Privacy at the communication layer

Privacy at the communication layer CS-721 https://spring.epfl.ch/cs721-privacy-at-the-communication-layer/ Carmela Troncoso http://carmelatroncoso.com/

While (course) do { This course End of lecture - Small intro to next topic - Assign a paper and Defender/Critic Pre-lecture - Read the paper - All provide a Review by Monday 3pm } Lecture - Defender presents the paper (15-30 free format) - Critic presents his view - Comment your reviews and learned lessons By end of course: propose one attack or one defense Up to 3 pages describing: attacker model, attack/defense, proposed evaluation

Reviews Free format Recommendations (for any academic review): - Have a structure - The conclusion should be clear - Be constructive. Write the review you d like to read - Think big. Many small flaws may not be a reason for rejection. Try to extract the contribution - new approach? - will people construct on it? - fundamental result?

My structure (not binding) Summary: helps the authors know what you understood (calibrate your review) General comments: comments about issues global to the paper: motivation, threat model, overall design, flaws in evaluation Specific comments: comments about particular issues in Section X, in page Y Minor comments: editorial comments, typos, suggestions (other people like Strengths/weaknesses)

Privacy at the communication layer Dear Dr., Can we change my chemo appointment? A. A Network

Privacy at the communication layer Intelligence agencies Dear Dr., Can we change my chemo appointment? A. ISPs A Network

Privacy at the communication layer Intelligence agencies SysAdmin s The Boss Dear Dr., Can we change my chemo appointment? A. ISPs A Network

Privacy at the communication layer Intelligence agencies SysAdmin s The Boss Your Parents Your Children Dear Dr., Can we change my chemo appointment? A. ISPs A Network

Privacy at the communication layer Intelligence agencies SysAdmin s The Boss Your Parents Anybody curious Your Children Dear Dr., Can we change my chemo appointment? A. ISPs A Network

The adversary is anyone and she is VERY powerful Intelligence agencies SysAdmin s The Boss Your Parents Anybody curious Your Children Dear Dr., Can we change my chemo appointment? A. ISPs A Network

But we can encrypt! What is the problem? Dear Dr., Can we change my chemo appointment? A. A Network

But we can encrypt! What is the problem? %Q}!$#!{}{ @%%:@} @$@@ }{}{@@}{}@{@ {@}@#$ }{%@$%@@# @${P%@@}}}~ <>}@!@ A Network

But we can encrypt! What is the problem? %Q}!$#!{}{ @%%:@} @$@@ }{}{@@}{}@{@ {@}@#$ }{%@$%@@# @${P%@@}}}~ <>}@!@ A Network Ethernet (IEEE 802.3, 1997)

But we can encrypt! What is the problem? %Q}!$#!{}{ @%%:@} @$@@ }{}{@@}{}@{@ {@}@#$ }{%@$%@@# @${P%@@}}}~ <>}@!@ Alic e A Network Ethernet (IEEE 802.3, 1997)

But we can encrypt! What is the problem? %Q}!$#!{}{ @%%:@} @$@@ }{}{@@}{}@{@ {@}@#$ }{%@$%@@# @${P%@@}}}~ <>}@!@ A Network Ethernet (IEEE 802.3, 1997)

But we can encrypt! What is the problem? %Q}!$#!{}{ @%%:@} @$@@ }{}{@@}{}@{@ {@}@#$ }{%@$%@@# @${P%@@}}}~ <>}@!@ A Network Ethernet (IEEE 802.3, 1997) Same for IP, TCP, SMTP, IRC, HTTP,...

But we can encrypt! What is the problem? %Q}!$#!{}{ @%%:@} @$@@ }{}{@@}{}@{@ {@}@#$ }{%@$%@@# @${P%@@}}}~ <>}@!@ Destination IP web Dr. Oncologist A Network Ethernet (IEEE 802.3, 1997) Same for IP, TCP, SMTP, IRC, HTTP,...

OMG!! Meta Data is also sensitive!! %Q}!$#!{}{ @%%:@} @$@@ }{}{@@}{}@{@ {@}@#$ }{%@$%@@# @${P%@@}}}~ <>}@!@ Destination IP web Dr. Oncologist A Network Ethernet (IEEE 802.3, 1997) Same for IP, TCP, SMTP, IRC, HTTP,...

Traffic analysis: meta data analysis Wikipedia: traffic analysis is the process of intercepting and examining messages in order to deduce information from patterns in communication Making use of just traffic data of a communication (aka metadata) to extract information (as opposed to analyzing content or perform cryptanalysis) Identities of communicating parties Timing, frequency, duration Location Volume Device Military Roots - M. Herman: These non-textual techniques can establish targets' locations, order-ofbattle and movement. Even when messages are not being deciphered, traffic analysis of the target's Command, Control, Communications and intelligence system and its patterns of behavior provides indications of his intentions and states of mind - WWI: British troops finding German boats. - WWII: assessing size of German Air Force, fingerprinting of transmitters or operators (localization of troops). Nowadays - Diffie&Landau: Traffic analysis, not cryptanalysis, is the backbone of communications intelligence - Stewart Baker (NSA): metadata absolutely tells you everything about somebody s life. If you have enough metadata, you don t really need content. - Tempora, MUSCULAR XkeyScore, PRISM - Also good uses: recommendations, location-based services, Herman, Michael. Intelligence power in peace and war. Cambridge University Press, 1996. Diffie, Whitfield, and Susan Landau. Privacy on the line: The politics of wiretapping and encryption. MIT press, 2010. http://www.theguardian.com/world/interactive/2013/nov/01/snowden-nsa-files-surveillance-revelations-decoded

Anonymous communications against Traffic Analysis If you are a cyber-criminal! DRM infringement, hacker, spammer, terrorist, etc. But, also if you are: Journalist Whistleblower Human rights activist Business executive Military/intelligence personnel Abuse victims And normal people?? - Avoid tracking by advertising companies - Protect sensitive personal information from businesses, like insurance companies, banks, etc. - Express unpopular or controversial opinions - Have a dual life A professor who is a pro in LoL! - Try uncommon things -It feels good to have some privacy!

But, It s Hard to be Anonymous! Your network location (IP address) can be linked to you ISPs store communications records Usually for several years (Data Retention Laws) Law enforcement can subpoena these records Your application is being tracked Cookies, Flash cookies, E-Tags, HTML5 Storage Centralized services like Skype, Google voice Browser fingerprinting Your activities can be used to identify you Unique websites and apps that you use Types of links that you click

You Have to Protect at All Layers! While Maintaining Efficiency

Anonymous communications adversary Observe All links (Global Passive Adversary) Some links Modify delay delete or inject messages Control some nodes in the network. The adversary s' limitations Cannot break cryptographic primitives Cannot see inside nodes he does not control

Anonymity PROPERTIES Sender anonymity: cannot know who is Receiver anonymity: cannot know who is Bidirectional anonymity: and cannot know who each other is 3 rd party anonymity: and can know each other, but Sauron doesn't Unobservability: Sauron cannot tell if or send/receive Unlinkability: Two messages cannot be linked to /

Quantifying anonymity How much anonymous we are? Anonymity Set Who sent this message? Dear Dr., Can we change my chemo appointment? A. A Network

Quantifying anonymity How much anonymous we are? Anonymity Set Who sent this message? Dear Dr., Can we change my chemo appointment? A. A Network Larger anonymity set = stronger anonymity

Quantifying anonymity How much anonymous we are? Anonymity Set Who sent this message? t Dear Dr., Can we change my chemo appointment? A. A Network Larger anonymity set = stronger anonymity

Quantifying anonymity How much anonymous we are? Anonymity Set Who sent this message? H(x) Pr[sender] t Dear Dr., Can we change my chemo appointment? A. A Network Larger anonymity set = stronger anonymity

Quantifying anonymity Anoa Framework Game à la crypto // Differential privacy Run the protocol (aka anonymous communication system) with different senders and check that the adversary cannot distinguish them

How do we build anonymous communications

Trivial: Anonymity through Broadcasting Dave Charlie Fred

Trivial: Anonymity through Broadcasting Dave Charlie E(msg) Fred

Trivial: Anonymity through Broadcasting E(Junk) E(Junk) Dave Charlie E(msg) Fred E(Junk)

Trivial: Anonymity through Broadcasting Simple receiver anonymity E(Junk) E(Junk) Dave Charlie E(msg) Fred E(Junk)

Trivial: Anonymity through Broadcasting Simple receiver anonymity E(Junk) E(Junk) Point 1: Do not re-invent this Dave Charlie E(msg) Fred E(Junk)

Trivial: Anonymity through Broadcasting Simple receiver anonymity Dave Charlie E(Junk) E(Junk) E(msg) Point 1: Do not re-invent this Point 2: Many ways to do broadcast - Ring - Trees It has all been done (Buses) Point 3: Is your anonymity system better than this? Fred E(Junk)

Trivial: Anonymity through Broadcasting Simple receiver anonymity Dave Charlie E(Junk) E(Junk) E(msg) Point 1: Donotre-inventthis Point 2: Many ways to do broadcast - Ring - Trees Ithas all been done (Buses) Point 3:Is your anonymity systembetterthanthis? Point 4: Whatarethe problems here? Fred E(Junk) Coordination Sender anonymity Latency Bandwidth

The Chaumian mix (1981) cryptographic relays to break the link between sender and receiver Zelda Walter E MIX (msg, Charlie) E(msg) Dave mi x Charlie Victor Fred

The Chaumian mix (1981) cryptographic relays to break the link between sender and receiver Zelda Walter E MIX (msg, Charlie) E(msg) Dave Victor mi x Bitwise Unlinkability Computational security (cryptography-based) Charlie Fred

The Chaumian mix (1981) cryptographic relays to break the link between sender and receiver Zelda Walter E MIX (msg, Charlie) E(msg) Dave Victor mi x Traffic analysis resistance destroy metadata Batch + (delay, inject, drop) Charlie Fred

The Chaumian mix (1981) cryptographic relays to break the link between sender and receiver Zelda Walter E MIX (msg, Charlie) E(msg) Dave Victor mi x One-proxy problems - Low throughput. - Corrupt Proxy or Proxy hacked / coerced. - Real case: Penet.fi vs the church of scientology (1996) Charlie Fred

Solution: Mix networks Receivers Senders Bitwise unlinkability Crypto to make inputs and outputs bit patterns different (re)packetizing + (re)schedule + (re)routing, Destroy patterns (traffic analysis resistance) Load balancing Distribute trust

Solution: Mix networks Receivers Senders 2 4 1 Bitwise unlinkability Crypto to make inputs and outputs bit patterns different (re)packetizing + (re)schedule + (re)routing, Destroy patterns (traffic analysis resistance) Load balancing Distribute trust A->M 2 : {M 4, {M 1,{B, Msg} M1 } M4 } M2

Solution: Mix networks Rely on more mixes good idea - Distributing trust some could be dishonest - Distributing load fewer messages per mix Two extremes - Mix Cascades All messages are routed through a preset mix sequence Good for anonymity poor load balancing - Free routing Each message is routed through a random sequence of mixes Security parameter: L then length of the sequence

Mix networks Who are the others? The (n-1) attack active attack Zelda Walter Dave mix Charlie Victor Fred

Mix networks Who are the others? The (n-1) attack active attack Wait or flush the mix. Block all incoming messages (trickle) and injects own messages (flood) Zelda Walter Dave mix Charlie Victor Fred

Who are the others? Mitigating N-1 attacks Strong identification to ensure distinct identities Problem: user adoption

Who are the others? Mitigating N-1 attacks Strong identification to ensure distinct identities Problem: user adoption Message expiry Messages are discarded after a deadline Adversary cannot flush the mix, and inject messages unnoticed Heartbeat traffic Mixes route messages in a loop back to themselves Detect whether an adversary is blocking messages Forces adversary to subvert everyone, all the time

Mixes are slooooow Low-latency anonymous communications Onion Routing: anonymize streams!

Mixes are slooooow Low-latency anonymous communications Onion Routing: anonymize streams! Next week

Key takeaways Anonymity requires a crowd Making one on your own expensive (broadcast) Who are the others? Hard problem Mix networks Practical anonymous messaging Bitwise unlinkability / traffic analysis resistance Distribution: Cascades vs. Free route networks Onion Routing next week