DecentAC.tex

\citet{PPACinPubFS} analysed two dichotomous models of communication.
The first was the pull model, where the recipients fetch (i.e.\ pull) new 
messages from the sender.
A suitable analogy would be that of magazines published through sales in 
kiosks: people go to the kiosk to get the latest publications.
The second model was the push model, here a sender sends the message directly 
to the recipients.
Thus it is more like magazine subscriptions: the next issue arrives in the 
mailbox shortly after publication.
This is the model of the communication described in \cref{GroupProperties}, 
i.e.\ the communication model for email.
\citeauthor{PPACinPubFS} found that achieving privacy in the pull model is 
technically easier than in the push model.
In fact, achieving strong privacy in the push model is very
difficult. %TODO: explain why

\paragraph{The Pull Model}

We can start by looking at the pull model for communication.
Alice wants to distribute a message to the participants in a discussion.
In the pull model the participants actively ask Alice or an intermediary for 
new messages at regular intervals.
To form a protocol around this model, Alice and the participants can agree on 
a location for the messages.
When Alice wants to send a new message, she writes it to this particular 
location.
When the other participants want to, they can read from the location to see if 
there are any new messages.

We can assume that the network that Alice uses is controlled by the regime's 
agents.
We can also assume that the storage where the messages are stored is publicly 
readable, because it is probable that the regime's agents can compromise it.
Thus Alice does not want to be associated with the message, not authorship nor 
posting it.

The first thing we can say about this is that Alice would like to have 
confidentiality for the message contents, so the regime's agents cannot read 
it.
She would also like to have integrity for the message, so that the recipients 
can be sure that the regime's agents have not modified it.
Many systems provide these two properties, e.g.\ \ac{PGP} which is used for 
email.
However, Alice also wants to hide the sender and recipients, a property which 
\ac{PGP} and others do not provide.
There is a class of encryption schemes called \ac{ANOBE} schemes.
This type of scheme provides confidentiality while hiding the sender and the 
intended recipients.
If Alice can write the message anonymously to the storage and the message is 
encrypted using \iac{ANOBE} scheme, then it will be difficult to determine the 
sender.
Furthermore, if the recipients fetch the messages anonymously too, then the 
recipients are also hidden.
Now the problem of integrity remains.
If Alice and the other participants agree on a commonly shared \ac{MA} key, 
then they can use \acp{MAC} to ensure integrity. %TODO: MA v. MAC
The reason \acp{MAC} are more desirable than digital signatures in this 
situation is that anyone who can verify the authenticity of \iac{MAC} can also 
create one (as was pointed out above).
With digital signatures on the other hand, if Alice signs a message it is clear 
that Alice is the only one who could have signed it.
This would provide the regime's agents with something to track messages by, all 
messages signed by the same key are related.
With \acp{MAC}, any of the other participants could also be the author of the 
message and the regime cannot determine which messages are related either.
This means that for a discussion, any of the participants would be equally 
likely to be the author of a given message.
However, this relies on the anonymity of the actors.

\paragraph{The Push Model}

In the push model Alice will send the message to all recipients directly.
The problems with the push model is that it reveals more meta-information.
Say that all participants have an inbox, similarly as in the email system.
Assume that the regime's agents monitor the network on a national level.
In this situation they can see one message originating from Alice, going to 
a server beyond the agency's reach, and soon \(n\) equally-sized messages 
return from the server near-simultaneously addressed to \(n\) people.
This is what is called a time-correlation attack.
The agency can then relate Alice with the people she is talking to.
This is the situation when using text-messaging apps such as Signal, because 
there all messages go through a central server.
This also has the side-effect that the operator of the central server can 
perform the same attack.

Now let us try to remove some information to make this more difficult for the 
agency.
Say that the sender and recipients are anonymous, so the agency can only track 
which messages ends up in which inboxes and when.
Despite the anonymity they can still do a time-correlation attack on the 
incoming messages.
This means that they learn which messages are related and in turn which inboxes 
are related and how.
This means that the agency have the structure, they only need to fill in the 
identities.
If one of the participants makes a mistake, then the regime's agents will have 
a starting point to target.
For example if a participant uses the same inbox for communication with all his 
friends, and not only the participants in the plot against the regime, then one 
of his other contacts might not be as concerned with staying anonymous.
The consequence is that the regime can see the identity of someone sending 
messages to an inbox of their interest.
Then they can target this person and learn which friend owns the inbox of 
interest.
Then they can proceed to targeting one of the protest organizers.
This type of attack will not work when the communication is according to the 
pull model, since there the agency must attack each anonymous connection.
%TODO: reviewer: explain what you mean by attack here