A High-Bandwidth, Low-Latency System for Anonymous Broadcasting by Zachary James Newman B.S., Columbia University (2014) Submitted to the Department of Electrical Engineering and Computer Science in partial fulfillment of the requirements for the degree of Master of Science in Electrical Engineering and Computer Science at the Massachusetts Institute of Technology May 2020 © Massachusetts Institute of Technology 2020. All rights reserved. Author: Department of Electrical Engineering and Computer Science May 15, 2020 Certified by: Srini Devadas Edwin Sibley Webster Professor of Electrical Engineering and Computer Science Thesis Supervisor Accepted by: Leslie A. Kolodziejski Professor of Electrical Engineering and Computer Science Chair, Department Committee on Graduate Students A High-Bandwidth, Low-Latency System for Anonymous Broadcasting by Zachary James Newman Submitted to the Department of Electrical Engineering and Computer Science on May 15, 2020, in partial fulfillment of the requirements for the degree of Master of Science in Electrical Engineering and Computer Science abstract In this thesis,1 we design and evaluate Spectrum, a system for bandwidth efficient, anonymous broadcasting. In this system, one (or more) publishers broadcast a mes- sage to many users, who provide cover traffic. These users share their message between two or more servers; as long as one of these is honest, even an adversary with a complete view of the network cannot discover a message’s source. Prior sys- tems require that each user publish a message; however, streaming media tends to have many consumers for every content producer. We take advantage of this for a large performance improvement. To do so, we provide a cryptographic solution to the disruption problem, where dishonest users can corrupt a message by writing noise. This solution provides access control for operations performed obliviously by the servers. Spectrum is 60× faster than prior work for moderate-sized messages (10 kB), Each client uploads under 1 kB of additional data to broadcast a message of any size. Using a two-server deployment, Spectrum is fast enough to broad- cast 3.4 GB/h to 600 users or streaming video to 5,000 users. Further, we can shard Spectrum across many physical servers for commensurate speedup, scaling a given workload to many more users. Thesis Supervisor: Srini Devadas Title: Edwin Sibley Webster Professor of Electrical Engineering and Computer Science 1 This thesis contains research performed with Sacha Servan-Schreiber, currently unpub- lished [52]. We developed the protocol collaboratively; I contributed the majority of our imple- mentation, by lines-of-code (84%) and conducted the experiments. acknowledgments This thesis would not exist if not for the unflagging support of my advisor Prof. Srini Devadas. Srini is always available to dispense wisdom about mit, academia, com- puting, or eating more ice cream than I would have assumed possible. The initial inspiration for this project came from Albert Kwon, without whom my adjustment to graduate school and mit would have been much more difficult. Albert provided invaluable feedback on the project. My partner-in-crime on this project, Sacha Servan-Schreiber, has constantly pushed me to make it better. We may drive each other a little crazy, but I wouldn’t have it any other way. Henry Corrigan-Gibbs was an irreplaceable mentor. I owe a long list of people for motivating me throughout: My other lab-mates past and present—Alex, Alin, Hanshen, Ilia, Jules, Jun, Kyle, Quan—have been fonts of both knowledge and camaraderie throughout the past two years; I’ve re- ally missed them while working from home. Profs. Tal Malkin and Allison Bishop inspired me to come to graduate school in the first place. My family—my parents, Kara, Audrey—have been a crucial source of stability since I’ve been conscious, and I credit them for my survival through high school and onward. My Boston friends, old and new—Maria, Margaret, Lowry, Melissa, Bill—and my friends elsewhere— Christian, Dina, Arta, Thomas, Noah, Appu, Estelle, Drew, Sam, Rob, Alicia, Maku- lumy, Katelyn, and so many more—have kept me laughing when I really needed it. Finally, my partner Katie has been the picture of supportive: moving with me to Boston, making sure I don’t forget to break for dinner when the workdays get long, and all without a hint of complaint! I know public acknowledgment would mortify her, so I’ll keep the magnitude of my appreciation between me and anyone with an internet connection who can read this widely available document. 5 CONTENTS 1 INTRODUCTION 13 1.1 setting 15 1.2 approach 15 1.3 limitations 16 2 RELATED WORK 19 2.1 mix networks and onion routing 19 2.2 dining cryptographer networks 21 3 PROTOCOL 23 3.1 setting 23 3.1.1 Protocol Goals 23 3.2 protocol interface 24 3.2.1 Security Goals 26 3.2.2 Trivial Protocol 27 3.3 anonymity via dining cryptographers 27 3.4 efficiency via distributed point functions 30 3.5 soundness via message authentication codes 33 3.5.1 Authenticating Distributed Point Functions 34 3.6 the spectrum protocol 40 4 EVALUATION 45 4.1 implementation and deployment 45 4.2 results 46 5 DISCUSSION 51 5.1 extensions 51 5.2 future work 52 5.3 conclusion 53 7 LISTOFFIGURES 3-1 protocol overview 25 3-2 dining cryptographer networks 29 4-1 all users publish 46 4-2 few users publish 47 4-3 horizontal sharding 48 4-4 beyond two servers 49 9 LIST OF TABLES 4.1 video streaming bandwidth 47 11 1 INTRODUCTION The voting booth is an apt symbol of democracy—not only because it enables vot- ing, but also because it is a booth. Booths symbolize the need for privacy: the right to hold and express an unpopular viewpoint without fear of retribution, along with protections against blackmail and vote buying. Winston Churchill concurs, deeming “strict secrecy” of voting the “foundation of democracy” [33]. American jurisprudence increasingly accepts an implicit right to privacy in the US Constitu- tion: Justice William O. Douglas writes for the majority in Griswold v. Connecticut that “specific guarantees in the Bill of Rights have penumbras, formed by emana- tions from those guarantees that help give them life and substance”—privacy the “penumbra” in question [65]. This case laid the basis for many future decisions up- holding individual rights [66, 67]. Elizabeth Stoycheff, a scholar of journalism, ar- gues [61] that government surveillance and monitoring programs specifically have a “chilling effect” that stymies minority viewpoints and intellectual freedom. With- out private communications, government cannot be representative and just. These protections do not apply in the converse—representative government must be transparent. The United States has a rich history of government whistle- blowing exposing misconduct, often leading to substantive policy or administra- tive changes. These whistleblowers exposed: military and political deception sur- rounding the Vietnam War (Daniel Ellsberg, the Pentagon Papers)[6]; illegal, po- litically motivated wiretapping and the resulting cover-up, leading to President Richard Nixon’s impeachment and resignation (Mark Felt, also known as “Deep Throat”) [8]; sexual misconduct by President Bill Clinton, leading to his impeach- ment (Linda Tripp) [30]; fbi intelligence failures predating the terrorist attacks of September 11, 2001 (Coleen Rowley) [37]; war crimes in Afghanistan (Chelsea Man- ning) [13]; and mass surveillance by intelligence agencies (Edward Snowden) [12]. Without transparency to expose inefficiencies and injustices, even democratic gov- ernment has at best limited accountability to its constituents. Similarly, private whistleblowers expose misdoings by individuals and non- governmental organizations. The leaked Panama Papers detailed fraud, tax evasion, and sanction circumvention, leading to racketeering and bribery charges for fifa officials and recovered sums in excess of $1 billion [23, 29, 64]; the Paradise Papers and many similar leaks describe the abuse of tax loopholes [34]. Whistleblowers are subject to harassment and punishment: many of the above have been prosecuted and in some cases served prison time. In the United States, prosecutors use broad laws against “aiding the enemy,” and “treason,” or the vari- ous provisions of the Espionage Act and Computer Fraud and Abuse Act, to punish 13 leakers. Some legislation protects specific industries or organizations: dubiously- Constitutional “ag-gag” statutes [4] forbid documenting abuses by the agricultural industry. This motivates the frequent use of pseudonyms—“Deep Throat” from Watergate [54], “John Doe” from the Panama Papers [18]—in pursuit of anonymity. In order to blow the whistle, however, one must somehow disseminate infor- mation and evidence. Historically, leakers met in-person with a journalist and give them physical papers; later leakers have mailed hard drives with data. Few use the internet directly, as it is a treacherous vehicle. Encryption technology hides the contents of messages, but not metadata: who communicates with whom, and when. Large-scale, extrajudicial US government programs vacuum up metadata from on- line communications [12] and use this metadata as a basis for military and political decision-making [19]. For instance, in the Chelsea Manning trial (where leaks did happen over the internet, the prosecution presented metadata evidence (of an sftp connection) to link Manning to the WikiLeaks organization [73], resulting in con- viction and a 35-year sentence. Many systems for metadata-hiding online communication mitigate these risks for privacy-sensitive users. The most popular, Tor [26], obscures communication patterns with latencies of a few seconds—sufficient for web browsing. While Tor is vulnerable against adversaries with perfect views of the network, millions of daily users trust Tor with their traffic [63]. Other systems trade-off speed for security in this setting. Chapter 2 details many of these systems. These systems excel where many users each want to publish small messages or communicate pairwise.