Anonymity Networks for Crypto Geeks, the Department of Defense, and you. Nick Mathewson <nickm@freehaven.net> The Free Haven Project MIT SIPB talk; 2 Feb 2006
This talk is about anonymity. Technical Social 1. What is it? 2. Why does it matter? 3. How do we build it? 4. What happens then?
1. What is anonymity anyway? (Wearing a funny wig, right?)
Informally: anonymity means you can't tell who did what “Who wrote this blog post?” “Who's been viewing my webpages?” “Who's been emailing patent attorneys?”
Formally: anonymity means indistinguishability within an “anonymity set” Alice1 Alice2 Alice3 Bob Alice4 Alice5 .... Attacker can't tell which Alice Alice6 is talking to Bob! Alice7 Alice8
We have to make some assumptions about what the attacker can do. Alice Anonymity network Bob watch Alice! watch (or be!) Bob! Control part of the network! Etc, etc.
Anonymity isn't cryptography: Cryptography only protects contents. “Hi, Bob!” “Hi, Bob!” <gibberish> Alice attacker Bob
Anonymity isn't steganography: Attacker can tell that Alice is talking; just not to whom. Bob1 Alice1 Alice Anonymity network Alice2 Bob2 ... AliceN (Strong high-bandwidth steganography may not exist.)
Anonymity isn't just wishful thinking... “You can't prove it was me!” “Promise you won't look!” “Promise you won't remember!” “Promise you won't tell!” “I didn't write my name on it!” “Isn't the Internet already anonymous?”
...since “weak” anonymity... isn't. “You can't prove it was me!” Proof is a very strong word. With statistics, suspicion becomes certainty. “Promise you won't look!” Will others parties have the ability and inclination to “Promise you won't remember!” keep their promises? “Promise you won't tell!” Not what we're talking “I didn't write my name on it!” about. Nope! (More info later.) “Isn't the Internet already anonymous?”
2. Why does anonymity matter? What, theoretically speaking, do we have to hide?
Anonymity serves different interests for different user groups. Governments Businesses “It's traffic-analysis “It's network security!” resistance!” Anonymity “It's privacy!” Private citizens
Regular citizens don't want to be watched and tracked. Blogger Blogger “I sell the logs.” Hostile Bob Alice Alice “Oops, I lost the logs.” 8-year-old Incompetent Bob Alice “Hey, they aren't Indifferent Bob Sick my secrets.” Alice Name, address, Consumer age, friends, Alice interests .... (medical, financial, etc), unpopular opinions, Oppressed illegal opinions.... Alice (the network can track too)
Businesses need to keep trade secrets. “Oh, your employees are reading Competitor our patents/jobs page/product sheets?” “Hey, it's Alice! Give her the 'Alice' version!” Competitor AliceCorp “Wanna buy a list of Alice's suppliers? Compromised What about her customers? network What about her engineering department's favorite search terms?”
National organizations need anonymity for their security. “Why is alice.localpolice.gov reading Investigated my website?” suspect Officer Alice “Why no, alice.localpolice.gov! Sting I would never sell counterfeits on e b ay!” target “What am I bid for a list of Baghdad Agent Untrusted IP addresses that get email from .gov?” Alice ISP Compromised “What does the CIA Google for?” service
You can't get anonymity on your own: private solutions are ineffective... Alice's small Citizen “One of the 25 users ... anonymity net Alice on AliceNet.” Officer Municipal Investigated Alice “Looks like a cop.” anonymity net suspect AliceCorp AliceCorp “It's somebody at Competitor anonymity net AliceCorp!”
... so, anonymity loves company! Citizen “???” ... Alice Officer Investigated Alice Shared “???” suspect anonymity net AliceCorp Competitor “???”
Yes, bad people need anonymity too, but they are already doing well. Compromised botnet Stolen mobile phones Evil Criminal Alice Open wireless nets .....
Yes, bad people need anonymity too, but they are already doing well. Compromised botnet Stolen mobile phones Evil Criminal Alice Open wireless nets .....
3. How does anonymity work? (a short history, with Tor focus) (Because we were Course 6, not Course 17.)
Tor is not the first or only design for anonymity. Low-latency High-latency Single-hop Chaum's Mixes proxies (1981) Crowds (~96) anon.penet.fi (~91) V1 Onion ZKS Routing (~96) “Freedom” Remailer networks: (~99-01) cypherpunk (~93), mixmaster (~95), Java Anon Proxy mixminion (~02) (~00-) Tor (01-) ...and more!
Low-latency systems are vulnerable to end-to-end correlation attacks. Low-latency: Alice1 sends: xx x xxxx x Alice2 sends: x x xx x x match! Bob1 gets: x x x x x x match! Bob2 gets: xx x xxxx x Time High-latency: Alice1 sends: xx x xxxx Alice2 sends: x x xx x x Bob1 gets: xx xxxx ..... Bob2 gets: x xxxxx ..... These attacks work in practice. The obvious defenses are expensive (like high-latency), useless, or both.
Still, we focus on low-latency, because it's more useful. Interactive apps: web, IRC, VOIP, ssh, X11, ... # users, low-latency anonymity systems: millions? Apps that accept multi-hour delays and high bandwidth overhead: email, sometimes. # users, high-latency anonymity systems: tens of thousands? And if anonymity loves company....?
The simplest designs use a single relay to hide connections. Bob1 Alice1 Bob3,“X” “Y” Relay Alice2 “Z” Bob2 Bob1, “Y” “X” ” Z “ , 2 b o B Bob3 Alice3 (ex: some commercial proxy providers)
But an attacker who sees Alice can see what she's doing. Bob1 Alice1 Bob3,“X” “Y” Relay Alice2 “Z” Bob2 Bob1, “Y” “X” ” Z “ , 2 b o B Bob3 Alice3
Add encryption to stop attackers who eavesdrop on Alice. Bob1 Alice1 E(Bob3,“X”) “Y” Relay Alice2 “Z” Bob2 E(Bob1, “Y”) ) “X” ” Z “ , 2 b o B ( E Bob3 Alice3 (ex: numerous commercial proxy providers)
But a single relay is a single point of failure. Bob1 Alice1 E(Bob3,“X”) “Y” Evil Alice2 Relay “Z” Bob2 E(Bob1, “Y”) ) “X” ” Z “ , 2 b o B ( E Bob3 Alice3 Eavesdropping the relay works too.
So, add multiple relays so that no single one can betray Alice. Bob1 Alice1 “Y” R1 “Z” R3 Bob2 Alice2 Bob3 “X” Alice3 R2
Wrap messages in multiple layers of encryption: each relay removes a layer. Bob1 Alice1 E1(R2, “Y” E2(Bob3,“X”) ) E3(Bob1, R1 “Y”) “Z” R3 Bob2 E1(R3, E3(Bob1, “Y”) ) E2(Bob3, Alice2 E3(Bob2, “X”) “Z”) Bob3 “X” ( E 3 R 3 , E 2 ( Alice3 R2 ) Z ” ) 2 , “ B o b
Use long-lived node-to-node links to hide number of connections. Alice S3 Bob S1 S2 S4
Since public-key is expensive, use it at the start of a session to establish session keys... The “onion” Alice E1(S2,K1,E2(S3,K2,E3(K3,Bob))) S3 Bob S1 E3(K3,Bob) S2 E2(S2,K2,E3(K3,Bob)) S4
...then, use session keys to encrypt actual traffic. Alice K1(K2,(K3, “Hi Bob”))) “ H i B o b ! S3 ” Bob S1 K3(“Hi Bob”) S2 K2,K3(“Hi Bob”)) S4
A corrupt first hop can tell that Alice is talking, but not to whom. Alice K1(K2,(K3, “Hi Bob”))) “ H i B o b ! S3 ” Bob S1 K3(“Hi Bob”) S2 K2,K3(“Hi Bob”)) S4
A corrupt final hop can tell that somebody is saying “Hi Bob,” but not who. Alice K1(K2,(K3, “Hi Bob”))) “ H i B o b ! S3 ” Bob S1 K3(“Hi Bob”) S2 K2,K3(“Hi Bob”)) S4
Stop here, and you have version 1 Onion Routing. ● Developed by researchers at US NRL ● Separate proxies for each user application on entry and exit. Web exit Web AP Web AP OR Alice Bob network FTP AP FTP exit ● Patented. ● Small test deployment, closed source. – (This prevented wider deployment.)
Zero Knowledge System's “Freedom Network” (~1999-2001) ● Developed as commercial product ● Much like OR, but: – More effort at efficient routing. – Pay-per-service model. – Tried padding, briefly. ● (It was ineffective and uneconomical) – Paid ISPs to run servers. ● Shut down in late 2001, probably due to cost problems. – Trust model was hard to market.
JAP/WebMIX network (~2000-) ● JAP = Java Anon Proxy ● Uses cascade topology instead of free-route. Bob1 Alice1 S S S Bob2 Dresden Alice2 S S S BobN AliceN – Cascades aggregate more traffic – But if correlation still works, attack is easier. ● PR problems related to illegal court order. ● Still active, still running, open source.
Tor* started at NRL in 2001 to remove obstacles to Onion Routing. OR v1 obstacles Never released Slow: multiple PK ops per request No forward secrecy Fixed list of servers Hard to scale * Tor, not TOR.
Simplify: Tor anonymizes TCP streams only, and makes other applications clean high-level protocols. SSH S O C K S Web SOCKS P H T T Web browser scrubber Tor network Tor client SOCKS IRC client
Recommend
More recommend
