A Formal Analysis of Onion Routing 10/26/2007

1. A Formal Analysis of Onion Routing10/26/2007 Aaron Johnson (Yale) with Joan Feigenbaum (Yale) Paul Syverson (NRL)

2. Papers • A Model of Onion Routing with Provable AnonymityFinancial Cryptography and Data Security 2007 • A Probabilistic Analysis of Onion Routing in a Black-box ModelWorkshop on Privacy in the Electronic Society 2007

3. Anonymous Communication • Sender anonymity: Adversary can’t determine the sender of a given message • Receiver anonymity: Adversary can’t determine the receiver of a given message • Relationship anonymity: Adversary can’t determine who talks to whom

4. Anonymous Communication • Sender anonymity: Adversary can’t determine the sender of a given message • Receiver anonymity: Adversary can’t determine the receiver of a given message • Relationship anonymity: Adversary can’t determine who talks to whom

5. How Onion Routing Works 1 2 u d 3 5 User u running client Internet destination d 4 Routers running servers

6. How Onion Routing Works 1 2 u d 3 5 4 • u creates 3-hop circuit through routers

7. How Onion Routing Works 1 2 u d 3 5 4 • u creates 3-hop circuit through routers

8. How Onion Routing Works 1 2 u d 3 5 4 • u creates 3-hop circuit through routers

9. How Onion Routing Works 1 2 u d 3 5 4 • u creates 3-hop circuit through routers • u opens a stream in the circuit to d

10. How Onion Routing Works {{{m}3}4}1 1 2 u d 3 5 4 • u creates 3-hop circuit through routers • u opens a stream in the circuit to d • Data is exchanged

11. How Onion Routing Works 1 2 u d 3 5 {{m}3}4 4 • u creates 3-hop circuit through routers • u opens a stream in the circuit to d • Data is exchanged

12. How Onion Routing Works 1 2 u d 3 5 {m}3 4 • u creates 3-hop circuit through routers • u opens a stream in the circuit to d • Data is exchanged

13. How Onion Routing Works 1 2 u m d 3 5 4 • u creates 3-hop circuit through routers • u opens a stream in the circuit to d • Data is exchanged

14. How Onion Routing Works 1 2 u d m’ 3 5 4 • u creates 3-hop circuit through routers • u opens a stream in the circuit to d • Data is exchanged

15. How Onion Routing Works 1 2 u d 3 5 4 {m’}3 • u creates 3-hop circuit through routers • u opens a stream in the circuit to d • Data is exchanged

16. How Onion Routing Works 1 2 u {{m’}3}4 d 3 5 4 • u creates 3-hop circuit through routers • u opens a stream in the circuit to d • Data is exchanged

17. How Onion Routing Works 1 2 {{{m’}3}4}1 u d 3 5 4 • u creates 3-hop circuit through routers • u opens a stream in the circuit to d • Data is exchanged

18. How Onion Routing Works 1 2 u d 3 5 4 • u creates 3-hop circuit through routers • u opens a stream in the circuit to d • Data is exchanged. • Stream is closed.

19. How Onion Routing Works 1 2 u d 3 5 4 • u creates 3-hop circuit through routers • u opens a stream in the circuit to d • Data is exchanged. • Stream is closed. • Circuit is changed every few minutes.

20. Results

21. Results • Formally model onion routing using input/output automata

22. Results • Formally model onion routing using input/output automata • Analyze relationship anonymity • Characterize situations with possibilistic anonymity • Bound probabilistic anonymity in worst-case and typical situations

23. Related Work • A Formal Treatment of Onion RoutingJan Camenisch and Anna LysyanskayaCRYPTO 2005 • A formalization of anonymity and onion routingS. Mauw, J. Verschuren, and E.P. de VinkESORICS 2004 • Towards an Analysis of Onion Routing SecurityP. Syverson, G. Tsudik, M. Reed, and C. LandwehrPET 2000

24. Model • Constructed with I/O automata • Models asynchrony • Relies on abstract properties of cryptosystem • Simplified onion-routing protocol • No key distribution • No circuit teardowns • No separate destinations • Each user constructs a circuit to one destination • Circuit identifiers

25. Automata Protocol u v w

26. Automata Protocol u v w

27. Automata Protocol u v w

28. Automata Protocol u v w

29. Automata Protocol u v w

30. Automata Protocol u v w

31. Automata Protocol u v w

32. Automata Protocol u v w

33. Automata Protocol u v w

34. Automata Protocol u v w

35. Creating a Circuit u 1 2 3

36. Creating a Circuit [0,{CREATE}1] u 1 2 3 • CREATE/CREATED

37. Creating a Circuit u 1 2 3 [0,CREATED] • CREATE/CREATED

38. Creating a Circuit u 1 2 3 • CREATE/CREATED

39. Creating a Circuit [0,{[EXTEND,2,{CREATE}2]}1] u 1 2 3 • CREATE/CREATED • EXTEND/EXTENDED

40. Creating a Circuit [l1,{CREATE}2] u 1 2 3 • CREATE/CREATED • EXTEND/EXTENDED

41. Creating a Circuit u 1 2 3 [l1,CREATED] • CREATE/CREATED • EXTEND/EXTENDED

42. Creating a Circuit u 1 2 3 [0,{EXTENDED}1] • CREATE/CREATED • EXTEND/EXTENDED

43. Creating a Circuit [0,{{[EXTEND,3,{CREATE}3]}2}1] u 1 2 3 • CREATE/CREATED • EXTEND/EXTENDED • [Repeat with layer of encryption]

44. Creating a Circuit [l1,{[EXTEND,3,{CREATE}3]}2] u 1 2 3 • CREATE/CREATED • EXTEND/EXTENDED • [Repeat with layer of encryption]

45. Creating a Circuit [l2,{CREATE}3] u 1 2 3 • CREATE/CREATED • EXTEND/EXTENDED • [Repeat with layer of encryption]

46. Creating a Circuit u 1 2 3 [l2,CREATED] • CREATE/CREATED • EXTEND/EXTENDED • [Repeat with layer of encryption]

47. Creating a Circuit u 1 2 3 [l1,{EXTENDED}2] • CREATE/CREATED • EXTEND/EXTENDED • [Repeat with layer of encryption]

48. Creating a Circuit u 1 2 3 [0,{{EXTENDED}2}1] • CREATE/CREATED • EXTEND/EXTENDED • [Repeat with layer of encryption]

49. Adversary 1 2 u d 3 5 4 Active & Local

50. Possibilistic Anonymity