Citation Context

... suggests that detection of Byzantine servers in the Pynchon Gate should be addressed using an information-theoretic tprivate v-Byzantine-robust k-out-of-ℓ PIR protocol based on Shamir secret sharing =-=[37]-=-, such as that proposed by Beimel and Stahl [2]. The paper then presents a performance improvement upon the results of [2], and introduces a two-stage Byzantine recovery procedure for its protocol. 8 ...

Citation Context

...the hash tree verification system: a corrupt distributor can, through malice or error, create a denial of service 2 This concern is present in many other anonymity systems, including Chaumian mixnets =-=[6, 28, 12]-=- and systems built on top of them [27, 25].sattack on the system by responding with incorrect data to a client’s query. While the client will detect that the message block is invalid after performing ...

Citation Context

...formation about the private information. Of particular concern are the possibilities that a single adversary may operate multiple nodes under different identities, effectively ensuring node collusion =-=[19]-=-, or that significant amounts of the anonymity infrastructure may lack good location independence [20]. Thus, systems which encourage participation by many unaffiliated operators of diverse background...

Citation Context

...sure that the adversary is unable to gain control of any part of the infrastructure, this laissez-faire approach to anonymity service operation taken by some of the more successful anonymity services =-=[17, 28]-=- simply accepts that some nodes will be controlled by an adversary, and accounts for this fact in the design of these systems. 1.2 Background on Nym Servers Pseudonymous messaging services allow users...

Citation Context

... with caution if intended to serve as a buildingblock for an anonymity system.)scollude, by proposing a hybrid privacy protection scheme which relies on the Paillier additive homomorphic cryptosystem =-=[30]-=-. This extension gives a PIR protocol with t-private v-Byzantine-robust k-out-of-ℓ information-theoretic protection and ℓ-computational protection. However, as the author states, adding this modificat...

Citation Context

...ot defeat the system merely by virtue of being able to perform calculations which reveal the private information. Other PIR protocols merely offer computational security: in Computational PIR systems =-=[7]-=-, the privacy of the PIR query is protected only against an adversary restricted to polynomial-time computational capability. CPIR-based solutions have the significant advantage that they can be perfo...

Citation Context

...s. The revised version of the protocol retains the same security properties set forth in the original design paper. We address the issue of Byzantine nodes by introducing a cut-and-choose methodology =-=[32, 4]-=-. To support this addition, we modify the query algorithm and add a response validation algorithm (to be run if the reconstruction algorithm fails) at the cost of trivial computation expense and a dou...

Citation Context

...ficient as it could be. The security implications of a modified validator protocol should be explored, perhaps with inspiration from sister disciplines, such as digital cash authenticity verification =-=[5]-=-, secure secrecy-preserving auctions [31], or randomized partial checking in mix networks for voting applications [22]. Using the PynGP 2.0 protocol, users can detect when a given server has behaved i...

Citation Context

...the hash tree verification system: a corrupt distributor can, through malice or error, create a denial of service 2 This concern is present in many other anonymity systems, including Chaumian mixnets =-=[6, 28, 12]-=- and systems built on top of them [27, 25].sattack on the system by responding with incorrect data to a client’s query. While the client will detect that the message block is invalid after performing ...

Citation Context

...tems can be used for parties to communicate without revealing their identities, or as a building-block for other systems that need a bi-directional anonymous communication channel, such as Free Haven =-=[15]-=-. 1.3 The Pynchon Gate and The Byzantine Postman Problem The most recent proposal for a nym server based on PIR with informationtheoretic security, the Pynchon Gate [34], offers greater robustness, st...

Citation Context

...o a different set of users [1]. 2 Background on The Pynchon Gate To address the reliability problems of silent node failure, as well as the serious security problems of statistical disclosure attacks =-=[33, 11, 13]-=- and end-to-end traffic analysis [26], Sassaman, Cohen, and Mathewson propose a complete architectural design of a PIR-based pseudonym service offering information-theoretic protection, called the Pyn...

Citation Context

...nspiration from sister disciplines, such as digital cash authenticity verification [5], secure secrecy-preserving auctions [31], or randomized partial checking in mix networks for voting applications =-=[22]-=-. Using the PynGP 2.0 protocol, users can detect when a given server has behaved in a Byzantine fashion. However, they have no irrefutable way of proving this to a third party. We have considered a sc...

Citation Context

...s. The revised version of the protocol retains the same security properties set forth in the original design paper. We address the issue of Byzantine nodes by introducing a cut-and-choose methodology =-=[32, 4]-=-. To support this addition, we modify the query algorithm and add a response validation algorithm (to be run if the reconstruction algorithm fails) at the cost of trivial computation expense and a dou...

Citation Context

...s, a passive adversary could observe the actions of Byzantine servers not under his control (and perhaps not even behaving maliciously, but simply incorrectly) to help facilitate intersection attacks =-=[38]-=-. Additionally, if a user cannot know with confidence which server is behaving in a Byzantine fashion, she is more likely to change the nodes she uses on a regular basis, both increasing her exposure ...

Citation Context

...reased utility of the system; due to the network-effects properties of anonymity systems, denying service to one set of users can effectively weaken the anonymity provided to a different set of users =-=[1]-=-. 2 Background on The Pynchon Gate To address the reliability problems of silent node failure, as well as the serious security problems of statistical disclosure attacks [33, 11, 13] and end-to-end tr...

Citation Context

...e reply-block, this would enable the attacker to identify the mixes used in the nym holder’s reply-block path, and increase his chances of successfully linking the nym with the nym holder’s true name =-=[36]-=-.sforth referred to as PynGP 1.0). Described below, our revised PynGP (PynGP 2.0) protocol relies only on additional sets of operations already performed by PynGP 1.0, yet this modified version of Pyn...

Citation Context

...on The Pynchon Gate To address the reliability problems of silent node failure, as well as the serious security problems of statistical disclosure attacks [33, 11, 13] and end-to-end traffic analysis =-=[26]-=-, Sassaman, Cohen, and Mathewson propose a complete architectural design of a PIR-based pseudonym service offering information-theoretic protection, called the Pynchon Gate [34]. 2.1 Architecture Over...

Citation Context

...infrastructure affect some users differently than others, an attacker may exploit such attacks on components of the system to facilitate an intersection attack against a user of the system as a whole =-=[16]-=-. In the Pynchon Gate, if a Byzantine distributor selectively performed denial of service attacks against certain users by returning garbage results to their queries, but correctly responded to other ...

Citation Context

...on Gate Protocol. 1 Introduction Several proposals have been made for the use of private information retrieval (PIR) [8] primitives to build secure, fault-tolerant pseudonymous mail retrieval systems =-=[10, 3, 23, 34]-=-. PIR-based pseudonym (or nym) servers have several significant advantages over nym servers based on other technologies. PIR protocols can be designed tosoffer information-theoretic security, i.e., as...

Citation Context

...o a different set of users [1]. 2 Background on The Pynchon Gate To address the reliability problems of silent node failure, as well as the serious security problems of statistical disclosure attacks =-=[33, 11, 13]-=- and end-to-end traffic analysis [26], Sassaman, Cohen, and Mathewson propose a complete architectural design of a PIR-based pseudonym service offering information-theoretic protection, called the Pyn...

Citation Context

... the Pynchon Gate should be addressed using an information-theoretic tprivate v-Byzantine-robust k-out-of-ℓ PIR protocol based on Shamir secret sharing [37], such as that proposed by Beimel and Stahl =-=[2]-=-. The paper then presents a performance improvement upon the results of [2], and introduces a two-stage Byzantine recovery procedure for its protocol. 8 For n challenge-vector sets, the probability of...

Citation Context

... offered in this paper, which retains the security properties of the original Pynchon Gate Protocol. 1 Introduction Several proposals have been made for the use of private information retrieval (PIR) =-=[8]-=- primitives to build secure, fault-tolerant pseudonymous mail retrieval systems [10, 3, 23, 34]. PIR-based pseudonym (or nym) servers have several significant advantages over nym servers based on othe...

Citation Context

...o a different set of users [1]. 2 Background on The Pynchon Gate To address the reliability problems of silent node failure, as well as the serious security problems of statistical disclosure attacks =-=[33, 11, 13]-=- and end-to-end traffic analysis [26], Sassaman, Cohen, and Mathewson propose a complete architectural design of a PIR-based pseudonym service offering information-theoretic protection, called the Pyn...

Citation Context

...ersary may operate multiple nodes under different identities, effectively ensuring node collusion [19], or that significant amounts of the anonymity infrastructure may lack good location independence =-=[20]-=-. Thus, systems which encourage participation by many unaffiliated operators of diverse backgrounds across a wide range of network providers can provide stronger services than those in which infrastru...

Citation Context

...distributor can, through malice or error, create a denial of service 2 This concern is present in many other anonymity systems, including Chaumian mixnets [6, 28, 12] and systems built on top of them =-=[27, 25]-=-.sattack on the system by responding with incorrect data to a client’s query. While the client will detect that the message block is invalid after performing the final step of the PIR protocol in Subs...

Citation Context

...he most suitable method of addressing the attack in question yet proposed. We then evaluate an alternate approach to solving to the problem described in [35], proposed by Goldberg in his recent paper =-=[21]-=-. We compare the security and performance trade-offs made in that proposal, and find it less secure against anonymity attacks as compared to the original (but flawed) Pynchon Gate Protocol (PynGP) [24...

Citation Context

...lications of a modified validator protocol should be explored, perhaps with inspiration from sister disciplines, such as digital cash authenticity verification [5], secure secrecy-preserving auctions =-=[31]-=-, or randomized partial checking in mix networks for voting applications [22]. Using the PynGP 2.0 protocol, users can detect when a given server has behaved in a Byzantine fashion. However, they have...

Citation Context

...ome data. Some have involved trusted third-parties or trusted hardware; others have been constructed on top of link-layer anonymity systems or mix networks. In this paper, we examine the Pynchon Gate =-=[34]-=-, a pseudonymous message system which takes an alternate approach to this problem by using Private Information Retrieval (PIR) as the basis for its pseudonymity properties. We restrict our examination...

Citation Context

...on Gate Protocol. 1 Introduction Several proposals have been made for the use of private information retrieval (PIR) [8] primitives to build secure, fault-tolerant pseudonymous mail retrieval systems =-=[10, 3, 23, 34]-=-. PIR-based pseudonym (or nym) servers have several significant advantages over nym servers based on other technologies. PIR protocols can be designed tosoffer information-theoretic security, i.e., as...

Citation Context

...distributor can, through malice or error, create a denial of service 2 This concern is present in many other anonymity systems, including Chaumian mixnets [6, 28, 12] and systems built on top of them =-=[27, 25]-=-.sattack on the system by responding with incorrect data to a client’s query. While the client will detect that the message block is invalid after performing the final step of the PIR protocol in Subs...

Citation Context

...on Gate Protocol. 1 Introduction Several proposals have been made for the use of private information retrieval (PIR) [8] primitives to build secure, fault-tolerant pseudonymous mail retrieval systems =-=[10, 3, 23, 34]-=-. PIR-based pseudonym (or nym) servers have several significant advantages over nym servers based on other technologies. PIR protocols can be designed tosoffer information-theoretic security, i.e., as...

Citation Context

... 1)-private ℓ-server PIR protocol. 2.2 The Pynchon Gate PIR Protocol The protocol runs as follows: after choosing distributors, the client establishes an encrypted connection to each (e.g., using TLS =-=[14]-=-). These connections must be unidirectionally authenticated to prevent man-in-the-middle attacks, and can be made sequentially or in parallel. The client sends a different “random-looking” bit vector ...

Citation Context

...on a variance in the user’s response to altered versus unaltered data, or by simply recognizing the product of the altered data as it is processed by the system (collectively known as tagging attacks =-=[18]-=-) are ineffective, as TLS protects data integrity on the wire. Thus, any tagging attacks an attacker wished to attempt against a user would have to occur through the use of a corrupt distributor. To p...

Citation Context

...21]. We compare the security and performance trade-offs made in that proposal, and find it less secure against anonymity attacks as compared to the original (but flawed) Pynchon Gate Protocol (PynGP) =-=[24]-=- presented in the first Pynchon Gate paper. We show that this proposal is significantly weaker than the solution offered in this paper, which retains the security properties of the original Pynchon Ga...

Citation Context

...f Byzantine servers only at the cost of reduced overall security as compared to PynGP. PynGP 2.0 requires no such compromise in its security. 8 Conclusions We have reviewed the attack as described in =-=[35]-=-, and found that it has significant impact on the deployability and potential success of the Pynchon Gate, as well as other PIR-based nym server systems that do not account for Byzantine servers. A de...