Riffle: an efficient communication system with strong anonymity

Re:Riffle: an efficient communication system with strong ano... by wtbob on Monday July 11, 2016 @11:19PM (#12076518)

It's interesting, for certain, but still requires all clients to dedicate an identical amount of bandwidth (n.b.: this is very probably required for traffic-analysis-resistant anonymity): 'Moreover, each message needs to be padded to a fixed length to prevent privacy leakage through the size of the message,' (pg.23) and 'To be fully traffic analysis resistant, all users are required to upload a message, even if they do not wish to communicate that round' (pg. 25).

Granted, the second sentence leaves open the possibility that perhaps all users aren't required to upload a message, at the cost of increased susceptibility to analysis, but I don't think that's really intended: worst-case, there's one client message per round, which provides no real anonymity against the client's primary server.

I'm not putting it down, really: Riffle is a remarkable achievement. Sadly, it appears that anonymity is really, really hard to do truly efficiently.

[ Parent | on HN ]

Re:Riffle: an efficient communication system with strong ano... by wtbob on Tuesday July 12, 2016 @12:30AM (#12076737)

Also, if I'm reading it correctly then each plaintext message from a particular client ends up at the same location within an epoch, due to the one-time shuffle at the beginning of each epoch. That might be able to reveal information about a client's activity within the epoch.

I also wonder if the presence of distinguishably-mandatory plaintext messages could be used within an epoch, particularly with respect to the previous point. E.g. maybe knowing the the same client was active in rounds 1 & 2, the inactive in round 3, then active in round 4, then inactive in rounds 5 & 6, then active in rounds 7 & 8 could be used to identify the client (imagine a low-latency system, and keystroke timings or voice packet lengths).

[ Parent | on HN ]