Low-latency mix networks for anonymous communication Ania M. Piotrowska A dissertation submitted in partial fulfillment of the requirements for the degree of Doctor of Philosophy of University College London. Department of Computer Science University College London 2020 2 3 I, Ania M. Piotrowska, confirm that the work presented in this thesis is my own. Where information has been derived from other sources, I confirm that this has been indicated in the work. To George Abstract Every modern online application relies on the network layer to transfer information, which exposes the metadata associated with digital communication. These distinc- tive characteristics encapsulate equally meaningful information as the content of the communication itself and allow eavesdroppers to uniquely identify users and their activities. Hence, by exposing the IP addresses and by analyzing patterns of the network traffic, a malicious entity can deanonymize most online communications. While content confidentiality has made significant progress over the years, existing solutions for anonymous communication which protect the network metadata still have severe limitations, including centralization, limited security, poor scalability, and high-latency. As the importance of online privacy increases, the need to build low-latency communication systems with strong security guarantees becomes nec- essary. Therefore, in this thesis, we address the problem of building multi-purpose anonymous networks that protect communication privacy. To this end, we design a novel mix network Loopix, which guarantees commu- nication unlinkability and supports applications with various latency and bandwidth constraints. Loopix offers better security properties than any existing solution for anonymous communications while at the same time being scalable and low-latency. Furthermore, we also explore the problem of active attacks and malicious infrastruc- ture nodes, and propose a Miranda mechanism which allows to efficiently mitigate them. In the second part of this thesis, we show that mix networks may be used as a building block in the design of a private notification system, which enables fast and low-cost online notifications. Moreover, its privacy properties benefit from an increasing number of users, meaning that the system can scale to millions of clients at a lower cost than any alternative solution. Impact statement The results presented in this thesis make significant steps towards the design and study of anonymous communication systems. More specifically, this dissertation introduces novel designs for anonymous communication networks, techniques to evaluate their privacy properties, as well as mechanisms to enhance them. More- over, the presented research has set in motion the development of open-source soft- ware and the deployment of a privacy infrastructure that allows users to control their information about their online activities. We have designed Loopix (Chapter 3), a novel design of a low-latency anony- mous communication system based on mix networks, which offers stronger security properties than the existing tools. Our design ensures metadata privacy even in the presence of powerful adversaries, yet, thanks to its scalability and performance fea- tures, is suitable for many real-time applications. Following the publication of this work in USENIX Security ’17, PANORAMIX adopted Loopix as its core infrastruc- ture design for an anonymous low-latency messaging system, the Katzenpost free software project.1 Along with the project partners and developers, we released the open access specifications of the Katzenpost design and it’s open-source implemen- tation.2,3 Furthermore, we showed how Loopix can be used to add network-level privacy for privacy focussed cryptocurrencies like Zcash in [1], which was later also added to Katzenpost [2]. We have also designed, in collaboration with the Bar-Ilan University and the University of Connecticut, the Miranda mechanism (Chapter 4), inspired during the development of Loopix, which aims to tackle a common problem in anony- mous communications systems, i.e. how to detect and exclude malicious infrastruc- ture mixes. Miranda allows the system users to detect and isolate active malicious mixes in an efficient and scalable way, without the need for computationally expen- sive cryptographic techniques. Our work introduces also interesting ideas for more 1PANORAMIX European project was a joined initiative of leading academic centres and indus- trial partners, whose aim was to develop an infrastructure for secure communications based on mix networks (https://panoramix.me/). 2https://katzenpost.mixnetworks.org/docs/specs.html 3https://github.com/katzenpost/ iv Impact statement efficient detection of corrupted nodes using community detection techniques, and opens practical research questions that are likely to lead to further improvements. The result of our work was presented in USENIX Security ’19. The last technical chapter of this work introduces AnNotify (Chapter 5), a novel private notification system, which scales to millions of users at a low band- width and performance cost. Therefore, AnNotify can be used as an alternative to traditional PIR or privacy-preserving presence systems like DP5. This work was a result of collaboration with Bar-Ilan University and was presented in WPES ’17. The work presented in this thesis and development of Katzenpost is now fur- ther adopted and continued by the Nym Technologies company.4 As part of Nym Technologies team, I have a chance to apply my academic and industrial experience by contributing to both research and development of the decentralized and incen- tivized privacy-enhancing infrastructure. 4https://nymtech.net/ Acknowledgements This PhD has been a truly life-changing experience and it would not have been possible to do without the support and guidance that I received from many people. First of all, I would like to thank my supervisor George Danezis for his time and guidance over the past years, and all of his advice. I am especially thankful for always encouraging me to explore new challenges, even those outside my comfort zone, and for teaching me to be an independent professional. I would also like to extend my gratitude to Sarah Meiklejohn and Steven Mur- doch, for their guidance and advice which helped me to significantly improve my research, and to my viva examiners, Emiliano De Cristofaro and Paul Syverson, for their precious feedback on my dissertation. I want to also thank my previous teachers, in particular, Marek Klonowski and Michal Morayne, for giving me the opportunity to join great research projects, having confidence in me, sharing research knowledge and for encouraging me to pursue the PhD path. Throughout my PhD years, I was very fortunate to work with amazing re- searchers and industrial partners. In particular, I would like to thank those who have spent some of their valuable time collaborating with me: Tariq Elahi, Jamie Hayes, Sebastian Meiser, Hemi Leibowitz, Amir Herzberg and Nethanel Gelernter. Thank you also to Google DeepMind and Chainalysis, who gave me an oppor- tunity to join top-notch teams as an intern. Those internships taught me many new interesting topics and allowed me to gain a lot of experience. Thank you to every- one with whom I had an opportunity to work there for making it such an amazing experience. In particular, I would like to thank Ben Laurie for his guidance and always having time for fascinating research conversations. I would also like to express my gratitude to a wonderful group of colleagues from the InfoSec group, who had influenced my research and made my everyday work at UCL so pleasant. Thank you also to all my friends in London and beyond, for their friendship, kind words, the time we have spent together and beautiful mem- ories. This PhD journey would never happen without Asia, who always has been vi Acknowledgements a role model for me. Thank you for your love, friendship and encouragement. I would also like to express my gratitude to my parents and my family, for their support and enthusiasm. Especially to my aunt Iwonka for her love, kindness and support. Thank you to my Grandma Halinka and Wanda, who never knew about this adventure but were with me every step along the way. I would never study Computer Science if not amazing men in my family - My Grandpas Mietek and Stanislaw, and my uncles Gienek, Zdzisiek, Irek and Maciek. Their passionate stories about history, science and travels encouraged me to follow my dreams. Thank you for believing in me, I hope I made you all proud. A big thank you also to Mrs Christina and Mr Andreas, for such loving wel- come in their family, and always being so supportive and enthusiastic about my endeavours. Last but not least, I would like to thank my George, for his love, support, motivation, teaching me to never give up and for making me every day a better person. This thesis, and my entire hard work, is dedicated to him. Contents Abstract i Impact statment iv Acknowledgements vi Contents vii List of Figures and Tables xii 1 Introduction 1 1.1 Motivation . 1 1.2 Goals . 4 1.3 Contributions . 5 1.4 Organisation of the thesis . 7 2 Background and related works 9 2.1 Technical defnitions and measures . 9 2.1.1 Information entropy . 9 2.1.2 Differential privacy . 10 2.1.3 Bloom filters . 10 2.1.4 Poisson and Exponential distribution . 11 2.1.5 Memoryless property . 12 2.2 Anonymity . 12 2.2.1 Traffic Analysis and Active Attacks . 13 2.3 Anonymous communication systems . 15 2.3.1 Early designs for decentralized anonymous communication systems . 15 2.3.2 Modern mix networks and DC-Nets designs . 24 2.3.3 Other decentralized anonymity systems . 30 2.4 Conclusion . 31 vii viii Contents I Anonymous communication systems resistant to traffic anal- ysis and active attacks 33 3 The Loopix Anonymity System 35 3.1 Introduction . 35 3.2 The system high-level overview . 36 3.3 System model and security goals .