Provable anonymity

This paper provides a formal framework for the analysis of information hiding properties of anonymous communication protocols in terms of epistemic logic. The key ingredient is our notion of observational equivalence, which is based on the cryptographic structure of messages and relations between otherwise random looking messages. Two runs are considered observationally equivalent if a spy cannot discover any meaningful distinction between them. We illustrate our approach by proving sender anonymity and unlinkability for two anonymizing protocols, Onion Routing and Crowds. Moreover, we consider a version of Onion Routing in which we inject a subtle error and show how our framework is capable of capturing this flaw. Categories and Subject Descriptors C.2.2 [Computer-Communication Networks]: Network Protocols—Protocol verification; F.4 [Mathematical Logic and Formal Languages] General Terms Security, Theory, Verification Keywords Anonymity, Unlinkability, Privacy, Epistemic Logic, ...

• Type: Conference
• Year: 2005
• Where: CCS
• Authors: Flavio D. Garcia, Ichiro Hasuo, Wolter Pieters, Peter van Rossum
• Keywords: Anonymous Communication Protocols, CCS 2005, Epistemic Logic, Onion Routing, Security Privacy