Privacy and Anonymity Using Mix Networks* Slides borrowed from Philippe Golle, Markus Jacobson.
-
Upload
kristian-stewart -
Category
Documents
-
view
217 -
download
0
Transcript of Privacy and Anonymity Using Mix Networks* Slides borrowed from Philippe Golle, Markus Jacobson.
Privacy and Anonymity Using Mix Networks*
Slides borrowed from Philippe Golle, Markus Jacobson
Contents
• Mix Network (Mixnet)
• Mixnet Applications
• Mixnet Requirements
• Robustness of Mixnets
• Checking a Mixnet’s Robustness
Definition: Mix Server
• A mix server:
• Receives inputs
• Produces “related” outputs
• The relationship between inputs and outputs is secret
Inputs Outputs?
Mix Server
Definition: Mix Network
• Mix network
A group of mix servers that operate sequentially.
Server 1 Server 2 Server 3
Inputs Outputs
? ? ?
Applications
• Hide: “who voted for whom?”
“who paid whom?”
“who said what?”
• Good for protecting privacy for
election and communication
• Used as a privacy building block
1. “Who do you like best?”
2. Put your ballot into
an WHITE envelope
and put again in a RED one and sign on it
Electronic Voting Demonstration
Jerry
Washington Lincoln Roosevelt
Administrators will
1. Verify signatures together
2. 1st Admin. shuffles and opens RED envelopes
3. Send them to 2nd Admin.
4. 2nd Admin. shuffles again and opens WHITE envelopes
5. Count ballots together
Electronic Voting Demo. (Cont’d)
Jerry
Sign voter 1 (encr(encr (vote1)))
Sign voter 2 (encr(encr (vote2)))
.
.
.Sign voter n (encr(encr (voten)))
A real system for elections
vote1
vote2
vote3
.
.
voten
MixNet
Washington Lincoln Roosevelt
MixNet
• “Choose one person you like to pay $5”
• Put your ballot into an WHITE envelope and put again in a RED
one and sign on itJerry
Name of the person ( ___________ )
Electronic Payment Demo.
Electronic Voting Demo. (Cont’d)Administrators will
1. Verify signatures together
2. Deduct $5 from each account
3. 1st Admin. shuffles and opens RED envelopes
4. Send them to 2nd Admin.
5. 2nd Admin. shuffles again and opens WHITE envelopes
6. Credit $5 to recipients
For payments
Sign payer 1 (encr(encr (payee1)))
Sign payer 2 (encr(encr (payee2)))
.
.
.
.
.Sign payer n (encr(encr (payeen)))
payee1
payee2
payee3
.
.
payeen
DEDUCT
Credit
Jerry
Name
(________ )
MixNet
For email communication
encr (email1, addressee1)
encr (email2, addressee2)
.
.
.encr (emailn, addresseen)
.
.
.
MixNet
DeliverTo: Jerry
Don’t forget to have lunch.
Other uses
• Anonymous web browsing (LPWA Anonymizer)
From LPWA homepage
Other uses (Cont’d)
• Location privacy for cellular devices
– Location-based service is GOOD ! • Landline-phone calling to 911 in the US,
112 in Europe
• All cellular carrier by December 2005
– RISK !• Location-based spam
• Harm to a reputation
Other uses (Cont’d)
• Anonymous bulletin boards
From A. Juels at WOTE’01
Mix
Other uses (Cont’d)
Sometimes abuses
• Avoid legislation (e.g., piracy)
Other Used
• RFID Privacy
Principle Chaum ’81
Message 1
Message 2
server 1 server 2 server 3
PrivacyEfficiencyTrustRobustness
Issues :
But what about robustness?
encr(Berry)
encr(Kush)
encr(Kush)
Kush
Kush
Kush
STOP
I ignore his
outputand
produce my own
There is no robustness!
Requirements
1. Privacy
Nobody knows who said what
2. Efficiency
Mixing is efficient (= practically useful)
3. Trust How many entities do we have to trust?
4. Robustness
Will replacement cheaters be caught?
Zoology of Mix Networks
• Decryption Mix Nets [Cha81,…]:– Inputs: ciphertexts
– Outputs: decryption of the inputs.
• Re-encryption Mix Nets[PIK93,…]:– Inputs: ciphertexts
– Outputs: re-encryption of the inputs
Inputs Outputs?
First SolutionChaum ’81, implemented by Syverson, Goldschlag
Not robust (or: tolerates cheaters for correctness)
Requires every server to participate (and in the “right” order!)
Re-encryption Mixnet
0. Setup: mix servers generate a shared ElGamal key
1. Users encrypt their inputs: Input Input Pub-key
3. A quorum of mix servers decrypts the outputs
Output OutputPriv-key
Server 1 Server 2 Server 3
re-encrypt
& mix
re-encrypt
& mix
re-encrypt
& mix
2. Encrypted inputs are mixed:
Proof ProofProof
Recall: El Gamal encryption
Public parameters: q is a prime
p = 2kq+1 is a prime
g generator of Gp
Secret key of a user: x (where 0 < x < q)
Public key of this user: y = gx mod p
El Gamal Encryption (encrypt m using y)
For message (or “plaintext”) : m
1. Pick a number k randomly from [0…q-1]
2. Compute a = yk. m mod p b = gk mod p
3. Output (a,b)
Decryption technique (to decrypt (a,b) using x)
Compute m a / bx (= yk. m = gxk. m) (gk)x gkx
Re-encryption technique
Input: a ciphertext (a,b) wrt public key y
1. Pick a number randomly from [0…q-1]
2. Compute a’ = y . a mod p b’ = g . b mod p
3. Output (a’, b’)
Same decryption technique!
Compute m a’ / b’x (= yk. y . m = gx (k+. m) (gk . g )x g
(k+x
A simple mix
(a1, b1)
(a2, b2).
.
.(an, bn)
RE-ENCRYPT
RE-ENCRYPT
(a’1,b’1)
(a’2,b’2).
.
.(a’n,b’n)
(a’’1,b’’1)
(a’’2,b’’2).
.
.(a’’n,b’’n)
Note: different cipher text, different re-encryption exponents!
And to get privacy… permute, too!
(a1, b1)
(a2, b2).
.
.(an, bn)
(a’’1,b’’1)
(a’’2,b’’2).
.
.(a’’n,b’’n)
Problem
• Mix servers must prove correct re-encryption– Given n El Gamal ciphertexts E(mi)as input
– and n El Gamal ciphertexts E(m’i) as output
– Compute: E( mi) and E(=m’i) – Ask Mix for ZK proof that these ciphertexts decrypt to
same plaintexts