What's a Little Leakage Between Friends?

Abstract

This paper introduces a new attack on recent messaging systems that protect communication metadata. The main observation is that if an adversary manages to compromise a user's friend, it can use this compromised friend to learn information about the user's other ongoing conversations. Specifically, the adversary learns whether a user is sending other messages or not, which opens the door to existing intersection and disclosure attacks. To formalize this compromised friend attack, we present an abstract scenario called the exclusive call center problem that captures the attack's root cause, and demonstrates that it is independent of the particular design or implementation of existing metadata-private messaging systems. We then introduce a new primitive called a private answering machine that can prevent the attack. Unfortunately, building a secure and efficient instance of this primitive under only computational hardness assumptions does not appear possible. Instead, we give a construction under the assumption that users can bound their maximum number of friends and are okay leaking this information.

SoK: Metadata-Protecting Communication Systems

“…We focus on the global adversary threat model as that is the real-world adversary to combat today in the context of MPCS. We include systems that are secure even when a client's correspondent is adversarial and those that are not [6].…”

“…Atom uses the square network by Håstad [34], which can permute 𝑚 elements using √ 𝑚 nodes with each shuffling √ 𝑚 ciphertexts and connects to √ 𝑚 nodes in the subsequent layer. 6 In Atom each logical server in this network is realized by a group of physical servers such that the anytrust assumption holds over the group. The number of servers in each group is tuned to ensure that given the total number of servers, and knowledge that up to a bounded fraction of them can be malicious, at least one server in each group should be honest with very high probability.…”

“…They assume honesty of a particular server (as opposed to any one server of a pool like anytrust), and the defence fails if that server is adversarial. This leads us to use the term heuristic security 6. This network only requires constant iterations of mixing to produce a near-uniform random permutation, and in their work they use 10 iterations of mixing.…”

Private resource allocators and their applications

“…Prior works on MPMs have shown that the proposed contact discovery, add-friend, dialing, and conversation protocols are secure and leak little information (negligible or bounded) on their own, but surprisingly, none had carefully looked at their composition. Indeed, recent work by Angel et al [9] shows that existing dialing and communication protocols do not actually compose in the presence of compromised friends. The reason is that the number of communication channels (k) is usually smaller than the number of friends that could dial the user at any one time.…”

“…This is significant because MPMs are designed precisely to avoid side-channel attacks. In particular, Angel et al [9] show that these systems are secure only if none of the contacts with whom a user communicates are compromised by an adversary; otherwise, compromised contacts can learn information about the user's other conversations. We expand on Angel et al's observation in Section II, and show that it is an instance of an allocation-based side-channel attack.…”