4 ms·

Rollercoaster has a decentralised traffic-analysis resistant architecture whereas Signal is centralised. With a centralised architecture such as Signal, Eve co

by dhx 5y ago

Rollercoaster has a decentralised traffic-analysis resistant architecture whereas Signal is centralised. With a centralised architecture such as Signal, Eve could monitor when Alice sends a message and correlate it over time to which endpoints receive a message soon thereafter. If Bob and Carol are in a group chat with Alice and they receive messages soon after Alice sends messages, Eve can assume over time that they're communicating with each other in a group chat. Due to the lack of cover traffic with Signal, the time of day, frequency and size of messages can be used to infer what they're doing or discussing. For Signal on mobile devices, the geolocation of the mobile device known from a cell tower network would also provide additional information about what Alice, Bob and Carol could be discussing. With Rollercoaster, the idea is that Eve cannot discern between different messages flowing through the network as there is no identifying data (including the size of messages which are all constant). Eve is also hampered from conducting passive timing analysis of submission and receipt of messages (even in group chats) because every node on the network is sending messages at the same rate all year round and also buffering messages and releasing them in a randomised order (not FIFO). To Eve, a message being sent by Alice could be a real message, a cover message, a real message being relayed 1min after receipt from another node or a cover message being relayed 1min after receipt from another node. With protection against Eve performing passive attacks in place, the focus moves to protecting against Eve performing active attacks including Sybil attacks (owning a considerable number of nodes in the network to try and control the entire mix net between Alice, Bob and Carol). Rollercoaster is based on Loopix[1] which includes "loop cover traffic" to detect Eve performing some forms of active attacks. The paper for an alternative mix net communication network Miranda[2] has more detail on how such mix networks can be defended against active attackers, and the numerous limitations that remain. [1] https://www.usenix.org/conference/usenixsecurity17/technical-sessions/presentation/piotrowska https://www.usenix.org/conference/usenixsecurity17/technical... [2] https://eprint.iacr.org/2017/1000.pdf https://eprint.iacr.org/2017/1000.pdf

_lambdalambda 5y ago
Hi, paper author here :) thanks for providing a great answer to that question. I missed that the post/paper made its way to HN. One thing I'd add for the benefit of the discussion is that the term "metadata privacy" is rather fuzzy and different people mean different things with it. That's where some confusion can come from. I like to use "unobservable communication" to refer to absolute metadata privacy where no single bit of information is leaked - i.e. an adversary cannot even tell if any communication is happening at all at any point in time. For most real-world use-cases and threat models, this absolute privacy goal is often a bit unpractical because it comes with high latency or bandwidth needs. For instance, Tor is popular and practical because they prioritise latency and throughput with a careful threat model that excludes a global network adversary. However, the right threat model really depends on the individual use-case and circumstances. I think that Loopix (as linked above and what we use in our paper) does a great job in quantifying the achieved anonymity. See also https://bib.mixnetworks.org/pdf/serjantov2002towards.pdf https://bib.mixnetworks.org/pdf/serjantov2002towards.pdf for some more Information Theory in the context of Mix networks.

by dhx 5y ago

_lambdalambda 5y ago

Hi, paper author here :) thanks for providing a great answer to that question. I missed that the post/paper made its way to HN. One thing I'd add for the benefit of the discussion is that the term "metadata privacy" is rather fuzzy and different people mean different things with it. That's where some confusion can come from. I like to use "unobservable communication" to refer to absolute metadata privacy where no single bit of information is leaked - i.e. an adversary cannot even tell if any communication is happening at all at any point in time. For most real-world use-cases and threat models, this absolute privacy goal is often a bit unpractical because it comes with high latency or bandwidth needs. For instance, Tor is popular and practical because they prioritise latency and throughput with a careful threat model that excludes a global network adversary. However, the right threat model really depends on the individual use-case and circumstances. I think that Loopix (as linked above and what we use in our paper) does a great job in quantifying the achieved anonymity. See also https://bib.mixnetworks.org/pdf/serjantov2002towards.pdf https://bib.mixnetworks.org/pdf/serjantov2002towards.pdf for some more Information Theory in the context of Mix networks.