Quantitative Anonymity Guarantees for Tor

Saarland University Faculty of Mathematics and Computer Science Quantitative Anonymity Guarantees for Tor Dissertation zur Erlangung des Grades des Doktors der Ingenieurwissenschaften der Fakultät fürMathematik und Informatik der Universitätdes Saarlandes von Sebastian Wilhelm Ludwig Meiser Saarbrücken, Februar 2016 Day of Colloquium 23. November 2016 Dean of the faculty Prof. Dr. Frank-Olaf Schreyer Chair of the Committee Prof. Dr. Christian Rossow Reviewers Prof. Dr. Michael Backes Prof. Aniket Kate, Ph.D. Dr. George Danezis Academic Assistant Dr. Robert Künnemann ii Zusammenfassung In dieser Arbeit präsentieren wir eine neue Methode, um beweisbar sichere Anony- mitätsgarantien fürProtokolle zur anonymen Kommunikation zu geben und veran- schaulichen die Anwendung dieser Methode anhand des Tor Protokolls. Zu diesem Zweck präsentieren wir zunächst das AnoA Framework, welches dazu dient, die Anony- mitätvon Protokollen zur anonymen Kommunikation zu quantifizieren. Der Angreifer, der in AnoA betrachtet wird, ist modular konfigurierbar. Wir zeigen, wie das Tor Protokoll in einer abstrakten Weise analysiert werden kann und greifen hierbei auf eine existierende Formalisierung von Tor im Universal Composibility (UC) Frame- work zurück. Wir beweisen, dass unsere abstrakten Betrachtungen sichere Garantien ergeben. Darüber hinaus entwickeln wir effizient berechenbare und beweisbar sichere Formeln, mit denen sich die Sicherheit von Tor gegenüber von Angreifern, die entweder durch Besitz eigener Tor Server oder durch eine Uberwachung¨ der Kommunikation, auf eine passive Art versuchen, die Anonymitätzu brechen. Letztlich führenwir eine umfassende Analyse des Tor Netzwerks durch und berechnen die Anonymität,die Tor gegen eine Vielzahl solcher Angreifer zur Verfügung stellt, basierend auf den technischen Eigenschaften von Tor's Pfadsuchalgorithmus (und einigen Alternativen). iii iv Abstract In this thesis, we present a methodology to compute sound anonymity guarantees for anonymous communication protocols, which we apply to the Tor protocol. To this end, we present AnoA, a formal framework for quantifying the anonymity of anonymous communication protocols against modularly describable adversaries. We show how the Tor protocol can be analyzed in an abstract way by utilizing an existing formalization of Tor in the universal composability (UC) framework and prove that this analysis is sound. Moreover, we derive efficiently computable, sound anonymity guarantees for Tor against eavesdropping adversaries that may control Tor servers or wiretap communica- tions between parties. For known adversaries that perform perfect traffic correlations we show that our bounds are tight. Finally, we perform an extensive analysis of the Tor network against such adversaries in which we calculate the anonymity of Tor when using Tor's current path selection, thereby considering many real-world properties of the path selection algorithm, as well as when using one of several variants, against a variety of eavesdropping adversaries that can control Tor nodes (depending on various properties) or wiretap the communication between them. v vi Acknowledgments Sufficiently acknowledging all people that positively influenced me during my doctoral studies is certainly a hard task. I will try to keep these words brief and hope to not offend in doing so. I want to thank my supervisor Michael Backes for his support, for the various explicit and implicit lessons in these past years and for giving me suffi- cient freedom in my research agenda. I obviously want to thank all my colleagues with which I worked together in these past years, foremost Esfandiar Mohammadi; I enjoyed our discussions, the invention of our grand board game, and, being able to call you a friend. Moreover, I want to thank Aniket Kate for his undying optimism regarding our projects, as well as for the foresight in striving for such types of guarantees. I want to thank Dominique Unruh for teaching me the art of designing definitions and proofs and Tim Ruffing for all helpful discussions. Concerning the line of research started by this thesis I want to thank all students and internship students that I had the pleasure to supervise (in almost alphabetical order): Markus Bauer, who both helped in fixing the implementation of MATor and who as his Bachelor's thesis developed a MATor plugin for the Tor browser, Simon Koch, who successfully battled parenthesis to perform a large-scale data collection for our network- infrastructure adversaries, Tahleen Rahman who had the bravery to delve into the depths of Tor's C-implementation and who extended this dissertation in her Master's thesis by modeling adversaries that add new Tor nodes to the consensus, Marcin Slowik who significantly contributed to more than one refactoring of MATor and with whom I had helpful discussions about the nature and generality of adversarial advantages, Lukas Wedeking, who as his Bachelor's thesis analyzed the impact of adversaries on Tor's hidden services on basis of this dissertation, and finally Marta Wrzola and Dawid Gawel who in their internship contributed to the final refactoring of MATor. I also want to thank the Cognition and Action research group of Prof. Dirk Wentura, as well as Prof. Christian Frings for giving me insights into psychology and pragmatism when solving problems, as well as for their encouraging discussions concerning my doctoral studies. Finally, I want to thank my family for their support and my friends for the countless hours of stress-relieving pen-and-paper games. For Science. vii viii Background of this Dissertation This dissertation is based on three peer-reviewed papers that have been accepted at influential and well-ranked conferences in the field of computer security, in each of which the author contributed as one of the main authors. In addition, the author was the main author of other peer-reviewed papers in the field of cryptography and information security [11, 10] and one of the main authors of a paper slightly related to the foundation of this thesis [16]. However, this dissertation focuses on the following four papers, as this selection defines a novel and very promising line of work. The author considers a thorough and consistent presentation that partially improves upon the original works to be significantly more useful to the research community than less consistent presentation that additionally covers the papers mentioned above. In AnoA [13] (published at CSF'13), as well as in the extended technical report • and the journal version (to be published in a special issue of the Journal of Privacy and Confidentiality), the author contributed significantly to the central notions of the framework, whereas a preliminary and abstract analysis of the Tor network (which is not included here) was mainly done by Praveen Manoharan. The central notion of IND-CDP is influenced by the papers \Computational Differen- tial Privacy" [81] of Mironov et. al, and \Secrecy without Perfect Randomness: Cryptography with (Bounded) Weak Sources" [16] in which the author also contributed as one of the main authors. The adaptations of the UC protocol to the AnoA framework were performed by Esfandiar Mohammadi. Praveen and Es- fandiar also worked on the UC-realization of differential-privacy style properties, which is a central building block for AnoA. In the paper \(Nothing Else) MATor(s)" [14] (published at CCS'14), the author • contributed as one of the main authors. Together with Esfandiar Mohammadi, he investigated how the actual Tor client implements Tor's current path selection algorithm, as well as the impact of these subtle choices on Tor's anonymity. More- over, they investigated the impact of TCP ports and derived sound formulas for calculating anonymity guarantees for Tor. The author additionally contributed to the implementation of MATor, a tool used for calculating Tor's anonymity that forms the foundation of all implementations considered for the evaluations in this thesis. In \Your choice MATor(s)" [12] (published at PETS'16), the author was the main • author and driving force. The author contributed by defining a novel, observation based analysis for calculating the anonymity guarantees, that is significantly more precise than the heuristics used before. The necessary modifications and the par- tial re-implementation of the analysis tool MATor, however, was done by Marcin Slowik, who worked under the author's direct supervision and the evaluation was designed and performed by both authors. ix x Finally, in a paper we are currently working on that is targeted at analyzing • the impact of network-level adversaries on Tor, the author contributed mainly to the theoretical foundations by defining a novel, observation based analyses of the calculation of our anonymity guarantees, together with the proofs on its correctness. The gathering of data was performed by Simon Koch, Tor's Internet topology was developed by the author together with Esfandiar Mohammadi and Christian Rossow. As an additional effort for this thesis, the individual papers have been combined into one consistent analysis of Tor that includes a novel formalization of a simplified AnoA game for Tor against eavesdropping adversaries. To this end, the majority of proofs has been revised, the analysis tool MATor has been re-factored and we repeated our large-scale formal evaluation of Tor against eavesdroppers. Contents 1 Introduction 1 1.1 Contribution . .2 1.2 Overview . .4 1.2.1 Anonymity and Privacy . .5 1.2.2 Intuition: Indistinguishability Based Anonymity . .6 1.2.3 The Tor Protocol . 10 1.2.4 From Observations of an Eavesdropper to Anonymity Guarantees 13 1.2.5 Defining Categories of Eavesdroppers . 14 1.2.6 Evaluating Tor Against Eavesdroppers . 16 1.3 Related Work . 16 1.3.1 Anonymous Communication Protocols . 17 1.3.2 Practical Attacks and Countermeasures . 18 1.3.3 Anonymity Analyses . 18 2 AnoA 23 2.1 Notation . 23 2.2 Full AnoA Game . 24 2.3 Anonymity Notions . 27 2.3.1 Sender Anonymity . 28 2.3.2 Recipient Anonymity .

Load more