Traceback for End-to-End Encrypted Messaging Nirvan Tyagi Ian - PowerPoint PPT Presentation

Traceback for End-to-End Encrypted Messaging Nirvan Tyagi Ian Miers Tom Ristenpart CCS 2019 1

Setting: End-to-end encrypted (E2EE) messaging Hello Alice Bob Platform 2

Setting: End-to-end encrypted (E2EE) messaging Hello > 2 billion users Alice Bob Platform 3

Problem: Viral forwarding of misinformation in E2EE messaging 4

Problem: Viral forwarding of misinformation in E2EE messaging 5

Content moderation for user-driven reports Moderation decision Action taken on User submits report based on content relevant parties 6

Content moderation for user-driven reports Moderation decision Action taken on User submits report based on content relevant parties Combination of machine learning and human review 7

Content moderation for user-driven reports Moderation decision Action taken on User submits report based on content relevant parties Combination of Ban fake/troll accounts machine learning and injecting misinformation human review into network Notify users that have previously shared or received misinformation 8

Content moderation for user-driven reports Moderation decision Action taken on User submits report based on content relevant parties Combination of Ban fake/troll accounts machine learning and injecting misinformation human review into network Report must provide enough information to execute the Notify users that have following steps previously shared or received misinformation 9

E2EE hides information useful for content moderation of misinformation 10

E2EE hides information useful for content moderation of misinformation - Platform doesn’t see message content Message content is encrypted! 11

E2EE hides information useful for content moderation of misinformation - Platform doesn’t see message content - Platform doesn’t see forwarding relationships Message content is encrypted! 12

E2EE hides information useful for content moderation of misinformation - Platform doesn’t see message content - Platform doesn’t see forwarding relationships Forwarding traffic is muddled by other users and other messages Message content is encrypted! 13

[TMR CCS’19] This work: Tracing in E2EE messaging - Message tracing : new cryptographic functionality for user-driven reporting of forwards in E2EE messaging - Path traceback: chain of messages from source to reporter - Tree traceback: entire forwarding tree of messages originating from source Moderation decision Action taken on User submits report based on content relevant parties 14

[TMR CCS’19] This work: Tracing in E2EE messaging - Message tracing : new cryptographic functionality for user-driven reporting of forwards in E2EE messaging - Path traceback: chain of messages from source to reporter - Tree traceback: entire forwarding tree of messages originating from source - Formal confidentiality and accountability security notions for tracing - Implementation and evaluation of practicality Moderation decision Action taken on User submits report based on content relevant parties 15

Prior work: Abuse reporting in E2EE messaging Message franking [FB white paper ’17], [GLR CRYPTO’17], [DGRW CRYPTO’18] 16

Prior work: Abuse reporting in E2EE messaging Message franking [FB white paper ’17], [GLR CRYPTO’17], [DGRW CRYPTO’18] User reports received message to platform ! 17

Prior work: Abuse reporting in E2EE messaging Message franking [FB white paper ’17], [GLR CRYPTO’17], [DGRW CRYPTO’18] User reports received message to platform ! m 18

Prior work: Abuse reporting in E2EE messaging Message franking [FB white paper ’17], [GLR CRYPTO’17], [DGRW CRYPTO’18] Platform learns message and sender, but nothing more about where message came from or where it reached User reports received message to platform ! m 19

[TMR CCS’19] This work: Tracing in E2EE messaging User reports received message to platform ! 20

[TMR CCS’19] This work: Tracing in E2EE messaging - Two constructions for message tracing - Path traceback User reports received message to platform ! m 21

[TMR CCS’19] This work: Tracing in E2EE messaging - Two constructions for message tracing - Path traceback - Tree traceback User reports received message to platform ! m 22

Goal: Act like standard E2EE messaging before report 23

Goal: Act like standard E2EE messaging before report Before report Platform view : encrypted content and metadata (participants, length, and timing) 24

Goal: Act like standard E2EE messaging before report Before report Platform view : encrypted content and metadata (participants, length, and timing) User view : messages they receive or send 25

Goal: Act like standard E2EE messaging before report Before report Platform view : encrypted content and metadata (participants, length, and timing) User view : messages they receive or send m m m User shouldn’t learn forwarding info of received messages 26

Goal: Act like standard E2EE messaging before report Before report Platform view : encrypted content and metadata (participants, length, and timing) User view : messages they receive or send m m ? m User shouldn’t learn forwarding info of received messages 27

Goal: Reveal limited information after report 28

Goal: Reveal limited information after report After report Platform view : message content and forward links of traceback target (e.g. path, tree) ! m 29

Goal: Report consists of accurate information ! m 30

Goal: Report consists of accurate information Trace accountability An honest user cannot be framed for an action they didn’t perform ! m 31

Goal: Report consists of accurate information Trace accountability An honest user cannot be framed for an action they didn’t perform ! m Malicious user can partition trace, but will be blamed as source 32

Path traceback Idea: Linked list of encrypted pointers A lice B ob C harlie 33

Path traceback Idea: Linked list of encrypted pointers A lice B ob C harlie m E2EE channel 34

Path traceback Idea: Linked list of encrypted pointers A lice B ob C harlie m E2EE channel - E2EE channel that is decoupled from message tracing 35

Path traceback Idea: Linked list of encrypted pointers A lice B ob C harlie m E2EE channel k AB “tracing” key - E2EE channel that is decoupled from message tracing - Unique per-message “tracing” key shared between communication partners 36

Path traceback Idea: Linked list of encrypted pointers A lice B ob C harlie m k AB E2EE channel k AB k AB “tracing” key - E2EE channel that is decoupled from message tracing - Unique per-message “tracing” key shared between communication partners 37

Path traceback Idea: Linked list of encrypted pointers A lice B ob C harlie m k AB E2EE channel k Ø k AB k AB “null pointer” key randomly generated 38

Path traceback Idea: Linked list of encrypted pointers A lice B ob C harlie m k AB E2EE channel k Ø k AB ct AB = Enc( k AB , k Ø ) k AB id AB = F( k AB , m ) 39

Path traceback Idea: Linked list of encrypted pointers A lice B ob C harlie m k AB E2EE channel k Ø k AB ct AB = Enc( k AB , k Ø ) k AB id AB = F( k AB , m ) “encrypted pointer” 40

Path traceback Idea: Linked list of encrypted pointers A lice B ob C harlie m k AB E2EE channel k Ø k AB ct AB = Enc( k AB , k Ø ) k AB id AB = F( k AB , m ) “encrypted pointer” PRF that is also CR (e.g., HMAC) 41

Path traceback Idea: Linked list of encrypted pointers A lice B ob C harlie m k AB E2EE channel k Ø k AB ct AB = Enc( k AB , k Ø ) k AB id AB = F( k AB , m ) Table stored on platform id AB ct AB 42

Path traceback Idea: Linked list of encrypted pointers A lice B ob C harlie m k AB E2EE channel k Ø id AB k AB ct AB = Enc( k AB , k Ø ) k AB id AB = F( k AB , m ) Table stored on platform id AB ct AB 43

Path traceback Idea: Linked list of encrypted pointers A lice B ob C harlie m k AB m E2EE channel k Ø id AB id BC k AB ct AB = Enc( k AB , k Ø ) ct BC = Enc( k BC , k AB ) k AB id AB = F( k AB , m ) id BC = F( k BC , m ) k BC k BC Table stored on platform id AB ct AB id BC ct BC 44

Path traceback Idea: Linked list of encrypted pointers A lice B ob C harlie m k AB m E2EE channel k Ø id AB id BC k AB ct AB = Enc( k AB , k Ø ) ct BC = Enc( k BC , k AB ) k AB id AB = F( k AB , m ) id BC = F( k BC , m ) k BC k BC Table stored on platform id AB ct AB id BC ct BC 45

Path traceback Idea: Linked list of encrypted pointers A lice B ob C harlie ! m k AB m E2EE channel k BC m k Ø id AB id BC k AB ct AB = Enc( k AB , k Ø ) ct BC = Enc( k BC , k AB ) k AB id AB = F( k AB , m ) id BC = F( k BC , m ) k BC k BC Table stored on platform id AB ct AB id BC ct BC 46

Path traceback Idea: Linked list of encrypted pointers A lice B ob C harlie ! m k AB m E2EE channel k BC m k Ø id AB id BC k AB ct AB = Enc( k AB , k Ø ) ct BC = Enc( k BC , k AB ) k AB id AB = F( k AB , m ) id BC = F( k BC , m ) k BC k BC Table stored on platform id AB ct AB id BC ct BC F( k BC , m) 47