3. Using different cryptographic algorithms

!7 Kirill Nikitin

$ % & $

slide-9
SLIDE 9

❖ Reducing Metadata Leakage with PURBs @ PETS 2019

Padded Uniform Random Blobs (PURBs)

  • A novel format for encrypted data without any metadata in clear.
  • The properties (informally):

!8 Kirill Nikitin

Content Metadata — PURB — Content and metadata protection — PURB — 1001…01

?!

Indistinguishability from random bits

PURB

PURB

PURB

PURB

PURB

PURB

PURB

PURB

Minimized length leakage

slide-10
SLIDE 10

❖ Reducing Metadata Leakage with PURBs @ PETS 2019

Padded Uniform Random Blobs (PURBs)

  • Two core components
  • Encoding scheme (Multi-Suite PURB or MsPURB)
  • Padding scheme (Padmé)

!9 Kirill Nikitin

slide-11
SLIDE 11

❖ Reducing Metadata Leakage with PURBs @ PETS 2019

Encoding scheme (MsPURB)

!10 Kirill Nikitin

slide-12
SLIDE 12

❖ Reducing Metadata Leakage with PURBs @ PETS 2019

Roadmap to MsPURB

!11 Kirill Nikitin

Single Recipient Multiple Suites Non-malleability Multiple Recipients

slide-13
SLIDE 13

❖ Reducing Metadata Leakage with PURBs @ PETS 2019

Single Recipient: Model

!12 Kirill Nikitin

— PURB —

Insecure channel Is it a PURB or a random bit string?! Active Adversary Honest Sender Honest Recipient

Single Recipient Multiple Suites Non- malleability Multiple Recipients

slide-14
SLIDE 14

❖ Reducing Metadata Leakage with PURBs @ PETS 2019

Single Recipient

!13 Kirill Nikitin

Recipient – public key Gy Similar to the Integrated Encryption Scheme (IES) [ABR01]

Single Recipient Multiple Suites Non- malleability Multiple Recipients

slide-15
SLIDE 15

❖ Reducing Metadata Leakage with PURBs @ PETS 2019

Single Recipient

Sender: 1. Generates an ephemeral key pair x, Gx;

!13 Kirill Nikitin

Recipient – public key Gy Similar to the Integrated Encryption Scheme (IES) [ABR01]

Single Recipient Multiple Suites Non- malleability Multiple Recipients

slide-16
SLIDE 16

❖ Reducing Metadata Leakage with PURBs @ PETS 2019

Single Recipient

Sender: 1. Generates an ephemeral key pair x, Gx; 2. Computes a shared secret Gyx;

!13 Kirill Nikitin

Recipient – public key Gy Similar to the Integrated Encryption Scheme (IES) [ABR01]

Single Recipient Multiple Suites Non- malleability Multiple Recipients

slide-17
SLIDE 17

❖ Reducing Metadata Leakage with PURBs @ PETS 2019

Single Recipient

Sender: 1. Generates an ephemeral key pair x, Gx; 2. Computes a shared secret Gyx; 3. Encrypts the data with one-time session key K;

!13 Kirill Nikitin

EncK (data)

Recipient – public key Gy Similar to the Integrated Encryption Scheme (IES) [ABR01]

Payload

Single Recipient Multiple Suites Non- malleability Multiple Recipients

slide-18
SLIDE 18

❖ Reducing Metadata Leakage with PURBs @ PETS 2019

Single Recipient

Sender: 1. Generates an ephemeral key pair x, Gx; 2. Computes a shared secret Gyx; 3. Encrypts the data with one-time session key K; 4. Creates an entry point with K and other metadata, encrypted with Gyx;

!13 Kirill Nikitin

EncK (data) AEGyx ( K || meta )

Recipient – public key Gy Similar to the Integrated Encryption Scheme (IES) [ABR01]

Entry point Payload

Single Recipient Multiple Suites Non- malleability Multiple Recipients

slide-19
SLIDE 19

❖ Reducing Metadata Leakage with PURBs @ PETS 2019

Single Recipient

Sender: 1. Generates an ephemeral key pair x, Gx; 2. Computes a shared secret Gyx; 3. Encrypts the data with one-time session key K; 4. Creates an entry point with K and other metadata, encrypted with Gyx; 5. Encodes Gx as a uniform bit string, e.g., with Elligator [BHKL13].

!13 Kirill Nikitin

EncK (data) AEGyx ( K || meta ) Hide(Gx)

Recipient – public key Gy Similar to the Integrated Encryption Scheme (IES) [ABR01]

Encoded public key Entry point Payload

Single Recipient Multiple Suites Non- malleability Multiple Recipients

slide-20
SLIDE 20

❖ Reducing Metadata Leakage with PURBs @ PETS 2019

Multiple Recipients

!14 Kirill Nikitin

— PURB —

Single Recipient Multiple Suites Non- malleability Multiple Recipients

slide-21
SLIDE 21

❖ Reducing Metadata Leakage with PURBs @ PETS 2019

Multiple Recipients

!15 Kirill Nikitin

Recipients – public keys Gy1, Gy2, Gy3. We create an entry point per recipient, each with K and metadata but encrypted with Gy1x, Gy2x, Gy3x respectively.

AEGy1x(K||meta) AEGy2x(K||meta) AEGy3x(K||meta)

Single Recipient Multiple Suites Non- malleability Multiple Recipients

slide-22
SLIDE 22

❖ Reducing Metadata Leakage with PURBs @ PETS 2019

Multiple Recipients

!15 Kirill Nikitin

Recipients – public keys Gy1, Gy2, Gy3. We create an entry point per recipient, each with K and metadata but encrypted with Gy1x, Gy2x, Gy3x respectively. But how do we organize these entry points in the PURB?

AEGy1x(K||meta) AEGy2x(K||meta) AEGy3x(K||meta)

Single Recipient Multiple Suites Non- malleability Multiple Recipients

slide-23
SLIDE 23

❖ Reducing Metadata Leakage with PURBs @ PETS 2019

Linear Approach Strawman

!16 Kirill Nikitin

Hide(Gx) EncK (data)

Recipients – public keys Gy1, Gy2, Gy3. We create an entry point per recipient, each with K and metadata but encrypted with Gy1x, Gy2x, Gy3x respectively.

Single Recipient Multiple Suites Non- malleability Multiple Recipients

slide-24
SLIDE 24

❖ Reducing Metadata Leakage with PURBs @ PETS 2019

Linear Approach Strawman

!16 Kirill Nikitin

Hide(Gx) EncK (data) AEGy1x(K||meta)

Recipients – public keys Gy1, Gy2, Gy3.

AEGy2x(K||meta) AEGy3x(K||meta)

We create an entry point per recipient, each with K and metadata but encrypted with Gy1x, Gy2x, Gy3x respectively.

Single Recipient Multiple Suites Non- malleability Multiple Recipients

slide-25
SLIDE 25

❖ Reducing Metadata Leakage with PURBs @ PETS 2019

Linear Approach Strawman

!16 Kirill Nikitin

Hide(Gx) EncK (data) AEGy1x(K||meta)

Recipients – public keys Gy1, Gy2, Gy3.

AEGy2x(K||meta) AEGy3x(K||meta)

We create an entry point per recipient, each with K and metadata but encrypted with Gy1x, Gy2x, Gy3x respectively.

Inefficient to decode

Single Recipient Multiple Suites Non- malleability Multiple Recipients

slide-26
SLIDE 26

❖ Reducing Metadata Leakage with PURBs @ PETS 2019

Hash Table

Single Hash-Table Strawman

!17 Kirill Nikitin

Hide(Gx) EncK (data)

Recipients – public keys Gy1, Gy2, Gy3.

Single Recipient Multiple Suites Non- malleability Multiple Recipients

Entry points are placed in a hash table, indexed by Gyx

slide-27
SLIDE 27

❖ Reducing Metadata Leakage with PURBs @ PETS 2019

Hash Table

!18 Kirill Nikitin

Hide(Gx) EncK (data)

Recipients – public keys Gy1, Gy2, Gy3.

AEGy3x(K||meta) AEGy1x(K||meta) AEGy2x(K||meta)

Single Recipient Multiple Suites Non- malleability Multiple Recipients

Entry points are placed in a hash table, indexed by Gyx

Single Hash-Table Strawman

slide-28
SLIDE 28

❖ Reducing Metadata Leakage with PURBs @ PETS 2019

Hash Table

!19 Kirill Nikitin

Hide(Gx) EncK (data)

Recipients – public keys Gy1, Gy2, Gy3.

AEGy3x(K||meta) random AEGy1x(K||meta) AEGy2x(K||meta) random

Single Recipient Multiple Suites Non- malleability Multiple Recipients

Entry points are placed in a hash table, indexed by Gyx

Single Hash-Table Strawman

slide-29
SLIDE 29

❖ Reducing Metadata Leakage with PURBs @ PETS 2019

Hash Table

!19 Kirill Nikitin

Hide(Gx) EncK (data)

Recipients – public keys Gy1, Gy2, Gy3.

AEGy3x(K||meta) random AEGy1x(K||meta) AEGy2x(K||meta) random 1. Space waste

  • 2. Bound on N of recipients

Single Recipient Multiple Suites Non- malleability Multiple Recipients

Entry points are placed in a hash table, indexed by Gyx

Single Hash-Table Strawman

slide-30
SLIDE 30

❖ Reducing Metadata Leakage with PURBs @ PETS 2019

Multiple Recipients: Our Solution

!20 Kirill Nikitin

Hide(Gx) EncK (data)

Recipients – public keys Gy1, Gy2, Gy3. Entry points are placed in a series of growing hash-tables!

Single Recipient Multiple Suites Non- malleability Multiple Recipients

slide-31
SLIDE 31

❖ Reducing Metadata Leakage with PURBs @ PETS 2019

HT0

Multiple Recipients: Our Solution

!20 Kirill Nikitin

Hide(Gx) EncK (data) AEGy1x(K||meta)

Recipients – public keys Gy1, Gy2, Gy3. Entry points are placed in a series of growing hash-tables!

Single Recipient Multiple Suites Non- malleability Multiple Recipients

AEGy1x(K||meta)

slide-32
SLIDE 32

❖ Reducing Metadata Leakage with PURBs @ PETS 2019

HT0 HT1

Multiple Recipients: Our Solution

!20 Kirill Nikitin

Hide(Gx) EncK (data) AEGy1x(K||meta)

Recipients – public keys Gy1, Gy2, Gy3.

AEGy2x(K||meta)

Entry points are placed in a series of growing hash-tables!

Single Recipient Multiple Suites Non- malleability Multiple Recipients

AEGy2x(K||meta)

slide-33
SLIDE 33

❖ Reducing Metadata Leakage with PURBs @ PETS 2019

HT0 HT1 HT2

Multiple Recipients: Our Solution

!20 Kirill Nikitin

Hide(Gx) EncK (data) AEGy1x(K||meta)

Recipients – public keys Gy1, Gy2, Gy3.

AEGy2x(K||meta)

Entry points are placed in a series of growing hash-tables!

AEGy3x(K||meta)

Single Recipient Multiple Suites Non- malleability Multiple Recipients

AEGy3x(K||meta)

slide-34
SLIDE 34

❖ Reducing Metadata Leakage with PURBs @ PETS 2019

HT0 HT1 HT2

Multiple Recipients: Our Solution

!21 Kirill Nikitin

Hide(Gx) EncK (data) AEGy1x(K||meta)

Recipients – public keys Gy1, Gy2, Gy3.

random AEGy2x(K||meta)

Entry points are placed in a series of growing hash-tables!

random random AEGy3x(K||meta) random

Single Recipient Multiple Suites Non- malleability Multiple Recipients

slide-35
SLIDE 35

❖ Reducing Metadata Leakage with PURBs @ PETS 2019

HT0 HT1 HT2

Multiple Recipients: Our Solution

!21 Kirill Nikitin

Hide(Gx) EncK (data) AEGy1x(K||meta)

Recipients – public keys Gy1, Gy2, Gy3.

random AEGy2x(K||meta)

Entry points are placed in a series of growing hash-tables!

random random AEGy3x(K||meta) random Decoding in Log2 len(PURB)

Single Recipient Multiple Suites Non- malleability Multiple Recipients

slide-36
SLIDE 36

❖ Reducing Metadata Leakage with PURBs @ PETS 2019

Multiple Suites

!22 Kirill Nikitin

— PURB —

Single Recipient Multiple Suites Non- malleability Multiple Recipients

&

&

&

slide-37
SLIDE 37

❖ Reducing Metadata Leakage with PURBs @ PETS 2019

Multiple Suites

  • Recipients use several distinct suites, based on public-key group (e.g.,

Curve25519 or Curve448) or entry point length.

  • Each suite (an encoded public key and hash tables) becomes a distinct logical

layer in a PURB, and these layers overlap!

!23 Kirill Nikitin

Single Recipient Multiple Suites Non- malleability Multiple Recipients

slide-38
SLIDE 38

❖ Reducing Metadata Leakage with PURBs @ PETS 2019

Multiple Suites: Layout

!24 Kirill Nikitin

PURB bytes

Suite A Suite B

Single Recipient Multiple Suites Non- malleability Multiple Recipients

slide-39
SLIDE 39

❖ Reducing Metadata Leakage with PURBs @ PETS 2019

Multiple Suites: Layout

!25 Kirill Nikitin

PURB bytes

Suite A Suite B

Hide(A) Hide(B) Enc(data)

Single Recipient Multiple Suites Non- malleability Multiple Recipients

slide-40
SLIDE 40

❖ Reducing Metadata Leakage with PURBs @ PETS 2019

Multiple Suites: Layout

!26 Kirill Nikitin

PURB bytes

Suite A Suite B

Single Recipient Multiple Suites Non- malleability Multiple Recipients

Hide(A) Enc(data) Hide(B)

slide-41
SLIDE 41

❖ Reducing Metadata Leakage with PURBs @ PETS 2019

Multiple Suites: Layout

!27 Kirill Nikitin

PURB bytes

Suite A Suite B

Single Recipient Multiple Suites Non- malleability Multiple Recipients

Hide(A) Enc(data) Hide(B)

slide-42
SLIDE 42

❖ Reducing Metadata Leakage with PURBs @ PETS 2019

Multiple Suites: Layout

!28 Kirill Nikitin

PURB bytes

Suite A Suite B

Single Recipient Multiple Suites Non- malleability Multiple Recipients

AEGy1x(K) AEGy1x(K) AEGy1x(K) Hide(A) Enc(data) Hide(B)

slide-43
SLIDE 43

❖ Reducing Metadata Leakage with PURBs @ PETS 2019

Multiple Suites: Layout

!29 Kirill Nikitin

PURB bytes

Suite A Suite B

Single Recipient Multiple Suites Non- malleability Multiple Recipients

AEGy1x(K) AEGy1x(K) AEGy1x(K) Hide(A) Enc(data) Hide(B)

slide-44
SLIDE 44

❖ Reducing Metadata Leakage with PURBs @ PETS 2019

Multiple Suites: Layout

!30 Kirill Nikitin

PURB bytes

Suite A Suite B

Single Recipient Multiple Suites Non- malleability Multiple Recipients

AEGy1x(K) AEGy1x(K) AEGy1x(K) Hide(A) Enc(data) AEQy4h(K) Hide(B)

slide-45
SLIDE 45

❖ Reducing Metadata Leakage with PURBs @ PETS 2019

Multiple Suites: Layout

!31 Kirill Nikitin

PURB bytes

Suite A Suite B

Single Recipient Multiple Suites Non- malleability Multiple Recipients

AEGy1x(K) AEGy1x(K) AEGy1x(K) Hide(A) Enc(data) AEQy4h(K) Hide(B) random

slide-46
SLIDE 46

❖ Reducing Metadata Leakage with PURBs @ PETS 2019

Multiple Suites: Layout

!32 Kirill Nikitin

PURB bytes

Suite A Suite B

Single Recipient Multiple Suites Non- malleability Multiple Recipients

random AEGy1x(K) AEGy1x(K) AEGy1x(K) Hide(A) Enc(data) AEQy4h(K) Hide(B)

slide-47
SLIDE 47

❖ Reducing Metadata Leakage with PURBs @ PETS 2019

Non-malleability

!33 Kirill Nikitin

PURB bytes

Suite A Suite B

MAC

Single Recipient Multiple Suites Non- malleability Multiple Recipients

random AEGy1x(K) AEGy1x(K) AEGy1x(K) Hide(A) Enc(data) AEQy4h(K) Hide(B)

slide-48
SLIDE 48

❖ Reducing Metadata Leakage with PURBs @ PETS 2019

Non-malleability

!34 Kirill Nikitin

PURB bytes

Suite A Suite B

MAC

Single Recipient Multiple Suites Non- malleability Multiple Recipients

random AEGy1x(K) AEGy1x(K) AEGy1x(K) Hide(A) Enc(data) AEQy4h(K) Hide(B)

slide-49
SLIDE 49

❖ Reducing Metadata Leakage with PURBs @ PETS 2019

Non-malleability

!34 Kirill Nikitin

PURB bytes

Suite A Suite B

MAC

Single Recipient Multiple Suites Non- malleability Multiple Recipients

random AEGy1x(K) AEGy1x(K) AEGy1x(K) Hide(A) Enc(data) AEQy4h(K) Hide(B)

IND$-CCA2

slide-50
SLIDE 50

❖ Reducing Metadata Leakage with PURBs @ PETS 2019

Finding Public Keys Efficiently

!35 Kirill Nikitin

PURB bytes

Possible position I

Suite A

Possible position II Possible position III

⨁

Hide(A)

See the paper for the details

Single Recipient Multiple Suites Non- malleability Multiple Recipients

slide-51
SLIDE 51

❖ Reducing Metadata Leakage with PURBs @ PETS 2019

Encoding and Decoding of PURBs

!36

1 3 10 100 Number of Recipients 10−2 10−1 100 101 102 103 104 CPU time [ms]

EncHeader KeyGen SharedSecrets Total time 1 suite 3 suites 10 suites Kirill Nikitin

slide-52
SLIDE 52

❖ Reducing Metadata Leakage with PURBs @ PETS 2019

Encoding and Decoding of PURBs

!36

1 3 10 100 Number of Recipients 10−2 10−1 100 101 102 103 104 CPU time [ms]

EncHeader KeyGen SharedSecrets Total time 1 suite 3 suites 10 suites

100 101 102 103 104 Number of Recipients 10−1 100 101 102 Decoding time [ms]

Assembly-

  • ptimization

PGP standard PGP hidden PURBs flat PURBs standard Kirill Nikitin

slide-53
SLIDE 53

❖ Reducing Metadata Leakage with PURBs @ PETS 2019

Padmé: reducing leakage about the size

!37 Ludovic Barman

PURB

PURB

PURB

PURB

PURB

PURB

PURB

PURB

slide-54
SLIDE 54

❖ Reducing Metadata Leakage with PURBs @ PETS 2019

Padmé

  • The total size is an important metadata, used in many attacks:
  • Website Fingerprinting
  • Traffic-Analysis
  • Attacks against HTTPS

  • Design a padding function to improve “size privacy”

!38 Ludovic Barman

slide-55
SLIDE 55

❖ Reducing Metadata Leakage with PURBs @ PETS 2019

Naïve approach: (constant) block-padding

!39 Ludovic Barman

128 256 386 [B] e.g. 150B => 256B

slide-56
SLIDE 56

❖ Reducing Metadata Leakage with PURBs @ PETS 2019

Naïve approach: (constant) block-padding

Problem: no good value for block size Example: b = 1 MB

!40 Ludovic Barman

512 B 17 GB

slide-57
SLIDE 57

❖ Reducing Metadata Leakage with PURBs @ PETS 2019

little confusion / privacy 2000x overhead

Naïve approach: (constant) block-padding

Problem: no good value for block size Example: b = 1 MB

!40 Ludovic Barman

512 B 17 GB

slide-58
SLIDE 58

❖ Reducing Metadata Leakage with PURBs @ PETS 2019

!41 Ludovic Barman

4 8 16 2 [B] 1

Variable block size:

Padding relative to the object size

small objects: small overhead

slide-59
SLIDE 59

❖ Reducing Metadata Leakage with PURBs @ PETS 2019

!42 Ludovic Barman

4 8 16 2 [B] 1

Variable block size:

Padding relative to the object size

large objects: larger privacy

slide-60
SLIDE 60

❖ Reducing Metadata Leakage with PURBs @ PETS 2019

!43 Ludovic Barman

4 8 16 2 [B] 1

Variable block size:

Padding relative to the object size

Padding to the "Next Power of 2"

slide-61
SLIDE 61

❖ Reducing Metadata Leakage with PURBs @ PETS 2019

Quantifying leakage of a padding function

  • Let f:

be the padding function. Let C be the image set of f.

ℕ → ℕ

!44 Ludovic Barman

Leakage [bits] = log2( |C| ) Leakage: log2(1) = 0 bit Leakage: log2(2) = 1 bit

Plaintext
 Lengths Padded
 Lengths

f(p) = 1 TB

1 TB

f(p) = {

1 GB p ≤ 1GB 1 TB Plaintext
 Lengths Padded
 Lengths 1 TB 1 GB

slide-62
SLIDE 62

❖ Reducing Metadata Leakage with PURBs @ PETS 2019

Padding to the nearest power of 2

  • Leakage: O(log log(M)), where M is the biggest plaintext possible
  • Much better than with constant block-size, which leaks O(log(M))
  • Interestingly, not padding at all also leaks O(log(M))





!45 Ludovic Barman

  • Max overhead: +100%
  • e.g., 16.1 GB => 32 GB

size of the image set

slide-63
SLIDE 63

❖ Reducing Metadata Leakage with PURBs @ PETS 2019

Reducing the overhead of padding

Next power of 2: Blocks have the form 2^0, 2^1, 2^2, etc. Represent them like floating points: Padmé: Instead of 0's, allow some values in the mantissa: => Smaller blocks => Smaller overhead

!46 Ludovic Barman

Exponent Mantissa all 0's log2(M) bits

slide-64
SLIDE 64

❖ Reducing Metadata Leakage with PURBs @ PETS 2019

Padmé

Pad to the next length L which respects:

!47 Ludovic Barman

≤ log2(log2(L)) bits Exponent Mantissa log2(L) bits

Doubles leakage => still in O(log log(M)) Intuition: the exponent can be anything, but the mantissa cannot be "too precise"

slide-65
SLIDE 65

❖ Reducing Metadata Leakage with PURBs @ PETS 2019

Padmé's overhead

max overhead =

!48 Ludovic Barman

Slowly decreases with L Max 12% ! L Max ~6% for L ! ~1 MB Max ~3% for L ! ~1 GB ∀ ≥ ≥

2 log2 L 1

%

slide-66
SLIDE 66

❖ Reducing Metadata Leakage with PURBs @ PETS 2019

Padmé's "size privacy"

!49 Ludovic Barman

Mean overhead: Next power of 2: +44% Padmé: +2.3%

Ubuntu packages

57'000 objects collected from apt lists

slide-67
SLIDE 67

❖ Reducing Metadata Leakage with PURBs @ PETS 2019

Conclusion

  • Padded Uniform Random Blobs (PURBs): ciphertext format with no metadata

leakage except length, which is minimized.

  • Encoding + Padding schemes.
  • Applications: Email, Group Chat, Disk Encryption, Initiation of Protocols.
  • To the best of our knowledge, the first video with pets @ PETS.

!50

kirill.nikitin@epfl.ch ' @ni_kirill ludovic.barman@epfl.ch ( @lbarman_ch https://purbs.net https://github.com/dedis/purb