1. Constructing Onions

2. Content • Onion routing principals • Tor: The second generation Onion Router • Overall design • Circuit construction • Proposed improvement on circuit construction of onion routing • “Pairing-Based Onion Routing”, Aniket Kate and others, Centre for Applied Cryptographic Research, University of Waterloo, 2007

3. Onion routing principals • Hide message source by routing it randomly • Popular technique: Crowds, Onion Routing • Routers don’t know for sure if the apparent source of a message is the true sender or another router • Only secure against local attackers!

4. Onion routing principals R R R4 R R3 R R1 R R2 Alice R Bob • Sender chooses a random sequence of routers • Some routers are honest, some hostile • Sender controls the length of the path • Goal: hostile routers shouldn’t learn that Alice is talking to Bob

5. Onion routing principals R2 R4 Alice R3 Bob R1 {M}pk(B) {B,k4}pk(R4),{ }k4 {R4,k3}pk(R3),{ }k3 {R3,k2}pk(R2),{ }k2 {R2,k1}pk(R1),{ }k1 • Routing info for each link encrypted with router’s public key • Each router learns only the identity of the next router

6. Tor: The second generation Onion Router • Tor aim is to resist observers and insiders by distributing each transaction over several nodes in the network • Tor works on the real-world Internet, requires little synchronization • There are roughly 420 onion routers that forward at least 5KB per seconds (2007)

7. Tor: The second generation Onion Router • Component • Directory server is to provide information about available onion routers to the user • Rendezvous point is to provide anonymity for server • Introduction points allow server to advertise them as contact point • Onion Router is the building block of the circuits • Onion Proxy is the client part of the network that injects the user’s traffic into the network

8. Overall design

9. Circuit construction in TOR

10. Pairing-Based Onion Routing • Pairing-based privacy-preserving non-interactive key exchange • Instead of iteratively and interactively constructing circuits with a telescoping method used in Tor, it builds the circuit with a single pass • Provides practical forward secrecy with less computation and communication • Leads to a reduction in amount of authenticated directory information

11. Pairing-Based Onion Routing

12. Pairing-Based Onion Routing • Setup • PKG generates a digital signature key pair • Generate prime number n and two group G and GT of order n • Define full domain cryptographic hash function • Key generation • PKG generates master key • Generates prime number and calculates • PKG generates private key and send it with the signed to the appropriate OR • User setup • Computes for chosen OR

13. Pairing-Based Onion Routing • Circuit construction at client side • User chooses set of ORs randomly • Computes pseudonym for each OR • Computes the value • Derive forward session key and backward session key • Build onion as where is symmetric key encryption • OR • Compute by using received and its currently valid private key • Derive forward session key and backward session key

14. Pairing-Based Onion Routing

15. Pairing-Based Onion Routing The timings were gathered on 3.0Ghz Pentium D desktop using the PBC pairing based cryptography library

16. Conclusion • Total computation time to construct a circuit of length l is 61% less on the client side and 49% less on the server side as compared to the current Tor system • Uses only linear number of AES-encrypted message, while Tor uses a quadratic number • Uses less computationand communication than the corresponding protocol in Tor • Single pass providing forward secrecy

17. Thank you