Probabilistic Anonymity Mohit Bhargava IIT New Delhi Catuscia

Probabilistic Anonymity Mohit Bhargava, IIT New Delhi Catuscia Palamidessi, INRIA Futurs & LIX, 25 January 2005 Probabilistic Anonymity

Plan of the talk • • The concept of anonymity Anonymity and nondeterminism Example: the Dining Cryptographers Conditional probability Anonymity and randomization The randomized Dining Cryptographers Analysis and verification in probabilistic πcalculus • Generalized D. C. • Conclusion LIX, 25 January 2005 Probabilistic Anonymity 2

The concept of anonymity • Goal: – To ensure that a certain part of an information becomes public while another part of it remains secret. – Typically, what we want to maintain secret is the identity of the agent involved • Examples: – Electronic elections – Delation • We will consider the case of in which the information to make public is whether or not a certain event has taken place, and the information to hide is the identity of the agent performing that event LIX, 25 January 2005 Probabilistic Anonymity 3

Anonymity and nondeterminism (1/2) • Work by Schneider and Sidiropoulos, ESORICS 1996 • Events are modeled as consisting of two components: the event itself, x, and the identity of the agent performing the event, a ax • Anony. Ags: the agents who want to remain secret • Given x, define A = {ax | a Anony. Ags } • A protocol described as a process P provides anonymity if an arbitrary permutation ρA of the events in A, applied to the observables of P, does not change the observables ρA(Obs(P)) = Obs(P) LIX, 25 January 2005 Probabilistic Anonymity 4

Anonymity and nondeterminism (2/2) • In general, given P, consider the sets: – A = { ax | a Anony. Ags } : the actions that we want to know only partially (we want to know x but not a) – B : the actions that we want to observe – C = Actions – (B U A) : The actions we want to hide A The observables to consider for the Anonymity analysis must abstract wrt the events in C. B C Definition: The system is anonymous if an arbitrary permutation ρA of the events in A, applied to the observables of P, does not change the observables ρA(Obs(P)) = Obs(P) LIX, 25 January 2005 Probabilistic Anonymity 5

The dining cryptographers (1/6) • Problem and solution formulated originally by David Chaum, J. Cryptology, 1988 • The Problem: – – – Three cryptographers share a meal The meal is paid either by the organization (master) or by one of them. The master decides who pays Each of the cryptographers is informed by the master whether or not he is has to pay • GOAL: – The cryptographers would like to know whether the meal is being paid by the master or by one of them, but without knowing who among them, if any, is paying. They cannot involve the master LIX, 25 January 2005 Probabilistic Anonymity 6

The dining cryptographers (2/6) Crypt(0) notpays 0 Master Crypt(1) LIX, 25 January 2005 Crypt(2) Probabilistic Anonymity 7

The dining cryptographers (3/6) A solution • Each cryptographer tosses a nondeterministic coin. Each coin is in between two cryptographers. • The result of each coin-tossing is visible to the adjacent cryptographers, and only to them. • Each cryptographer examines the two adjacent coins – If he is paying, he announces “agree” if the results are the same, and “disagree” otherwise. – If he is not paying, he says the opposite LIX, 25 January 2005 Probabilistic Anonymity 8

The dining cryptographers (4/6): A solution Crypt(0) notpays 0 Coin(0) Coin(1) Master Crypt(2) Crypt(1) agree 1 / disagree 1 LIX, 25 January 2005 look 20 Coin(2) Probabilistic Anonymity 9

The dining cryptographers (5/6) Properties of the solution Proposition 1 (Public information): if the number of “disagree” is even, then the master is paying. Otherwise, one of them is paying. Proposition 2 (Anonymity): In the latter case, if the coin is fair then the non paying cryptographers and the external observers will not be able to deduce whom exactly is paying LIX, 25 January 2005 Probabilistic Anonymity 10

The dining cryptographers (6/6) Automatic verification • Schneider and Sidiropoulos verified the anonymity of the solution to the dining cryptographers by using CSP. – The protocol : system P of parallel CSP processes (master, cryptographers, coins) – A (anonymous events): pays 0, notpays 0, …, notpays 2 – B (observable events): agree 0, disagree 0, …, disagree 2 – C (hidden events): results of coins – Observables : all traces of P with events from C removed • For every permutation ρ on A, we have ρ(Obs(P)) = Obs(P) LIX, 25 January 2005 Probabilistic Anonymity 11

Limitations of the nondeterministic approach • The nondeterministic components must be produced by random devices – nondeterministic coin random coin • An observer may deduce info about the system from the probability distribution of the devices. This possibility is not captured by the nondeterministic formulation: The nondeterministic definition is “too coarse” – For example, if we know that two adjacent coins are biased, we can deduce when the corresponding cryptographer is likely to be lying • The probability distribution of the devices may be guessed by testing the system – For example in if the cryptographers are more than 3, we can deduce that two coins are biased by looking at the results several times LIX, 25 January 2005 Probabilistic Anonymity 12

Conditional probability (1/3) • We propose a notion of anonymity based on conditional probability • A brief recall of the notion of conditional probability • Puzzle: – A king offers to a guest to pick one of three closed boxes. One contains a diamond, the other two are empty – After the guest has picked a box, the king opens one of the other two boxes and shows that it is empty – Then the king offers to the guest to exchange the box he picked with the other (closed) one – Question: should the guest exchange? LIX, 25 January 2005 Probabilistic Anonymity 13

Conditional probability (2/3) • Answer: it depends on whether the king opens intentionally an empty box, or not. • In the first case, the guest should better change his choice since the other box has now probability 2/3 to contain the ring • In the second case, it does not matter. Both the remaining closed boxes have now probability ½ to contain the ring LIX, 25 January 2005 Probabilistic Anonymity 14

Conditional probability (3/3) • pb(X|Y) = conditional probability of X given Y = pb(X and Y) / pb(Y) Let us consider again the puzzle in Case 2 • • • Bi = Box i contains the ring Initially: pb(B 1) = pb(B 2) = pb(B 3) = 1/3 After opening one box, say Box 1, if it turns out to be empty, we have: pb(B 2) = pb(B 2 | not B 1) = pb(B 2 and not B 1) / pb(not B 1) = pb(B 2)/pb(not B 1) = (1/3) / (2/3) =1/2 LIX, 25 January 2005 Probabilistic Anonymity 15

Anonymity and randomization (1/2) • Remember that, given P, we consider the sets: – A = { ax | a Anony. Ags } : the actions that we want to know only partially (we want to know x but not a) – B : the actions that we want to observe (it may include x but not a) – C = Actions – (B U A) : The actions we want to hide A B LIX, 25 January 2005 C Probabilistic Anonymity 16

Anonymity and randomization (2/2) • The observables must abstract wrt C • Definition: The system is anonymous if for every nonderministic choice, for every observations O 1, O 2 in which x happens, and for every action ax A, we have pb(ax | O 1) = pb(ax | O 2) i. e. the observables do not allow to deduce anything about the identity of the agent • Equivalently: for every O, a and b, we have pb(O | ax) = pb(O | bx) namely, the probability of an observable does not depend on the identity of the agent • Note that the second formulation can be regarded as the probabilistic version of the definition of Schneider/ Sidiropoulos • Note that in general pb(ax | O) =/= pb(bx | O), hence the latter cannot be a good definition of probabilistic anonymity LIX, 25 January 2005 Probabilistic Anonymity 17

The randomized dining cryptographers • Each cryptographer tosses a probabilistic coin • All the rest is the same as before. In particular, the master is nondeterministic LIX, 25 January 2005 Probabilistic Anonymity 18

Verification in probabilistic p-calculus • • We have verified the anonymity of the randomized solution to the dining cryptographers by using the probabilistic p-calculus. – The protocol : system P of parallel processes: – A (anonymous events): pays 0, notpays 0, …, notpays 2 – C (hidden events): results of coins – B (observable events): agree 0, disagree 0, …, disagree 2 – Observables : all traces of P with events from C removed • • • Master: probabilistic (blind) Coins: probabilistic (blind) Cryptographers: deterministic combination chosen nondeterministically chosen probabilistically Determined by the choice of the master and of the coins For every i, k, and for every combination O of agree/disagree, we have ρb(O | paysi) = pb(O | paysk) LIX, 25 January 2005 Probabilistic Anonymity 19

The generalized dining philosophers • In general, given an arbitrary graph, where the nodes represent the cryptographers, and the arcs the coins, we can extend the protocol as follows: – bi = 0 if cryptographer i does not pay, bi = 1 otherwise – coink = 0 if coin k gives head, coink = 1 otherwise – crypti = output of cryptographer i, calculated as follows: crypti = Crypti Coink Sk adjacent i coink + bi where the sums are binary LIX, 25 January 2005 Probabilistic Anonymity 20

The protocol in the general case • Proposition: there is a payer iff Si crypti = 0 Proof: just observe that in this sum each coink is counted twice. Furthermore there is at most one k s. t. bk = 1. Hence the result is 0 iff there is no k s. t. bk = 1. • Proposition: If all the coins are fair, and the graph is connected, then – the system is anonymous for every external observer – the system is anonymous for any node j such that, if we remove j and all its adjacent arcs, the rest of the graph is still connected LIX, 25 January 2005 Probabilistic Anonymity 21

Conclusion • Notion of probabilistic anonymity – Extending the classic one of Schneider. Sidiropoulos • Application to the example of the generalized dining cryptographers • Verification using the p-calculus • In retrospect, we should have verified the protocol using a probabilistic master LIX, 25 January 2005 Probabilistic Anonymity 22