Anonymous networks and timing attacks: Tarzan and MorphMix
- Transfer
Introduction | Tor | Tarzan and MorphMix | Low Cost Attack | Low Cost Attack on Tarzan and Morphmix | Principles of building secure systems (conclusion)
Tarzan is another low latency anonymizing system. It is also based on the ideas of Chaum and, like others, was created to ensure anonymity when using web applications and instant messengers. Unlike Tor, Tarzan is based on peer-to-peer architecture. Each Tarzan node can be either a client or a transfer node. This eliminates the timing attacks of traffic analysis between input and output nodes. Indeed, at any moment, anyone can join or leave the network, and any node can be a potential initiator of the flow (client). A protocol based on the gossip-based mechanism similar to that described in (Harchol-Balter, Leighton & Lewin 1999) is used to disseminate information about nodes on the network. Due to the peer-to-peer architecture features, an attacker can pose as many Tarzan nodes as he wants. Therefore, Tarzan provides a mechanism to reduce the likelihood of choosing a malicious node. The mechanism involves the categorization of nodes based on the hashes of their IP addresses.
The final recipient of the anonymous stream does not have to be a Tarzan-node - access to the outside world is carried out using PNAT (see below). Tarzan authors claim that their network is able to withstand a global observer. This is achieved thanks to a kind of covering traffic called “mimic traffic”. So that fake traffic does not overload the network much, each Tarzan-node establishes a fake connection with only a few other nodes.
Here's how it works: when a node connects to the network, after receiving a list of all other Tarzan nodes, it selects some of them to simulate traffic (forms a list of simulators). One of these selected nodes will be used later, when an anonymous connection is required, as the next transfer node.
For example, Tarzan node a wants to establish an anonymous connection to the srv web server . In this case, node a wants the tunnel length to be equal to l + 1, where l is the number of nodes in the tunnel. Then a does the following:
The result is this path: a -> n1 -> n2 -> ... -> nl -> PNAT -> svr
It is important that PNAT is selected from all nodes, and not just from the number of nl node simulators . Figure 2 shows the Tarzan network and the created tunnel. In the example, each Tarzan node has 6 simulators.
Figure 2. Simulator-based Tarzan architecture
MorphMix (Rennhard & Plattner 2002, Rennhard & Plattner 2004) is another low latency anonymous communication system. MorphMix follows peer-to-peer architecture. Like Tor, MorphMix uses fixed-length chain of transfer nodes and layer-by-layer encryption (each node can only deploy its own layer). Like Tor, MorphMix does not have cover traffic - it is considered to be ineffective.
Developers MorphMix following terminology is used:
chain transfer nodes - anonymous tunnel ( anonymous tunnel )
the first node - the initiator ( initiator )
last node - the last node ( final node )
nodes between the first and last node - intermediate nodes ( intermediate nodes )
Unlike Tor and Tarzan, where the nodes to tunnel the organization appoints the initiator in MorphMix each intermediate node chooses his successor. To confirm that the choice of the next node occurs, a witness mechanism is honestly provided. Any network node can be a witness.
When the initiating node a wants to organize an anonymous tunnel, it selects the first intermediate node b and witness w from the list of its neighbors. Witness w acts as a third trusted party in the process of choosing the next tunnel node after b - let's call it c. w allows the initiator a to establish a shared key with node c through b without revealing key material to node b .
Figure 3 (from Rennhard & Plattner 2002) shows how in MorphMix the process of selecting the next tunnel node using a witness occurs. It is assumed that the connection between a and b has already been established.
Figure 3. The process of selecting the next (after b ) tunnel node in MorphMix.
1. a selects witness w from among the nodes known to him. Then it generates half the key information DH a, adds the current time value ( nonce 1 ) to it and encrypts all this with the public key w - {nonce 1 , DH a } PuKw . Note that the indication of the current time nonce 1 is used for preventing attacks resubmitting ( replay attack ). s - indicates b how many nodes it should select (from these nodes the next node for the tunnel will be selected). b does not receive any information about the key information DH a , because it is encrypted on the public key w .
2. After b received the message, he forwards DH a (as part of the encrypted message {nonce 1 , DH a } PuKw ) to witness w along with the selected nodes and their public keys ( {ip c , PuK c , ip d , PuK d , ip e , PuK e } ).
3. w performs two actions. First: it decrypts {nonce 1 , DH a } PuKw to get DH a. Then w randomly selects the next node in the tunnel c . Next, w sends DH a and information about host b and its public key {ip b , PuK b } to host c .
4. If to agree to be the next host of the tunnel, it sends w message "Ok".
5. w signs the list of selected b nodes with nonce 1 , while the selected node c is indicated first after nonce 1 . And sendsb .
6. b receives a message from w . He learns that the next node in the tunnel should be with . It generates the id id of an anonymous connection between b and c . Then it sends the id and the new current time nonce 2 to node c .
7. In response c generates and sends a b a half of the key data DH with together with an indication id .
8. b sends a DH withand a list of selected nodes signed by witness w .
In MorphMix, hosts do not need to know about all other hosts in the network.
Translator Notes
* When translating, we encountered some inconsistencies in the description of MorphMix. We tried to level them with the help of a free non-literal translation, which gives a sufficient idea in this context of the network, but cannot claim to be 100% accurate. Therefore, if you need accurate information about the work of MorphMix, refer to the relevant documents.
Tarzan
Tarzan is another low latency anonymizing system. It is also based on the ideas of Chaum and, like others, was created to ensure anonymity when using web applications and instant messengers. Unlike Tor, Tarzan is based on peer-to-peer architecture. Each Tarzan node can be either a client or a transfer node. This eliminates the timing attacks of traffic analysis between input and output nodes. Indeed, at any moment, anyone can join or leave the network, and any node can be a potential initiator of the flow (client). A protocol based on the gossip-based mechanism similar to that described in (Harchol-Balter, Leighton & Lewin 1999) is used to disseminate information about nodes on the network. Due to the peer-to-peer architecture features, an attacker can pose as many Tarzan nodes as he wants. Therefore, Tarzan provides a mechanism to reduce the likelihood of choosing a malicious node. The mechanism involves the categorization of nodes based on the hashes of their IP addresses.
The final recipient of the anonymous stream does not have to be a Tarzan-node - access to the outside world is carried out using PNAT (see below). Tarzan authors claim that their network is able to withstand a global observer. This is achieved thanks to a kind of covering traffic called “mimic traffic”. So that fake traffic does not overload the network much, each Tarzan-node establishes a fake connection with only a few other nodes.
Here's how it works: when a node connects to the network, after receiving a list of all other Tarzan nodes, it selects some of them to simulate traffic (forms a list of simulators). One of these selected nodes will be used later, when an anonymous connection is required, as the next transfer node.
For example, Tarzan node a wants to establish an anonymous connection to the srv web server . In this case, node a wants the tunnel length to be equal to l + 1, where l is the number of nodes in the tunnel. Then a does the following:
- a selects the first transmission node n1 from among its simulators
- a asks n1 for a list of its simulators l n1
- a selects the second transmission node n2 from the list l n1
- a queries n2 for a list of its simulators l n2 . The request goes through n1 , while n1 does not know what exactly it sends.
- a selects the third gear node n3 from the list l n2
- Thus a increases the tunnel until there are l nodes
- In the end, a randomly selects the last node from among all the nodes in the network. This last node in Tor is called the exit node, and in Tarzan it is called PNAT .
The result is this path: a -> n1 -> n2 -> ... -> nl -> PNAT -> svr
It is important that PNAT is selected from all nodes, and not just from the number of nl node simulators . Figure 2 shows the Tarzan network and the created tunnel. In the example, each Tarzan node has 6 simulators.
Figure 2. Simulator-based Tarzan architecture
MorphMix *
MorphMix (Rennhard & Plattner 2002, Rennhard & Plattner 2004) is another low latency anonymous communication system. MorphMix follows peer-to-peer architecture. Like Tor, MorphMix uses fixed-length chain of transfer nodes and layer-by-layer encryption (each node can only deploy its own layer). Like Tor, MorphMix does not have cover traffic - it is considered to be ineffective.
Developers MorphMix following terminology is used:
chain transfer nodes - anonymous tunnel ( anonymous tunnel )
the first node - the initiator ( initiator )
last node - the last node ( final node )
nodes between the first and last node - intermediate nodes ( intermediate nodes )
Unlike Tor and Tarzan, where the nodes to tunnel the organization appoints the initiator in MorphMix each intermediate node chooses his successor. To confirm that the choice of the next node occurs, a witness mechanism is honestly provided. Any network node can be a witness.
When the initiating node a wants to organize an anonymous tunnel, it selects the first intermediate node b and witness w from the list of its neighbors. Witness w acts as a third trusted party in the process of choosing the next tunnel node after b - let's call it c. w allows the initiator a to establish a shared key with node c through b without revealing key material to node b .
Figure 3 (from Rennhard & Plattner 2002) shows how in MorphMix the process of selecting the next tunnel node using a witness occurs. It is assumed that the connection between a and b has already been established.
Figure 3. The process of selecting the next (after b ) tunnel node in MorphMix.
1. a selects witness w from among the nodes known to him. Then it generates half the key information DH a, adds the current time value ( nonce 1 ) to it and encrypts all this with the public key w - {nonce 1 , DH a } PuKw . Note that the indication of the current time nonce 1 is used for preventing attacks resubmitting ( replay attack ). s - indicates b how many nodes it should select (from these nodes the next node for the tunnel will be selected). b does not receive any information about the key information DH a , because it is encrypted on the public key w .
2. After b received the message, he forwards DH a (as part of the encrypted message {nonce 1 , DH a } PuKw ) to witness w along with the selected nodes and their public keys ( {ip c , PuK c , ip d , PuK d , ip e , PuK e } ).
3. w performs two actions. First: it decrypts {nonce 1 , DH a } PuKw to get DH a. Then w randomly selects the next node in the tunnel c . Next, w sends DH a and information about host b and its public key {ip b , PuK b } to host c .
4. If to agree to be the next host of the tunnel, it sends w message "Ok".
5. w signs the list of selected b nodes with nonce 1 , while the selected node c is indicated first after nonce 1 . And sendsb .
6. b receives a message from w . He learns that the next node in the tunnel should be with . It generates the id id of an anonymous connection between b and c . Then it sends the id and the new current time nonce 2 to node c .
7. In response c generates and sends a b a half of the key data DH with together with an indication id .
8. b sends a DH withand a list of selected nodes signed by witness w .
In MorphMix, hosts do not need to know about all other hosts in the network.
Translator Notes
* When translating, we encountered some inconsistencies in the description of MorphMix. We tried to level them with the help of a free non-literal translation, which gives a sufficient idea in this context of the network, but cannot claim to be 100% accurate. Therefore, if you need accurate information about the work of MorphMix, refer to the relevant documents.
