DAPPCON 2019: Network-Layer Anonymity for Privacy-Enhanced Dapps - Claudia Diaz (Nym)

Transcript

so I'm ready yet I have two hats that you can see in the slide I am chief scientist at min technologies and I am also an associate professor at the University of Leuven we have worked for the last 20 years on designing and analyzing privacy technologies and in particular anonymous communication system so I will try in the next 20 minutes to share with you some of the insights and he points that I have learned doing this work all right so let's start from the beginning what does it mean to be anonymous so an anonymous is a word that comes from Greek it comes from the prefix an and the word anima and it means without a name so to be anonymous is to be nameless so basically

it means that we have some subjects that we to which to whom we cannot link or attach a name now this subject who is this subject it can be anything it can be somebody physically present like I am present here maybe you don't know my name you can kind of hold it in beginning it can be the owner of a device an account or wallet it can be the person whose data record for example patient record is in a in a database it can be the subject making a transaction they write in fun online text you name it ok and what about this name what do we think of names so names are not just the name that is printed in your password that's one of your names but there are many other identifiers that

can function as your name so for example unique IDs obviously but also your cookie identifiers identify you and I your name towards the website that you have visited the key to a database that has your records is their name where they can aggregate more data your IP address at the network layer is your name all right so what's in a name it's it's not just why do we want to prevent attached naming this individual because the name is not just the name the name usually is connected to a history of other actions or activities that this person engaged with ok so together with this name we will typically have a database of past actions that we can link to that name and therefore to the

individual so if we can name this person we can also connect this person to a lot of other history about well and then therefore learn potentially a lot of library information now a final thing I want to say in this introductory slide is that when we think of knowing or not knowing the name in technical terms is not usually about either I know it and I know everything or I don't know it and I know nothing the way we model anonymity in technically typically is that there is a bag of names and we don't know which one corresponds to the individual so you should think about it like for example all the batches of the conference or the participants you see me participate in this conference and in the table of

batches you might want to guess or try to find which one is mine and maybe you have no clue about any that can be equally likely to be mine or maybe you can think okay well she's a female so probably it's a female name and you know she lives like southern European so it's probably you know some names might be more likely than others so this is the way we typically think about anonymity and naming and when we're looking at online anonymity okay so what about only online anonymous only an activity we have a user Alice she wants to access some service and she wants to do it anonymously meaning that at the side of the service it should not be possible to know what her name is now if we want to

model anonymity in a classical secure communication model we have something like this we would have Alice - Bob she sent a message to Bob and we have an adversary Eve that can look at the communication and a secure channel would provide confidentiality authentication and integrity for that message now the problem with this model is that it doesn't have we cannot wanna learn anima T there because we can see we Alice sends a message to Bob therefore Eve already knows who Alice is talking to and she knows how to link the sender and receive the communication so this is not a model that we can use for - for online and remedy instead when we talk about anonymity we typically think of something like this which is

that we have many Alice's and many Bob's and we can not tell which Alice is talking too much Bob again the adversary also becomes a little bit more complicated we don't have just a line from Alice to Bob now we have a complicated system it could be the adversary is looking at Alice's communications it could be that the adversary is looking at Bob it could be that the other story is looking at some pieces of the network some intermediate entities or it could be that the adversary is looking at the whole network if your adversary is for example the NSA or some entity that has very broad visibility over Internet communications so the first really key point that I want you to take from here is that you cannot be a nun using your

own in order to be anonymous you have to be embedded or covered in a group of people okay you want this group of people to be diverse this is very important if you have imagined that you are you're accessing information about cancer in a website and you don't want anybody to know that you're accessing this information if you're using a system that many other people use to access information about cancer then even if I cannot tell who you are I can still ensure a lot about the activity you're conducting right so you don't want to use a system that only other people who are doing similar things to

what you're doing use that use it you want to use a system that is used by a very broad and diverse base of people doing a very diverse set of things and in this way when I see you using this system I have a lot of uncertainty about what you're actually doing because you might be looking at the website you might be sending a message you might be just checking your Dropbox you might be reading your email you might be doing all kinds of things so they more diverse the uses of the network and of the system the more anonymous you are so anonymity loves company and in order to be anonymous you have to be you know you have to work together with other people this is a very important point this is not the case you just care about confidentiality if you just carry out confidentiality

for my own data I generate a key and keep my data I don't need anybody else to that's I'm done if you and I want to have a confidential conversation we establish a key and then we can talk and we don't need other people to help us if you want to be anonymous you need other people to help you because by yourself you will not be able to be anonymous you need them to provide cover and the other thing about anonymity is that it's very fragile anonymity can be broken as soon as you can find as soon as you're leaking information that can enable identification at any layer so this can be your mobile phone that has radio fingerprints that is recognizable for

example and I can maybe be anonymize you by looking by identifying this radio fingerprint or I can identify you through your network IP address or other traffic metadata or maybe the fingerprint of your device or your browser or your your software the so brains on your in your computer or you have published an anonymous text maybe I can identify you based on your writing style or based on some information that I have about block transactions depending on the application you will have different layers the point is if in one of these layers you have information leaking then enables identification all the work that you did at the other layers you know it's kind of loss because you will not be anonymous

anymore so that's the other key point I want to make that leakage that enables the an ionization occurs at multiple layers so I know you're not done with anonymity want to just have covered one layer alright so when we think about private communication what property is more specifically are we thinking about so first of all of course we want the content of communications to be confidential we want to have other properties such as for securities such that if for example some of the entities are compromised past communications cannot be the privacy back of past communications has been preserved and you and we also want to avoid central points of failure in order to have a

disability trans model that does not rely on centralized parties so that's one of the types of properties we also want to have anonymity this is the main focus of this talk now anonymity is not just a single property anonymity can be defined in many different ways I'm just giving three main examples of what anonymity can mean so Center and an immediate means that I can the message to you without you knowing that I sent you the message you as a receiver will not know that I sent a message receiver anonymity means that you can send a message to me without knowing who I am or where I am located you can reply to me anonymity if I send you an anonymous message very often what

we want is third party and I mean this is a weaker notion here you and I we know each other we authenticate each other we want to sign everything and we want to ensure okay we want to be sure each other's identity but we don't want any third party to know that we are talking to each other and you know this is what is called anonymity toast third party and third party anonymity now i'm simplifying here there is a recent paper a very nice paper that was published this summer in the tax conference that looks into privacy properties for that are related to anonymity and they identified 28 properties so just to give you a sense of the amount of variables and features are involved threat model assumptions different leakages and so on so this is actually much more complex

than what i'm saying but these are kind of very important properties that we often want to achieve beyond anonymity we want messages to be on linkable that means that if i send you two messages maybe i want you to not be able to tell that the two messages came from the same person why is that because if you have a system that provides anonymity but not unlink ability that means that after a while you will have compiled a dossier of all the activity all the messages that some anonymous subject has been sending the more information you collect the more you can reveal about the person and the more that random identifier that you assigned to that I'm gonna use

usually becomes an actual name because it has a history attached to it and it has valuable information attached to it and finally a very strong property is an observability so anonymity is not enough because anonymity does not conceal the amount of traffic that you that you are sending it it does not conceal when you're online or offline when you're accessing a service or not and so on so another mobility is some stronger property that not only conceals who talks to whom but hides the fact that you're sending a message so to achieve this we apportion it damage traffic hover traffic meaning that you have to be simulating activity even if you're not doing anything okay what about advertiser when we want to be anonymous online what kind of

network adversaries are we considering and in the case of the system's I want to talk about these are very strong Network adversaries so the capabilities of this adversary is typically for for mixes which is the system I will introduce I am in a moment is that this is an adversary that can monitor all the links in the network so we assume the adversary can monitor all communications in the network they can compromise a subset of entities in the network either by injecting their own nodes which typically is difficult to prevent this is what is called a Sybil attack if they really take over by injecting a lot of them or maybe they are not able to introduce their own nodes but they can coerce existing nodes into or compromise them into leaking their keys or

obtaining their key so that they can you know access the internal information of that node and we typically can see the active adversaries that can read inject delete and modify message so this is a pretty powerful adversary what's the objective of this adversary mainly I linked a sender and a receiver for communication so either so identify the sender of a received message or the receiver of a sent message depending on whether you're looking at the outputs and strong limitation we have is that adversaries can not break crypto primitives and cannot see inside the nose they do not control okay so what we're doing instead is statistical analysis the metadata that is available at the network

to this adversary that is looking at the links and that is available as well at the corrupted nodes that are able to see some more privileged information all right so what kind of systems do we have to achieve these properties against this strong Network adversaries so the the original design is dates back from the the 80s is probably older than many people in this room and I scroll is what we can call the chun-yin mix and this is basically a proxy that performs a shuffle it takes a set of input messages shuffles them and outputs them these systems typically have a parameter is that is a threshold so for example if the parameter the professional is a hundred he means that the mix will wait until it

collects a hundred messages and once it has received the hundredth message it will perform a cryptographic operation shuffle and output so it this is a it was proposed to implement anonymous email and the goal is that even if the adversary is looking is seeing all the inputs and all the outputs they are not able to correlate which input corresponds to which output so you want to have a permutation that doesn't leak any information for that you need to change the message cryptographically meaning that the bits should not give any information about what input corresponds to which output but that's not enough that's the easy part actually the difficult part is that you also have to break timing and order correlations because if I know that the first in is the first out then even if I can the

cryptograph the cryptography is perfect based on order on timing I will be able to make input two of those right so Charmian makes us achieve reordering by waiting for this end messages performing a shuffle and then sending them forward in a random order and if you want to this will trust you can chain multiple mixes in a in a cascade so this is the original decide from the 80s we have other designs have been proposed since so for example what about flushing every hour instead of waiting for n messages in this way we have a bound on how long it will take a message to be delivered you can have optional conditions only or you will only send

messages if you have more than 20 otherwise then an immediate sets to small things like that pool mixes are an interesting extension instead of sending all the messages constraint contain inside the the mix they send only a subset and they keep the rest inside giving mix with the new arrivals so that means that you have a much bigger than immediate set because once a message goes in you are not sure when they were out asymptotically they will go out if we go out before the end of time but you don't know when and therefore you have a much bigger than limit a set and a very interesting variant is what is called the slope angle or Poisson mixes that delay each message individually instead of batching and what they do is that the each message is delayed according to

a sample drawn from an exponential distribution and the nice thing about this is that you can actually the the person encoding these delays which will typically be the sender can actually predict when the message will be the Leopards these mixes provide actually the same kind of anonymity as full mixes because of the memory less property of his potential distribution which means that if you have n messages that came into the mix no matter at which times they came in when you see one going out all of the messages in the mix are equally likely to be the one picked the one that is coming out first independently of the order of arrival okay good so of course you don't want to have a

single mix this is a single trusted central point you want to distribute trust to avoid single points and failures if you want to rock messages to multiple mixes now how did you organize these mixes what's the network topology you are going to choose so early designs had a free route that means that you can choose any let's say free mixes in any order and this is for example more or less helped or is designed and on the other end of the scale you had cascades that are basically this is the charm proposal where you just change a set of properties one after the other and if you need to increase capacity then you have to have funnel Cascades because you will have a limit on how much an individual connection and computer can work how much throughput it can handle

in the intermediate topologies are what we call stratified or layered topologies and are very interesting because it turns out they actually provide higher anonymity than any of the other designs oh wow yeah thank you any for like they provide higher anonymity while providing very good scalability in particular compared to Cascades who selects the routes is it the sender of the message or do each of the intermediaries decide on the next hop normally in mixed networks I think on your routing it is the sender that will decide on the footpath that means they have to know the full path they have to know the full network in order to select this path which is also a challenge what about reliable transport you're sending this message into the mix and do you know if

it arrived or not most designs most existing designs actually all existing designs except for ours do not provide reliable transport in the sense that you have is a best effort you have to hope the message is delivered we actually are able to have acknowledgments using single users with high blocks that are part of the packet format that we're using that enable sending anonymous replies and these anonymous requires we're using a technology meant so that you can tell back to the sender your message was delivered and if the acknowledgement is not received then you know it was not delivered and therefore you have to be sentence there are in anonymity systems there are important trade-offs between latency and an immediate and bandwidth bandwidth in business of how much public

traffic you can have how many users you can handle and only how many how much you delay messages and depending on your priorities the type of application they strengthen on email you will be in different places on this on this trade off and then what's your degree of centralization many of the existing system such a store they have centralized components such as directory authorities that this needs to be level information and these are in our opinion undesirable if you want to have a truly decentralized system again also how do you incentivize you have to have in anonymity you cannot do it alone a lot of people have to work together to achieve anonymity how do you incentivize these participants how do you reward them for performing the role and I will not go into this this is just to show

you the complexity of designing a new routing this is actually part of a survey that we did with fatima she does it was not at web 3 foundation and a survey of gnarnia slotting protocols and these are the features that we extracted that you have to actually take into consideration when you want to design an anonymous routing system so just to show you that there is a lot more that I'm not going into detail here ok so you might be asking okay so we know tor or we have heard of tor so how are mixed nets different from tor so just to give you the highlights of what is similar and what is different they are similar in that they are typically source routed source routed means that the sender the creator of the nets which is the one who

decides on the food routes this is source route other systems exist that are hot by growling meaning that the sender sends to one entity in the network and then that entity decides on who the next hop is and then that one decides in the next those systems are vulnerable to look that route capture attacks and generally source routing is more desirable and they're also similar in that we have basically cells or packets that reverse our network with multiple hops in which each hop is performing a cryptographic transformation of the of the of the packets now hardly difference so Tory's connection based in tour you're basically open like a physical channel and to and you first establish this

channel these circuits and then you use this circuit for several minutes to you know it's an interactive bi-directional low latency channel right mixed Nets our packet base that means that every packet is routed independently it means every packet has its own routing information in that it there all right so that's one important difference another important difference is that tor does not add latency because it aims to be as fast as possible to be usable for web browsing and therefore and that's not at latency at that means that is vulnerable to end-to-end confirmation attacks end-to-end confirmation attacks are attacks where you can see the beginning of the connection so sender to the top

network and the end of the connection tor network to final destination if you are able to have these two vantage points because there is no latency and there is no cover traffic added you can simply see okay a connection started at this time ended at this time cut so many packets the packets in the first second where so many second and then you can see the same pattern repeating with a small delay at the exit because you didn't every order package within our coverage traffic so you didn't be stored this this pattern that is in the in the sequence while with mixes we are adding a latency so you cannot perform this easy correlation you cannot best do what is called long

term intersection which means that it's statistically after many many observations you start saying that some recipients are more likely than others to be your target so in that sense they are a lot stronger and then another differences that tour aims to be an open system that means that if you can use it to connect you website whatever systems that are completely unaware of this is enough at all and that makes it very challenging well it makes sense you typically have a closest than meaning that the recipient also has software that understands the packet format and can perform a decryption and it's in a way integrated or interoperable with the system in both systems you can use any traffic tor doesn't implement its some mixes not implemented we want to use it

because that exchanges anonymity and provides enough stability okay so the one we are with the mix that we're working on and I'm coming I'm closing very quickly it's based on loop Peaks there's a paper that you can check and use this for so mixes so this mixes that have exponential delays because they have have very they have a predictable latency and they produce very large anonymity sense so we like them because of that we're using a layered network topology because it's the best topology according to studies that we need over ten years ago and we use loops of damaged traffic that create covered traffic in the system meaning that it's not possible to see if you're doing something at all you just send in copper traffic and that strengthens anonymity and also provides

enough stability and deniability properties we also have reliable transport we have this ax based on these things single gene supply blocks these have reply blocks that can be used to send anonymous replies we use them to send acts back and achieve reliable transport and we have an incentivize network where the mixes are paid for their work they receive money rewards for the work they do and and this is for useful work if not for useless work just looking for hashes and that enables a decentralized architecture we are now working we have a very nice design for working on a measurement system that will give us accurate readings that are decentralized and secure of this quality of service that to make sure that mixes

are really indeed not dropping packets yeah you can take a picture or read them so we have time for one question [Music]

now how do we make sure that that is that generate what is called metric messages these messages are generated not like 20 she will generate messages and then be able to prove that they saw apps that

were in thank the speaker one more time [Applause]