Asymmetric Message Franking Content Moderation for Metadata-Private End-to-End Encryption Nirvan Tyagi Paul Grubbs Julia Len Ian Miers Tom Ristenpart CRYPTO 2019 1
Setting: End-to-end encrypted messaging Hello From: Alice To: Bob Alice Bob Platform 2
Setting: End-to-end encrypted messaging - Confidentiality and Integrity Hello From: Alice To: Bob Alice Bob Platform 3
Setting: End-to-end encrypted messaging “Public” - Confidentiality and Integrity - Deniability Hello - Alice Hello From: Alice To: Bob Alice Bob Platform [OTR BGB ’04], [Signal X3DH ’16] 4
Setting: End-to-end encrypted messaging - Confidentiality and Integrity - Deniability - Metadata privacy From: ? ? To: Alice Bob Platform 5 [Dissent OSDI’12], [Riposte S&P’15], [Vuvuzela SOSP’15], [Pung OSDI’16] . . .
Setting: End-to-end encrypted messaging - Confidentiality and Integrity - Deniability - Metadata privacy From: ? To: Bob Alice Bob Platform 6 [Dissent OSDI’12], [Riposte S&P’15], [Vuvuzela SOSP’15], [Pung OSDI’16] . . .
What about abuse? From: ? To: Bob Alice Bob Platform 7
What about abuse? $#@%! From: ? To: Bob Alice Bob Platform 8
What about abuse? Online bully Abusive partner Spammer Misinformation $#@%! From: ? To: Bob Alice Bob Platform 9
What about abuse? Moderator Online bully $#@%! Abusive partner Spammer Misinformation $#@%! From: ? To: Bob Alice Bob Platform 10
What about abuse? Moderation is a big priority: Facebook employs ≈15K content moderators* Moderator Online bully $#@%! Abusive partner Spammer Misinformation $#@%! From: ? To: Bob Alice Bob Platform 11 * “The secret lives of Facebook moderators in America” [The Verge 2019]
What about abuse? Moderation is a big priority: Facebook employs ≈15K content moderators* Moderator Online bully $#@%! Abusive partner ? ? Spammer Misinformation Privacy complicates abuse moderation! $#@%! From: ? To: Bob Alice Bob Platform 12 * “The secret lives of Facebook moderators in America” [The Verge 2019]
What about abuse? Moderation is a big priority: Facebook employs ≈15K content moderators* Moderator Online bully $#@%! Abusive partner ? ? Spammer Misinformation Privacy complicates abuse moderation! $#@%! Can we balance need for accountability via moderation From: ? To: Bob with privacy goals? Alice Bob Platform 13 * “The secret lives of Facebook moderators in America” [The Verge 2019]
Our contributions Asymmetric Message Franking (AMF) : a new cryptographic ● primitive for content moderation Metadata-privacy : message sender and/or recipient identities ○ hidden Third-party moderation : moderator decoupled from ○ message-delivery platform Formal accountability and deniability security notions for content ● moderation Construction inspired by “designated-verifier” signatures ● Implementation and proof-of-concept deployment ● [TGLMR CRYPTO’19] 14
Prior work on moderation in E2E encryption Message franking [FB white paper ‘17], [GLR CRYPTO‘17], [DGRW CRYPTO‘18] - Content-based moderation of encryption that is NOT metadata-private - Compactly-committing authenticated encryption 15
Prior work on moderation in E2E encryption Message franking [FB white paper ‘17], [GLR CRYPTO‘17], [DGRW CRYPTO‘18] - Content-based moderation of encryption that is NOT metadata-private - Compactly-committing authenticated encryption Moderator m Alice Bob From: Alice To: Bob Platform 16
Prior work on moderation in E2E encryption Message franking [FB white paper ‘17], [GLR CRYPTO‘17], [DGRW CRYPTO‘18] - Content-based moderation of encryption that is NOT metadata-private - Compactly-committing authenticated encryption Symmetric encryption Moderator following key agreement [Signal X3DH ‘16] m Alice Bob From: Alice To: Bob Platform 17
Prior work on moderation in E2E encryption Message franking [FB white paper ‘17], [GLR CRYPTO‘17], [DGRW CRYPTO‘18] - Content-based moderation of encryption that is NOT metadata-private - Compactly-committing authenticated encryption Moderator m Identities authenticated by platform Alice Bob From: Alice To: Bob Platform 18
Prior work on moderation in E2E encryption Message franking [FB white paper ‘17], [GLR CRYPTO‘17], [DGRW CRYPTO‘18] - Content-based moderation of encryption that is NOT metadata-private - Compactly-committing authenticated encryption Moderator m Alice Bob From: Alice To: Bob Platform Alice, Bob, ct 19
Prior work on moderation in E2E encryption Message franking [FB white paper ‘17], [GLR CRYPTO‘17], [DGRW CRYPTO‘18] - Content-based moderation of encryption that is NOT metadata-private - Compactly-committing authenticated encryption Moderator k m Alice Bob From: Alice To: Bob Platform Alice, Bob, ct 20
Prior work on moderation in E2E encryption Message franking [FB white paper ‘17], [GLR CRYPTO‘17], [DGRW CRYPTO‘18] - Content-based moderation of encryption that is NOT metadata-private - Compactly-committing authenticated encryption m = Dec k ( ct) Alice sent Bob m Moderator k m Alice Bob From: Alice To: Bob Platform Alice, Bob, ct 21
Prior work on moderation in E2E encryption Message franking [FB white paper ‘17], [GLR CRYPTO‘17], [DGRW CRYPTO‘18] - Content-based moderation of encryption that is NOT metadata-private - Compactly-committing authenticated encryption m = Dec k ( ct) Alice sent Bob m Moderator k m Alice Bob From: Alice To: Bob Platform Alice, Bob, ct 22
Prior work on moderation in E2E encryption Message franking [FB white paper ‘17], [GLR CRYPTO‘17], [DGRW CRYPTO‘18] - Content-based moderation of encryption that is NOT metadata-private - Compactly-committing authenticated encryption m = Dec k ( ct) Alice sent Bob m Moderator k m Alice Bob From: Alice To: Bob Platform Alice, Bob, ct 23
Message franking for metadata-private setting? Message franking [FB white paper ‘17], [GLR CRYPTO‘17], [DGRW CRYPTO‘18] - Content-based moderation of encryption that is NOT metadata-private - Compactly-committing authenticated encryption m = Dec k ( ct) ? sent Bob m Moderator k m Alice Bob From: ? To: Bob Platform ? , Bob, ct 24
Message franking for metadata-private setting? Message franking [FB white paper ‘17], [GLR CRYPTO‘17], [DGRW CRYPTO‘18] - Content-based moderation of encryption that is NOT metadata-private - Compactly-committing authenticated encryption m = Dec k ( ct) ? sent Bob m Moderator k m Alice Bob From: ? To: Bob Platform ? , Bob, ct 25
Message franking for metadata-private setting? Message franking [FB white paper ‘17], [GLR CRYPTO‘17], [DGRW CRYPTO‘18] - Content-based moderation of encryption that is NOT metadata-private - Compactly-committing authenticated encryption m , Alice = Dec k ( ct) Alice sent Bob m Can we patch by including Alice’s identity in commitment? Moderator k m , Alice Alice Bob From: ? To: Bob Platform ? , Bob, ct 26
Message franking for metadata-private setting? Message franking [FB white paper ‘17], [GLR CRYPTO‘17], [DGRW CRYPTO‘18] - Content-based moderation of encryption that is NOT metadata-private - Compactly-committing authenticated encryption m , Alice = Dec k ( ct) Alice sent Bob m Can we patch by including Alice’s identity in commitment? Moderator k m , Alice Charlie Bob From: ? To: Bob Platform ? , Bob, ct 27
Message franking for metadata-private setting? Message franking [FB white paper ‘17], [GLR CRYPTO‘17], [DGRW CRYPTO‘18] - Content-based moderation of encryption that is NOT metadata-private - Compactly-committing authenticated encryption m , Alice = Dec k ( ct) Alice sent Bob m Can we patch by including Alice’s identity in commitment? Moderator k m , Alice Charlie Bob Core problem: Alice’s identity not cryptographically From: ? To: Bob bound to message content Platform ? , Bob, ct 28
AMFs: High level idea Specialized digital signature scheme that provides: - Accountability - Deniability 29
AMFs: High level idea Specialized digital signature scheme that provides: - Accountability - Deniability Moderator Alice Bob ? From: ? To: Platform 30
AMFs: High level idea Specialized digital signature scheme that provides: - Accountability - Deniability Moderator m , σ m , σ Alice Bob ? From: ? sk A , pk A To: σ = Sign( sk A , m ) Platform 31
AMFs: High level idea Specialized digital signature scheme that provides: - Accountability Standard digital signatures provide - Deniability accountability …but not deniability Verify( pk A , m , σ ) Moderator m , σ m , σ Alice Bob ? From: ? sk A , pk A To: σ = Sign( sk A , m ) Platform 32
AMFs: High level idea “Public” Specialized digital signature scheme that provides: - Accountability Standard digital signatures provide - Deniability accountability …but not deniability Verify( pk A , m , σ ) Moderator m , σ m , σ Alice Bob ? From: ? sk A , pk A To: σ = Sign( sk A , m ) Platform 33
Recommend
More recommend
