This paper presents Riposte, a new system for anonymous broadcast messaging. Riposte is the first such system, to our knowledge, that simultaneously protects against traffic-analysis attacks, prevents anonymous denial-of-service by malicious clients, and scales to million-user anonymity sets. To achieve these properties, Riposte makes novel use of techniques used in systems for private information retrieval and secure multi-party computation. For latency-tolerant workloads with many more readers than writers (e.g. Twitter, Wikileaks), we demonstrate that a three-server Riposte cluster can build an anonymity set of 2,895,216 users in 32 hours.
David Chaum's cascade'' mix networks were one of the first systems devised with the specific goal of defending against traffic-analysis attacks @cite_65 . Since then, there have been a number of mix-net-style systems proposed, many of which explicitly weaken their protections against a near omni-present adversary @cite_64 to improve prospects for practical usability (i.e., for email traffic) @cite_35 . In contrast, attempts to provide very strong anonymity guarantees at the price of usability for interactive applications.
@cite_35 @cite_64 @cite_65
2150248082 1486928190 2103647628
We present Mixminion, a message-based anonymous remailer protocol with secure single-use reply blocks. Mix nodes cannot distinguish Mixminion forward messages from reply messages, so forward and reply messages share the same anonymity set. We add directory servers that allow users to learn public keys and performance statistics of participating remailers, and we describe nymservers that provide long-term pseudonyms using single-use reply blocks as a primitive. Our design integrates link encryption between remailers to provide forward anonymity. Mixminion works in a real-world Internet environment, requires little synchronization or coordination between nodes, and protects against known anonymity-breaking attacks as well as or better than other systems with similar design parameters. The previous talk was about trying to get entropy, and I’m going to talk about ignoring entropy. It’s natural to talk about anonymity in a workshop about brief encounters and security protocols, I would say anonymity is the quintessence of brief encounter, you only have a brief encounter if in fact you are anonymous, so you need to be anonymous to guarantee that it is brief, otherwise it is at best pseudonymous, because you’re preserving state from one instance of communication to another. A technique based on public key cryptography is presented that allows an electronic mail system to hide who a participant communicates with as well as the content of the communication - in spite of an unsecured underlying telecommunication system. The technique does not require a universally trusted authority. One correspondent can remain anonymous to a second, while allowing the second to respond via an untraceable return address. The technique can also be used to form rosters of untraceable digital pseudonyms from selected applications. Applicants retain the exclusive ability to form digital signatures corresponding to their pseudonyms. Elections in which any interested party can verify that the ballots have been properly counted are possible if anonymously mailed ballots are signed with pseudonyms from a roster of registered voters. Another use allows an individual to correspond with a record-keeping organization under a unique pseudonym, which appears in a roster of acceptable clients.