Till Studer's Notes

Recent Notes

11 min read

Privacy

Use Cases in Need for Privacy

  • Privacy: Hide online transactions, Web browsing, etc. from intrusive governments, marketers and archivists
  • Untraceable electronic mail:
    • Corporate whistle-blowers
    • Political dissidents
    • Socially sensitive communications (online AA meeting)
  • Confidential business negotiations Freedom of speech:
    • Censorship resistant publishing
  • Electronic elections and polls
  • Whistle-blowing (e.g. WikiLeaks)
  • Digital cash: Electronic currency with properties of paper money (online purchases unlinkable to buyer’s identity)
  • Law enforcement and intelligence
    • Sting operations and honeypots
    • Secret communications on a public network

The Need for Anonymity

  • Internet is designed as a public network
    • Machines on LAN may see your traffic, network routers see all traffic that passes through them
  • Routing information is public
    • IP packet headers identify source and destination
    • Even a passive observer can easily figure out who is talking to whom
  • Web Surfing leaves traces
    • Log entries on web servers and mail transfer agents
    • Local monitoring by the ISP, often mandated by law
    • Monitoring of transit traffic by routers and gateways
  • Encryption does not hide identities
    • Encryption hides payload, but not routing information
    • Even IP-level encryption (tunnel-mode IPSec/ESP) reveals IP addresses of IPSec gateways

Privacy – A Definition

  • Privacy is the ability of an individual or group to seclude themselves or information about themselves, and thereby express themselves selectively.
  • Privacy is the right of the individual to control his/her personal data.

Privacy by Design Law

Setting Privacy and Anonymity in Context

  • Privacy
    • EU Directive 2016/679 (General Data Protection Regulation aka GDPR)
    • Bundesgesetz über den Datenschutz (DSG) 235.1, original 19. Juni 1992, last major revision enacted in September 2023,
  • Protecting Privacy:
    • Data Minimization (“Hard” Privacy):
      • Subject provides as little data as possible
      • Reduce as much as possible the need to trust other entities
      • Example: anonymity
    • Trusted Controller (“Soft” Privacy):
      • Data subject provides his/her data
      • Data controller responsible for its protection

EU General Data Protection Regulation (EU GDPR)

  • Two categories of compliance for companies in GPDR:
    1. Data Protection: Data protection means keeping data safe from unauthorized access
    2. Data Privacy: Data privacy means empowering users to make their own decisions about who can process their data and for what purpose
  • Became effective May 25, 2018 in the EU and applies
    • to every organization which is doing business in the EU.
    • to all organizations collecting data from EU residents or process that information on behalf of someone collecting it.

Data Protection

If you process data, you have to do so according to seven protection and accountability principles outlined:

  1. Lawfulness, Fairness and Transparency: Processing must be lawful, fair, and transparent to the data subject.
  2. Purpose limitation: You must process data for the legitimate purposes specified explicitly to the data subject when you collected it.
  3. Data Minimization: You should collect and process only as much data as absolutely necessary for the purposes specified.
  4. Accuracy: You must keep personal data accurate and up to date.
  5. Storage Limitation: You may only store personally identifying data for as long as necessary for the specified purpose.
  6. Integrity and Confidentiality: Processing must be done in such a way as to ensure appropriate security, integrity, and confidentiality (e.g. by using encryption).
  7. Accountability: The data controller is responsible for being able to demonstrate GDPR compliance with all of these principles.

Data Privacy

  1. Transparency & Communication (Right to be informed): You have to explain how you process data in “a concise, transparent, intelligible and easily accessible form, using clear and plain language”
  2. At the moment you collect personal data from a user, you need to communicate specific information to them: Art 13 and Art. 14 (Rights in relation to automated decision making and profiling)
  3. Right of access
  4. Accuracy (Right of rectification)
  5. Right to erasure (also “right to be forgotten”)
  6. Right to restrict processing
  7. Right to data portability:
    • Basically, you have to store your users’ personal data in a format that can be easily shared with others and understood.
    • Moreover, if someone asks you to send their data to a designated third party, you have to do it (if technically feasible), even if it’s one of your competitors.
  8. Right to object
  • Consent must be “freely given, specific, informed and unambiguous.”
  • Requests for consent must be “clearly distinguishable from the other matters” and presented in “clear and plain language.”
  • Data subjects can withdraw previously given consent whenever they want, and you have to honor their decision. You can’t simply change the legal basis of the processing to one of the other justifications.
  • Children under 13 can only give consent with permission from their parent.
  • You need to keep documentary evidence of consent.

EU-US Data Privacy Framework

  • Framework for transfer of (user) data from the European Union to the US.
  • Rough idea: Data transfer is allowed if levels of protection are as good as in the EU.
  • Predecessors are the Safe Harbor program (2000-2015), and Privacy Shield program (2016-2020). Both were declared invalid by the European Court of Justice due to concerns that US surveillance programs could access user data from the EU.
  • The European Court of Justice will most likely also have to decide on the legality of the privacy framework for the same reasons.

Anonymity

  • Anonymity is the state of being not identifiable within a set of subjects (anonymity set).
    • Therefor you cannot be anonymous by yourself
    • And should hide your activities among others’ similar activities
  • Examples of anonymity sets:
    • Message Senders
    • Message Recipients

Definition

  • Unlinkability of action and identity
    • For example, sender and his email are no more related after observing communication than they were before
  • Un-observability
    • Any item of interest (message, event, action) is indistinguishable from any other item of interest
    • Very hard to achieve!

How to Attack

In general: You can correlate on the edges of an anonymous system. For example by observing the times of events.

  • Passive traffic analysis
    • Infer from network traffic who is talking to whom
    • To hide your traffic, must carry other people’s traffic!
  • Active traffic analysis
    • Inject packets or put a timing signature on packet flow
  • Compromise of network nodes
    • Attacker may compromise some routers
    • It is not obvious which nodes have been compromised
      • Attacker may be passively logging traffic
    • Better not to trust any individual router
      • Assume that some fraction of routers is good, and you do not know which ones

Pseudo–Anonymous Remailers

  • Single point of vulnerability: Correlation of incoming with outgoing traffic through monitoring of the remailer’s network interfaces.
  • Provider of the pseudo-anonymous remailing service might disclose identities due to political pressure, bribery or official injunctions by law enforcement agencies.

High Latency Anonymizers

  • Cascade of Mixes
    • Large message re-sorting buffers with high-latency
  • Implementations
    • Cypherpunk (Type I Anonymous Remailer) uses PGP for encryption
    • Mixmaster (Type II Anonymous Remailer) requires a special client
    • Mixminion (Type III Anonymous Remailer) requires a special client
  • Pros
    • High degree of anonymity because timing correlations are thwarted by large re-sorting buffers and a high number of mixes in the cascade.
  • Cons
    • The high latency due to the re-sorting buffers does not allow near-real-time interactive services like web browsing or instant messaging.
    • Some mixes in a cascade might not be online at the time a delayed message finally arrives, thus often leading to message loss.
      • Statistics published by tools like “echolot” help to select a reliable cascade.

Chaum’s Mixers

  • Early proposal for anonymous email:
  • Principal Concept: Public key crypto + trusted re-mailer (Mix)
    • Untrusted communication medium
    • Public keys used as persistent pseudonyms
  • Modern anonymity systems use mix(ing) as a basic building block

Public Key Crypto System

  • Chaum originally proposed text-book RSA
  • Problem: Text-book RSA is deterministic (for given public key)
    • Same message → same ciphertext
  • Solution: Add random string to encryption

Simple Mix Design

= Means the encryption of message under public key of

Mix Design with Return Addresses

  1. Sender :
  2. Recipient :
  3. Recipient :
  4. Sender :

Sequence of Mixes

  • Messages are sent through a sequence of mixes
  • The sequence can also form an arbitrary network of mixes (“mixnet”)
  • Some of the mixes may be controlled by attacker, but even a single good mix guarantees anonymity

Chaum’s Cascade of Mixes

Many Users and High Traffic Improve Anonymity

Untraceability by Using Public Key Cryptography:

Onion Routing 1st Generation

P. F. Syverson, D. M. Goldschlag and M. G. Reed, “Anonymous connections and onion routing,” Proceedings. 1997 IEEE Symposium on Security and Privacy (Cat. No.97CB36097), Oakland, CA, USA, 1997

Low Latency Anonymizers

  • Cascade of mixes
    • Small or no re-sorting buffers resulting in low-latency
  • Implementations
    • Tor - The Second-Generation Onion Router
    • JAP - Java Anon Proxy, renamed to JonDo
  • Pros
    • Low latency allows interactive services like web browsing, instant messaging or even ssh connections.
  • Cons
    • Strength of anonymity drops precariously during periods of low traffic volume.
    • Low-Latency schemes are vulnerable to a global observer monitoring all nodes because the timing of packets crossing the network can be correlated.

Onion Routing 2nd Generation

Roger Dingledine, Nick Mathewson, and Paul Syverson. 2004. Tor: the second-generation onion router. In Proceedings of the 13th conference on USENIX Security Symposium - Volume 13 (SSYM’04)

Building up a Circuit

Using the Circuit

Tor

  • Developers and Sponsors
    • Tor was initially designed and developed as part of the U.S. Naval Research Laboratory’s Onion Routing program in 2003 (by Roger Dingledine, Nick Mathewson and Paul Syverson).
    • Tor development is now supported by a large number of sponsors.
    • Thousands of nodes, 2M+ users
  • Features
    • Anonymizes bi-directional TCP-streams over the Internet.
    • Perfect forward secrecy thanks to Diffie-Hellman key exchanges.
    • Trusted directory servers provide current information on Onion Routers.
    • Exit policies define the hosts and ports an exit node will connect to.
    • Through a leaky-pipe circuit topology and dynamic in-band signalling traffic can leave the cascade at any intermediate node.
    • Establishment of Rendezvous points allows for hidden services.
    • Usually around 6000 Onion Routers are active on a global scale.

Cells, Circuits and Streams

Constructing a Circuit

Hidden Services Using Rendezvous Points

Management

  • Many applications can share one circuit
    • i.e. multiple TCP streams go over one anonymous connection
  • Tor router:
    • Does not need root privileges
    • Encourages people to set up their own routers
    • More participants = better anonymity for everyone
  • Directory servers
    • Maintain lists of active onion routers, their locations, current public keys, etc.
    • Control how new routers join the network
      • “Sybil attack”: attacker creates a large number of routers
    • Directory servers’ keys ship with Tor code

”Soft” Privacy

  • A privacy policy statement describes the intended use of the data; the policy that the company (claims it) will adhere to in using your data.
  • P3P is a standardized XML based format for privacy policies
    • enables automated tool support
      • e.g. to decide accept cookie
    • Issues:
      • Policies can be ambiguous
      • No definition how policy should be interpreted, so no enforcement
  • Enterprise Privacy (E-P3P) enforces privacy policy by attaching it to the data within an enterprise
  • P3P was obsoleted in August 2018, fewer than 6% of the 10,000 most frequently visited websites supported P3P at that time.
  • Alternatives (?): Do Not Track me, Browser included private browsing

Dining Cryptographers

Information-theoretic Anonymity

Three cryptographers are having dinner: Either the NSA is paying for the dinner, or one of them is paying, but wishes to remain anonymous.

  1. Each diner flips a coin and shows it to his left neighbor. Every diner will see two coins: his own and his right neighbor’s.
  2. Each diner announces whether the two coins are the same. If he is the payer, he lies (says the opposite).
  3. Odd number of “same” ➔ NSA is paying; even number of “same” ➔ one of them is paying
  4. But a non-payer cannot tell which of the other two is paying! This proposal guarantees information theoretic anonymity for message senders.

Correctness

Privacy

Non-Payer’s View: Same Coins

Non-Payer’s View: Different Coins

Superposed Sending

  • This idea generalizes to any group of size N
  • For each bit of the message, every user generates 1 random bit and sends it to 1 neighbor
    • Every user learns 2 bits (his own and his neighbor’s)
  • Each user announces own bit XOR neighbor’s bit
  • Sender announces own bit XOR neighbor’s bit XOR message bit
  • XOR of all announcements = message bit
    • Every randomly generated bit occurs in this sum twice (and is canceled by XOR), message bit occurs once

Dining Cryptographer-Based Anonymity is Impractical

  • Requires secure pairwise channels between group members
    • Otherwise, random bits cannot be shared
  • Requires massive communication overhead and large amounts of randomness
  • DC-net (a group of dining cryptographers) is robust even if some members collude
    • Guarantees perfect anonymity for the other members

Relevant Note(s):

Graph View