On the limits of provable anonymity

Gelernter, Nethanel; Herzberg, Amir

doi:10.1145/2517840.2517850

Cited by 21 publications

(28 citation statements)

References 39 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…We formalize this in the following definition, where we also use '_' to declare that this part of a tuple can be any value. 11 11 E.g. ∃(u, m, _) ∈ r will be true iff ∃u : ∃(u, m, u ) ∈ r.…”

Section: Protocol-dependent: Sessionsmentioning

confidence: 99%

See 1 more Smart Citation

On Privacy Notions in Anonymous Communication

Kuhn

Beck

Schiffner

et al. 2019

Proceedings on Privacy Enhancing Technologies

View full text Add to dashboard Cite

Many anonymous communication networks (ACNs) with different privacy goals have been developed. However, there are no accepted formal definitions of privacy and ACNs often define their goals and adversary models ad hoc. However, for the understanding and comparison of different flavors of privacy, a common foundation is needed. In this paper, we introduce an analysis framework for ACNs that captures the notions and assumptions known from different analysis frameworks. Therefore, we formalize privacy goals as notions and identify their building blocks. For any pair of notions we prove whether one is strictly stronger, and, if so, which. Hence, we are able to present a complete hierarchy. Further, we show how to add practical assumptions, e.g. regarding the protocol model or user corruption as options to our notions. This way, we capture the notions and assumptions of, to the best of our knowledge, all existing analytical frameworks for ACNs and are able to revise inconsistencies between them. Thus, our new framework builds a common ground and allows for sharper analysis, since new combinations of assumptions are possible and the relations between the notions are known.

show abstract

Section: Protocol-dependent: Sessionsmentioning

confidence: 99%

“…Gelernter and Herzberg [11] extend Hevia's framework to include corrupted participants. Additionally, they show that under this strong adversary an ACN protocol achieving the strongest notions exists.…”

Section: Gelernter's Frameworkmentioning

confidence: 99%

On Privacy Notions in Anonymous Communication

Kuhn

Beck

Schiffner

et al. 2019

Proceedings on Privacy Enhancing Technologies

View full text Add to dashboard Cite

show abstract

“…Building on the work of Hevia and Micciancio (2008), Gelernter and Herzberg published, concurrently with this work, an expressive framework that extends the work of Hevia and Micciancio with active adversaries that adaptively send inputs (Gelernter and Herzberg, 2013). They apply their methodology to obtain an impossibility result for a strong combination of sender anonymity and unobservability, which they coin "ultimate anonymity".…”

Section: Related and Prior Workmentioning

confidence: 99%

AnoA: A Framework for Analyzing Anonymous Communication Protocols

Backes

Kate

Manoharan

et al. 2017

JPC

View full text Add to dashboard Cite

Abstract. Anonymous communication (AC) protocols such as the widely used Tor network have been designed to provide anonymity over the Internet to their participating users. While AC protocols have been the subject of several security and anonymity analyses in the last years, there still does not exist a framework for analyzing these complex systems and their different anonymity properties in a unified manner.In this work we present AnoA: a generic framework for defining, analyzing, and quantifying anonymity properties for AC protocols. In addition to quantifying the (additive) advantage of an adversary in an indistinguishability-based definition, AnoA uses a multiplicative factor, inspired from differential privacy. AnoA enables a unified quantitative analysis of well-established anonymity properties, such as sender anonymity, sender unlinkability, and relationship anonymity. AnoA modularly specifies adversarial capabilities by a simple wrapper-construction, called adversary classes. We examine the structure of these adversary classes and identify conditions under which it suffices to establish anonymity guarantees for single messages in order to derive guarantees for arbitrarily many messages. This then leads us to the definition of Plug'n'Play adversary classes (PAC), which are easy-to-use, expressive, and satisfy this condition. We prove that our framework is compatible with the universal composability (UC) framework and show how to apply AnoA to a simplified version of Tor against passive adversaries, leveraging a recent realization proof in the UC framework.

show abstract

“…Previous mathematically founded analyses abstract the Tor network by ignoring characteristics of Tor, such as the path selection algorithm, the varying entrusted bandwidth of different Tor nodes, or the user's requested ports [6,[15][16][17][18]21]. However, these real-life characteristics of Tor significantly influence a user's anonymity, which renders the previously proven bounds inaccurate.…”

Section: Introductionmentioning

confidence: 99%

“…The first line of work assumes a worst case adversary and proves rigorous anonymity bounds for Tor users [6,[15][16][17][18]21]. These pieces of work, however, abstract the Tor network by ignoring characteristics of Tor that significantly influence a user's anonymity, such as the path selection algorithm, the varying entrusted bandwidth of different Tor nodes, or the user's requested ports.…”

Section: Introductionmentioning

confidence: 99%

(Nothing else) MATor(s)

Backes

Kate

Meiser

et al. 2014

Proceedings of the 2014 ACM SIGSAC Conference on Computer and Communications Security

View full text Add to dashboard Cite

In this paper we present MATOR: a framework for rigorously assessing the degree of anonymity in the Tor network. The framework explicitly addresses how user anonymity is impacted by real-life characteristics of actually deployed Tor, such as its path selection algorithm, Tor consensus data, and the preferences and the connections of the user. The anonymity assessment is based on rigorous anonymity bounds that are derived in an extension of the ANOA framework (IEEE CSF 2013). We show how to apply MATOR on Tor's publicly available consensus and server descriptor data, thereby realizing the first real-time anonymity monitor. Based on experimental evaluations of this anonymity monitor on Tor Metrics data, we propose an alternative path selection algorithm that provides stronger anonymity guarantees without decreasing the overall performance of the Tor network.

show abstract

On the limits of provable anonymity

Cited by 21 publications

References 39 publications

On Privacy Notions in Anonymous Communication

On Privacy Notions in Anonymous Communication

AnoA: A Framework for Analyzing Anonymous Communication Protocols

(Nothing else) MATor(s)

Contact Info

Product

Resources

About