Provable Unlinkability Against Traffic Analysis with Low Message Overhead

Abstract

Rackoff and Simon proved that a variant of Chaum's protocol for anonymous communication, later developed as the Onion Routing Protocol, is unlinkable against a passive adversary that controls all communication links and most of the nodes in a communication system. A major drawback of their analysis is that the protocol is secure only if (almost) all nodes participate at all times. That is, even if only n N nodes wish to send messages, all N nodes have to participate in the protocol at all times. This suggests necessity of sending dummy messages and a high message overhead.Our first contribution is showing that this is unnecessary. We relax the adversary model and assume that the adversary only controls a certain fraction of the communication links in the communication network. We think this is a realistic adversary model.

Breaking and (Partially) Fixing Provably Secure Onion Routing

“…Hence, for this analysis we need to exclude attacks that result in dropping or delaying onions. 6 Given this adversary model 7 we are able to prove the privacy goals expected for OR.…”

“…[1], [3], [28], [29], [31] state that this translates to the degree of anonymity Tor provides, although [15], [18] argue that it is not applicable for Tor. [4] states that it "hide(s) the source and destination over a network," [27] even understood it as "a concrete ZK proof of senders' knowledge of their messages" and [6] as "provable reduction from unlinkability to traffic analysis." [19] states that the privacy is "that an adversary cannot correctly guess relations between incoming messages and outgoing messages at onion routers, and [...] that each onion router cannot know the whole route path of any onion."…”

“…First, no one ever analyzed the privacy this ideal OR functionality actually achieves, to start with. Many papers [1], [3], [4], [6], [15], [17]- [19], [26]- [28], [30] citing it disagree violently on this point. As our first contribution towards solving the matter, we analyze the ideal functionality.…”