No Right to Remain Silent: Isolating Malicious Mixes Hemi Leibowitz, Bar-Ilan University, IL; Ania M

No Right to Remain Silent: Isolating Malicious Mixes Hemi Leibowitz, Bar-Ilan University, IL; Ania M. Piotrowska and George Danezis, University College London, UK; Amir Herzberg, University of Connecticut, US https://www.usenix.org/conference/usenixsecurity19/presentation/leibowitz This paper is included in the Proceedings of the 28th USENIX Security Symposium. August 14–16, 2019 • Santa Clara, CA, USA 978-1-939133-06-9 Open access to the Proceedings of the 28th USENIX Security Symposium is sponsored by USENIX. No Right to Remain Silent: Isolating Malicious Mixes Hemi Leibowitz Ania M. Piotrowska George Danezis Bar-Ilan University, Israel University College London, UK University College London, UK Amir Herzberg University of Connecticut, US Abstract network is an example of anonymity systems that protect the meta-data. Tor is currently the most popular system offering Mix networks are a key technology to achieve network anonymity, attracting almost 2 million users daily. However, anonymity and private messaging, voting and database as research has shown [47, 40, 42, 41], Tor offers limited lookups. However, simple mix network designs are vulner- security guarantees against traffic analysis. able to malicious mixes, which may drop or delay packets The need for strong anonymity systems resulted in re- to facilitate traffic analysis attacks. Mix networks with prov- newed interest in onion mixnets [12]. In an onion mixnet, able robustness address this drawback through complex and sender encrypts a message multiple times, using the public expensive proofs of correct shuffling but come at a great cost keys of the destination and of multiple mixes. Onion mixnets and make limiting or unrealistic systems assumptions. We are an established method for providing provable protec- present Miranda, an efficient mix-net design, which miti- tion against meta-data leakage in the presence of a powerful gates active attacks by malicious mixes. Miranda uses both eavesdropper, with low computational overhead. Early mix- the detection of corrupt mixes, as well as detection of faults nets suffered from poor scalability, prohibitive latency and/or related to a pair of mixes, without detection of the faulty low reliability, making them unsuitable for many practical one among the two. Each active attack – including dropping applications. However, recently, researchers have made sig- packets – leads to reduced connectivity for corrupt mixes and nificant progress in designing mixnets for high and low la- reduces their ability to attack, and, eventually, to detection of tency communication with improved scalability and perfor- corrupt mixes. We show, through experiments, the effective- mance overhead [44, 48, 13]. This progress is also visible in ness of Miranda, by demonstrating how malicious mixes are the industrial sector, with the founding of companies whose detected and that attacks are neutralized early. goal is to commercialise such systems [1, 2]. Onion mixnets offer strong anonymity against passive ad- 1 Introduction versaries: a single honest mix in a cascade is enough to en- sure anonymity. However, known mixnet designs are not ro- The increasing number of bombshell stories [27, 19, 10] re- bust against active long-term traffic analysis attacks, involv- grading mass electronic surveillance and illicit harvesting of ing dropping or delaying packets by malicious mixes. Such personal data against both ordinary citizens and high-ranking attacks have severe repercussions for privacy and efficiency officials, resulted in a surge of anonymous and private com- of mix networks. For example, a disclosure attack in which a munication tools. The increasing awareness of the fact that rogue mix strategically drops packets from a specific sender our daily online activities lack privacy, persuades many In- allows the attacker to infer with whom the sender is commu- ternet users to turn to encryption and anonymity systems nicating, by observing which recipient received fewer pack- which protect the confidentiality and privacy of their com- ets than expected [4]. Similarly, Denial-of-Service (DoS) munication. For example, services like WhatsApp and Sig- attacks can be used to enhance de-anonymization [9], and nal, which offer protection of messages through end-to-end (n−1) attacks allow to track packets over honest mixes [45]. encryption, gained popularity over the past years. However, It is challenging to identify and penalize malicious mixes such encryption hides only the content but not the meta- while retaining strong anonymity and high efficiency. Trivial data of the message, which carries a great deal of privacy- strategies for detecting malicious mixes are fragile and may sensitive information. Such information can be exploited to become vectors for attacks. Rogue mixes can either hide infer who is communicating with whom, how often and at their involvement or worse, make it seem like honest mixes what times. In contrast, the circuit-based onion routing Tor are unreliable, which leads to their exclusion from the net- USENIX Association 28th USENIX Security Symposium 1841 work. Several approaches to the problem of active attacks Overview. The rest of this paper is organized as follows. In and reliability were studied, however, they have significant Section 2, we discuss the motivation behind our work, and shortcomings, which we discuss in Section 8. define the threat model and security goals. In Section 3, we In this work, we revisit the problem of making decryption present important concepts of Miranda. In Sections 4 and 5, mix networks robust to malicious mixes performing active we detail the core protocols of Miranda, which detect and attacks. We propose Miranda1, an efficient reputation-based penalize active attacks. In Section 6, we present improved, design, that detects and isolates active malicious mixes. We community-based detection of malicious mixes. In Section 7, present security arguments that demonstrate the effective- we evaluate the security properties of Miranda against active ness of Miranda against active attacks. The architectural attacks. In Section 8, we contrast our design to related work. building blocks behind Miranda have been studied by pre- Finally, we discuss future work in Section 9 and conclude in vious research, but we combine them with a novel approach Section 10. which takes advantage of detecting failure of inter-mix links, used to isolate and disconnect corrupt mixes, in addition to direct detection of corrupt mixes. This allows Miranda to 2 The Big Picture mitigate corrupt mixes, without requiring expensive compu- tations. In this section, we outline the general model of the Miranda Miranda disconnects corrupt mixes by carefully gathering design, define the threat model, and motivate our work by evidence of their misbehavior, resulting in the removal of quantifying how active attacks threaten anonymity in mix links which are misused by the adversary. The design in- networks. Then, we summarize the security goals of Mi- cludes a set of secure and decentralized mix directory au- randa. thorities that select and distribute mix cascades once every epoch, based on the gathered evidence of the faulty links 2.1 General System Model between mixes. Repeated misbehaviors result in the com- plete exclusion of the misbehaving mixes from the system We consider an anonymous communication system consist- (see Figure 1). ing of a set of users communicating over the decryption mix We believe that Miranda is an important step toward a de- network [12] operating in synchronous batches, denoted as ployable, practical strong-anonymity system. However, Mi- rounds. Depending on the path constraints, the topology may randa design makes several significant simplifying assump- be arranged in separate cascades or a Stratified network [21]. tions. These include (1) a fixed set of mixes (no churn), (2) We denote by M the set of all mixes building the anonymous a majority of benign mixes (no Sybil), (3) reliable commu- network. For simplicity, in this work we assume that the set nication and efficient processing (even during DoS), and (4) of mixes M is fixed (no churn). See discussion in Section 9 synchronized clocks. Future work should investigate, and of this and other practical challenges. hopefully overcome, these challenges; see Section 9. Messages are end-to-end layer encrypted into a crypto- Contributions. Our paper makes the following contribu- graphic packet format by the sender, and the recipient per- tions: forms the last stage of decryption. Mixes receive packets • We present Miranda, an efficient, low-cost and scalable within a particular round, denoted by r. Each mix decodes novel design that detects and mitigates active attacks. To a successive layer of encoding and shuffles all packets ran- protect against such attacks, we leverage reputation and domly. At the end of the round, each mix forwards all pack- local reports of faults. The Miranda design can be inte- ets to their next hops. Changing the binary pattern of packets grated with other mix networks and anonymous commu- by removing a single layer of encryption prevents bit-wise nication designs. correlation between incoming and outgoing packets. More- • We propose an encoding for secure loop messages, that over, mixing protects against an external observer, by obfus- may be used to securely test the network for dropping at- cating the link between incoming and outgoing packets. tacks – extending traditional mix packet formats for veri- Message packet format. In this paper, we use the Sphinx fiability.

Load more