Security Analysis of Accountable Anonymity in Dissent

Abstract

Users often wish to communicate anonymously on the Internet, for example in group discussion or instant messaging forums. Existing solutions are vulnerable to misbehaving users, however, who may abuse their anonymity to disrupt communication. Dining Cryptographers Networks (DC-nets) leave groups vulnerable to denial-of-service and Sybil attacks, mix networks are difficult to protect against traffic analysis, and accountable voting schemes are unsuited to general anonymous messaging.DISSENT is the first general protocol offering provable anonymity and accountability for moderate-size groups, while efficiently handling unbalanced communication demands among users. We present an improved and hardened DISSENT protocol, define its precise security properties, and offer rigorous proofs of these properties. The improved protocol systematically addresses the delicate balance between provably hiding the identities of well-behaved users, while provably revealing the identities of disruptive users, a challenging task because many forms of misbehavior are inherently undetectable. The new protocol also addresses several non-trivial attacks on the original DISSENT protocol stemming from subtle design flaws.

P2P Mixing and Unlinkable Bitcoin Transactions

“…A Generic Attack on P2P Mixing Protocols: As our fourth contribution, we present a deanonymization attack on existing P2P mixing protocols that guarantee termination in the presence of disruptive peers. We exemplify the attack on the Dissent shuffle protocol [23], [56] and then generalize the attack to demonstrate that no P2P mixing protocol simultaneously supports arbitrary input messages, provides anonymity, and terminates in the presence of disruptive peers.…”

“…An important guarantee provided by DiceMix is that if a protocol run fails, the honest peers agree on the set of malicious peers to be excluded. Although this is critical for termination, this aspect has not been properly formalized or addressed in some previous P2P mixing protocols supposed to ensure termination [23], [53], [56].…”

“…We illustrate the attack on the Dissent shuffle protocol [23], [56]. 5 In the last communication round of the Dissent shuffle protocol, every peer publishes a decryption key.…”

“…2) DiceMix Protocol: Although some DC-net successors [31], [42] as well as some anonymous group messaging systems [23], [53], [56] satisfy the P2P mixing requirements, we found those to be too inefficient for large-scale mixing. As our second contribution, we present the new P2P mixing protocol DiceMix, which builds on the original DC-net protocol.…”

Seeking anonymity in an internet panopticon

“…Dissent builds on anonymity primitives that have formal security proofs in a model where the attacker is assumed to monitor all network traffic sent among all participating nodes but cannot break the encryption. We have extended these formal security proofs to cover the first version of the full Dissent protocol [21], and formal analysis of subsequent versions is in progress. Although verifiable shuffles differ from DC-nets in their details, both approaches share one key property that enables formal anonymity proofs: All participants act collectively under a common "control plane" rather than individually as in an ad hoc OR system.…”