132 Views

Download Presentation
## Dining Cryptographers

- - - - - - - - - - - - - - - - - - - - - - - - - - - E N D - - - - - - - - - - - - - - - - - - - - - - - - - - -

**Dining Cryptographers**Paper by David Chaum (1988) Presentation by Glenn Fink Dining Cryptographers, Glenn Fink**Dining Cryptographers: Overview**• Who says all the tough papers are at the end of the semester? • Anyone know what the Frobenius automorphism of the Galois group GF(pn) is? • But apart from this, there is still much of practical utility in the paper. Dining Cryptographers, Glenn Fink**Dining Cryptographers**Act I: Three of a kind “Same” “Same” • Flip Coins • Make Observations • Count Observations Result: #Diffs: 0 (Even) NSA Pays “Same” Dining Cryptographers, Glenn Fink**Dining Cryptographers**Act II: Two of a kind “Different” “Same” • Flip Coins • Make Observations • Count Observations Result: #Diffs: 2 (Even) NSA Pays “Different” Dining Cryptographers, Glenn Fink**Dining Cryptographers**Act III: Two of a kind + Inversion “Different” “Different” * Inverted * I’m paying, but no one knows it’s me! • Flip Coins • Make Observations • Count Observations Result: #Diffs: 3 (Odd) Some Cryptographer Pays “Different” Dining Cryptographers, Glenn Fink**T**H T T H H H T H H Diffs Diffs H H H H H H H H T T H H H H T H Diffs Diffs H H H H Proof Sketch (By Induction) T • All heads or all tails: 0 Diffs • One tail, rest heads: 2 Diffs • On each side of tail • Two tails, rest heads: 2 cases: • Two tails are adjacent: 2 Diffs • Two tails nonadjacent: 4 Diffs • N+1 tails, rest heads: three cases: • New tail is adjacent to one string of tails: No change • New tail is nonadjacent to any string of tails: Two more diffs • New tail connects two strings of tails: Two fewer diffs Result: If everyone tells the truth, there will always be an even number of differences T T Dining Cryptographers, Glenn Fink**Anonymity Set 0**Graph Theory Interpretation Anonymity Set • Persons=Nodes • Keys=Edges • Shared by nodes • Anonymity Set: • The set of nodes whose transmissions are indistinguishable • Collusion • Sharing keys to expose another person’s transmissions Anonymity Set 1 Partial Collusion: Not all keys shared Dining Cryptographers, Glenn Fink**Keys and Compromises**• A “key” is really just a history of all the quarters that will ever be flipped between two participants. • E.g., a string of bits • Key compromise means that a third party also knows the results of each flip. Shared Keys Dining Cryptographers, Glenn Fink**Practical Considerations**• Key Generation • Generate a true one-time pad via a physical random process • Generate a short key and expand it via pseudo-random process • Key Distribution • Covertly: in person or via pre-shared symmetric cipher • Publicly: via a public-key-enabled key exchange • Key Usage • Everyone sees the stream of bits from the message • Everyone sees the sum of the outputs of all the nodes • Comparing the sum at each round tells whether someone is transmitting, but… • … No one knows the originator of the message Dining Cryptographers, Glenn Fink**Transmission Example**Round 1 yx 10 = 1 1100 10 = 1 1011 x1=y y1=x 10 = 1 1001 y1=x y x1=y 0111 10 = 1 y0=y y0=y • Flip Coins • Make Observations • Count Observations 00 = 0 0010 0100 00 = 0 Dining Cryptographers, Glenn Fink**Transmission Example**Round 2 yx 00 = 0 1100 00 = 0 1011 “yx” y0=y y0=y 10 = 1 0 1001 y0=y y x y1=x 0111 01 = 1 x0=x x0=x • Flip Coins • Make Observations • Count Observations 11 = 0 0010 0100 11 = 0 Dining Cryptographers, Glenn Fink**Transmission Example**Round 3 yx 11 = 0 1100 10 = 1 1011 “yx” y0=y y1=x 11 = 0 1 1001 x1=y y x y x0=x 0111 00 = 0 x1=y x0=x • Flip Coins • Make Observations • Count Observations 01 = 1 0010 0100 00 = 0 Dining Cryptographers, Glenn Fink**Transmission Example**Round 4 yx 11 = 0 1100 11 = 0 1011 y0=y y0=y 11 = 0 1001 y0=y y x y x y1=x 0111 10 = 1 x1=y x0=x • Flip Coins • Make Observations • Count Observations 01 = 1 0010 0100 00 = 0 Dining Cryptographers, Glenn Fink**Transmission Example**Summary y x “ ” y x y y x x y x y x 0 1 1 0 Anonymous Transmission Dining Cryptographers, Glenn Fink**Attacking the Dining Cryptographers**By partitioning a non-fully-connected network “1” Sum = 1; Transmitter is on this side. Sum = 1; Someone transmitted. Sum = 0; Transmitter is not on this side. Ring network can be attacked in n log n rounds Fully-connected network requires n-1 attackers! Dining Cryptographers, Glenn Fink**Conclusion**• Chaum’s protocol allows parties to transmit anonymous messages in public. • The protocol is highly resistant to collusion attacks. • But attacks are possible because anonymity degrades with time. • Protocol does not protect physical path tracing. • Protocol does not provide for message confidentiality. • Communication via this protocol is four times less efficient on average than traceable transmission protocols. • Protocol forms the basis for Chaum’s DC-Net. Dining Cryptographers, Glenn Fink**Other References**• Good source of information on all sorts of anonymity schemes: • http://www.freehaven.net/anonbib • Tutorial presentation given at ACM CCS 2004 on anonymity: • http://www.cs.georgetown.edu/~clay/ccs-anon.ppt Dining Cryptographers, Glenn Fink