2
$\begingroup$

I am trying to finish a paper on censorship resistant data-sharing systems in semi-centralized ways. I know the below threat model can be mitigated by using decentralized system, but I am looking for a possible theoretic solution for the following, without being able to change the rules.

Consider the following threat model:

  • A website that allows accounts for journalists to receive leaked documents / data.

  • Each journalist has an ID on this website (say username, public key, public key fingerprint, whatever will do).

  • Whistle blowers use those IDs to send leaked data using this website.

  • The journalists need to be able to log into their accounts on the website and see all the information that was sent to them, like a list of "support tickets" or something like this.

  • The website should not be able to see that data content in clear text. - this problem is fixable by implementing database encryption with key derived from user password and kept in session, and dumped at the end.

The threat that needs to be fixed: CENSORSHIP OF ACCOUNTS.

The problem with the above system is that journalists accounts are static. They are also public, and known to everyone including the possible censors. So, a censor with "authority" can easily force the website to "block" account XXX or otherwise make its data unavailable. Regardless the data itself is secure and safe, not read by any party, it can still be made unavailable to the journalist by censoring their accounts.

What I need is a hint in order to implement multiple cryptographic functions in a system that will allow a website to map data to an account anonymously.

Explained in laymen terms (for simplicity):

  • You go to a website to send some information to user / account: XXX.
  • Consider the information you send is already encrypted end to end from you to the receiver, so the information itself is not at risk. The only risk is for the information not to reach the receiver.
  • The website needs to be able to show that data to user / account XXX when they log in and needs to also have a technical impossibility to "freeze" or "censor" the account XXX in order to not receive further information if required by a censor.

I was thinking of zeroproof systems but I have no clear way to implement them. Also, if instead of account names we use whole pubkeys, senders can send encrypted data directly but a censor can force the website to "filter" pubkey X. So, the base problem remains unsolved.

Even if one would use Time based codes based on OTP that link to certain accounts, a censor could still force the website to identify the journalist account by trying to send some dummy data themselves to that certain account using a time based token.

Ideas? Thanks in advance.

Improve this question
$\endgroup$

1 Answer 1

Reset to default
1
$\begingroup$

I'm not sure this threat model is realistic, since I would expect an adversary to want to shutdown the entire site, instead of just censoring specific "contributors" :-).

To protect from this (and from the users becoming de-anonymized) one would likely use an anonymity network such as Tor.

The website should not be able to see that data content in clear text. - this problem is fixable by implementing database encryption with key derived from user password and kept in session, and dumped at the end.

The problem with this, is that the data will be unencrypted at the server's location for some time - worse, the server has the key. Lets assume, that the server is compromised, and malicious: Then it could easily obtain a copy of every new document, and of old documents by storing the password, when the respective user logs in again.

A solution to this problem would be to have contributors encrypt data using the public key of the recipient.

However, if you use asymmetric cryptography on the client side, someone has to perform the encryption. You don't want the website to do this for several reasons:

  • JavaScript (which would likely be required) is a large attack surface - if the server is compromised, and users of the website are required to enable JS, they are exposed to more risk.

  • If the server is compromised, it could swap the encryption for nothing, without the users noticing.

Therefore, you would likely need an external program, such as gpg or age.

Unfortunately, by now, we have achieved usability levels close to that of encrypted email :-(.

What I need is a hint in order to implement multiple cryptographic functions in a system that will allow a website to map data to an account anonymously.

As I already said, I don't think this is a realistic requirement. Additionally, I'm not aware of any protocols that solve this problem.

However, ring-signatures could maybe be used to authenticate users. Using ring-signatures, a user could prove that they are part of a larger user-group. Then, the server can't determine which specific user they are, but could allow them to submit documents for upload.

I'm not sure on the specifics, and there are many ways the protocol design of this could go wrong. A first step would be, to determine the exact requirements.

Improve this answer
$\endgroup$
5
  • $\begingroup$ I agree with your comments regarding asymmetric crypto client side, without server touching the data even with temporary session key to avoid threats of a compromised server. I do understand the point of view of unrealistic requirement, but this is just a theoretical paper that describes a news agency being targeted by a regime in a relatively free country. So the goal is to mix with the "regime favorite" news agencies and still be able to obtain information (no selective targeting). I know about anonymity networks but here is not the case, the activity is legal we just need to avoid filtering $\endgroup$
    – skydanc3r
    Commented Nov 22, 2020 at 20:29
  • $\begingroup$ Anyway, I think you gave me the golden hint. ring-signatures seams like will achieve my goal. I am reading about it now. I just have one more question: if all the website users are in the same group, and one users signs (on behalf of the entire group) can that user prove to the website that he is the real signer? $\endgroup$
    – skydanc3r
    Commented Nov 22, 2020 at 20:31
  • $\begingroup$ Do you mean whether they can prove they were the signer later on? $\endgroup$
    – ambiso
    Commented Nov 23, 2020 at 7:03
  • $\begingroup$ yes, exactly. is there any piece of data they can provide to prove they were the signer from a big group? $\endgroup$
    – skydanc3r
    Commented Nov 23, 2020 at 14:58
  • $\begingroup$ I'm can't say if ring-signatures in general provide this feature, however the ring-signatures introduced in the paper I linked do. At the very end the authors state: "To prove that A is the signer, A can reveal a single seed which was used to generate all the non-signers’ parts of the signature." $\endgroup$
    – ambiso
    Commented Nov 23, 2020 at 20:08

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.