Receiver Anonymity via Incomparable Public Keys Brent R

Receiver Anonymity via Incomparable Public Keys Brent R. Waters, Edward W. Felten, and Amit Sahai Department of Computer Science Princeton University

Receiver Anonymity Alice can give Bob information that he can use to send messages to Alice, while keeping her true identity secret from Bob. Anonymous ID “Where are good Hang Gliding spots? ” Send to: alt. anonymous. messages Bulletin Board Bob alt. anonymous. messages Alice

Receiver Anonymity • Anonymous Identity – Information allowing a sender to send messages to an anonymous receiver – May contain routing and encryption information • Requirements – – Receiver is anonymous even to the sender Anonymous Identity can be used several times Communication is secret (encrypted) Messages are received efficiently

A Common Method Alice anonymously receives encrypted message from both Bob and Charlie by reading a newsgroup. Anonymous ID 1 “Where are good Hang Gliding spots? ” Bulletin Board Bob alt. anonymous. messages Send to: alt. anonymous. messages Alice Encrypt with: a 45 cd 79 e Charlie Anonymous ID 2 “What Biology conferences are interesting? ” Send to: alt. anonymous. messages Encrypt with: a 45 cd 79 e

The Encryption Key is Part of the Identity Bob and Charlie collude and discover that they are encrypting with the same public key and thus are sending messages to the same person. Anonymous ID 1 “Where are good Hang Gliding spots? ” Bulletin Board Bob alt. anonymous. messages Send to: alt. anonymous. messages Alice Encrypt with: a 45 cd 79 e Charlie Anonymous ID 2 “What Biology conferences are interesting? ” Send to: alt. anonymous. messages Encrypt with: a 45 cd 79 e

The Encryption Key is Part of the Identity Bob and Charlie then aggregate what they each know about the Anonymous Receiver and are able to compromise her anonymity. Anonymous ID 1 “Where are good Hang Gliding spots? ” Bulletin Board Bob alt. anonymous. messages Send to: alt. anonymous. messages Alice Encrypt with: a 45 cd 79 e Hang Gliding + Biology => Alice Charlie Anonymous ID 2 “What Biology conferences are interesting? ” Send to: alt. anonymous. messages Encrypt with: a 45 cd 79 e

Using an Independent Public Key per Sender Alice creates a separate public/private key pair for each sender. Upon receiving a message on the newsgroup Alice tries all her private keys until one matches or she has tried them all. Bulletin Board Bob alt. anonymous. messages a 45 cd 79 e Alice Keys to Try Charlie 48 b 33 c 03 ae 668 f 53 207 c 5 edb

Using an Independent Public Key per Sender Alice creates a separate public/private key pair for each sender. Upon receiving a message on the newsgroup Alice tries all her private keys until one matches or she has tried them all. Bulletin Board Bob alt. anonymous. messages a 45 cd 79 e Alice 207 defb 1 b 593 f 399 Keys to Try 04 d 2 a 93 c Charlie 398 bac 49 48 b 33 c 03 43 bca 289 ae 668 f 53 207 c 5 edb 40 b 2 f 68 c 2 fce 8473 e 3 c 8 f 522 70 f 4 ba 54 46 cce 276 075 ca 5 ef b 9034 d 40 86 cf 1943 56734 ba 5

Incomparable Public Keys • Receiver generates a single secret key • Receiver generates several Incomparable Public Keys (one for each Anonymous Identity) • Receiver use the secret key to decrypt any message encrypted with any of the public keys • Holders of Incomparable Public Keys cannot tell if any two keys are related (correspond to the same private key)

Using an Incomparable Public Keys to Receive Messages Efficiently Alice creates a one secret key and distributes a different Incomparable Public Key to each sender. Bulletin Board Bob alt. anonymous. messages a 45 cd 79 e Alice 207 defb 1 b 593 f 399 Keys to Try 04 d 2 a 93 c Charlie 398 bac 49 e 3 c 8 f 522 207 c 5 edb 70 f 4 ba 54 46 cce 276 59 b 39 c 03

Key Generation • Based on El. Gamal encryption – All users share a global (strong) prime p – Operations are performed in group of Quadratic Residues of Zp* • Secret Key Generation: – Choose an El. Gamal secret key a • Generate a new Incomparable Public Key: – Pick random generator, g, of the group – Public key is (g, ga)

Security Intuition • Cannot distinguish equivalent keys (g, ga), (h, ha) from non-equivalent ones (g, ga), (h, hb) – Assuming Decisional Diffie-Hellman is hard

Security Intuition • Cannot distinguish equivalent keys (g, ga), (h, ha) from non-equivalent ones (g, ga), (h, hb) – Assuming Decisional Diffie-Hellman is hard • However, this is not enough if the receiver might respond to a message

Security Intuition • Cannot distinguish equivalent keys (g, ga), (h, ha) from non-equivalent ones (g, ga), (h, hb) – Assuming Decisional Diffie-Hellman is hard • However, this is not enough if the receiver might respond to a message Bob (g, ga) Charlie (h, ha)

Security Intuition • Cannot distinguish equivalent keys (g, ga), (h, ha) from non-equivalent ones (g, ga), (h, hb) – Assuming Decisional Diffie-Hellman is hard • However, this is not enough if the receiver might respond to a message Bob Charlie Pair-wise multiply (g, ga) (h, ha)

Security Intuition • Cannot distinguish equivalent keys (g, ga), (h, ha) from non-equivalent ones (g, ga), (h, hb) – Assuming Decisional Diffie-Hellman is hard • However, this is not enough if the receiver might respond to a message Bob Charlie Pair-wise multiply (g, ga) Alice can decrypt messages encrypted with this new key. (gh, (gh)a) (h, ha)

Solution • Record keys that were validly created • The ciphertext will contain a “proof” about which key was used for encryption • The private key holder can alternatively distribute each Incomparable Public Keys with its MAC

Encryption C = (gr, gar. K) – (g, ga) is an Incomparable Public Key

Encryption C = (gr, gar. K), H(r), EK(r, (g, ga), plaintext) – – (g, ga) is an Incomparable Public Key H is a secure hash function K is a random symmetric key r is a random exponent

Decryption C = (gr, gar. K), H(r), EK(r, (g, ga), plaintext) • Use secret key a to decrypt the El. Gamal encrypted ciphertext and learn the symmetric key K

Decryption C = (gr, gar. K), H(r), (r, (g, ga), plaintext) • Use secret key a to decrypt the El. Gamal encrypted ciphertext and learn the symmetric key K • Use K to decrypt the symmetrically encrypted ciphertext

Decryption C = (gr, gar. K), H(r), (r, (g, ga), plaintext) • Use secret key a to decrypt the El. Gamal encrypted ciphertext and learn the symmetric key K • Use K to decrypt the symmetrically encrypted ciphertext • Check that the public key inside the envelope has been distributed

Decryption C = (gr, gar. K), H(r), (r, (g, ga), plaintext) • Use secret key a to decrypt the El. Gamal encrypted ciphertext and learn the symmetric key K • Use K to decrypt the symmetrically encrypted ciphertext • Check that the public key inside the envelope has been distributed • Check that the claimed public key was used – Hash r and check it against claimed hash of r

Decryption C = (gr, gar. K), H(r), (r, (g, ga), plaintext) • Use secret key a to decrypt the El. Gamal encrypted ciphertext and learn the symmetric key K • Use K to decrypt the symmetrically encrypted ciphertext • Check that the public key inside the envelope has been distributed • Check that the claimed public key was used – Hash r and check it against claimed hash of r – Raise the public key to the r to check that it was used in the El. Gamal encryption

Decryption C = (gr, gar. K), H(r), (r, (g, ga), plaintext) • Use secret key a to decrypt the El. Gamal encrypted ciphertext and learn the symmetric key K • Use K to decrypt the symmetrically encrypted ciphertext • Check that the public key inside the envelope has been distributed • Check that the claimed public key was used – Hash r and check it against claimed hash of r – Raise the public key to the r to check that it was used in the El. Gamal encryption • If all test pass accept the plaintext

Security • Provably secure in the Random Oracle Model assuming DDH is hard • We have another construction based only on general assumptions • We can apply similar techniques to a CCA secure cryptosystem such as Cramer-Shoup

Efficiency • Efficiency is comparable to standard El. Gamal • One exponentiation for encryption • Two exponentiations for decryption and verification of a message

Comparison with Alternative Methods Several Independent Public Keys - Running time increases linearly with number of potential senders Several Independent Symmetric Keys + Encryption and decryption operations are faster - Running time increases linearly with number of potential senders - No secrecy of past messages if sender’s key is captured - Key must be distributed securely

Comparison with Alternative Methods (cont. ) Message Markers Sender puts a random tag on each message that identifies him and which key to use Tag 5 d 234 3891 c Key 98 b 2 e 6 7 ac 023

Comparison with Alternative Methods (cont. ) Message Markers Sender puts a random tag on each message that identifies him and which key to use Tag 5 d 234 3891 c Key 98 b 2 e 6 7 ac 023 + Potentially quick way for the receiver to identify her messages and discard messages destined for others - Cannot reuse a mark - Therefore both sender and receiver must update expected next mark – leads to problems if messages are lost

Applications • Use in anonymous communication between users – Users already employ newsgroups such as alt. anonymous. messages to send PGP encrypted messages to anonymous receivers • Protection of anonymity in case of device compromise – Receiver distributes a set of sensor nodes that he does not want to be traced back to him – Initially trusts the devices, but they could be captured or otherwise compromised

Embedding Incomparable Public Keys in Security Protocols Use with other schemes to enhance anonymity and efficiency • We adapted SKEME key exchange protocol to incorporate Incomparable Public Keys – Allows for establishment of efficient session key while maintaining anonymity guarantees • Peer-to Peer systems – P 5 allows tradeoff anonymity and efficiency • By making all public keys Incomparable we can enhance anonymity while still giving user a tradeoff option

Implementation • Implemented Incomparable Public Keys by extending Gnu. PG (PGP) 1. 2. 0 • Available at http: //www. cs. princeton. edu/~bwaters/research/

Gnu. PG (PGP) Background • Users post encrypted messages to newsgroups to attempt receiver anonymity • Software for automatically retrieving messages from newsgroups – Jack B. Nymble – Private Idaho

Implementation: Benefit • Receivers can give have one private key to decrypt messages sent from any one of many Incomparable Public keys • Interface is similar to original Gnu. PG interface • Only a few changes needed to be made existing code (El. Gamal encryption already exists in Gnu. PG)

Related Work • Bellare et al. (2001) – Introduce notion of Key-Privacy – If Key-Privacy is maintained an adversary cannot match ciphertexts with the public keys used to create them – The authors do not consider anonymity from senders • Pfitzmann and Waidner (1986) – Use of multicast address for receiver anonymity – Discuss implicit vs. explicit “marks”

Related Work (cont. ) • Chaum (1981) – Mix-nets for sender anonymity – Reply addresses usable only once – Other work follows this line

Conclusion • The contents of public keys are important in protecting the receiver’s anonymity from the sender • Incomparable Public Keys provide a secure and efficient way of accomplishing receiver anonymity • Incomparable Public Keys are useful in practice with Key Exchange and P 2 P systems