Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

There might be flaws in the following method for anonymous signal reception that I'm not seeing:

Alice doesn't know who Bob is. Bob wants to Alice to notify Bob of a particular outcome without discovering who Bob is. Bob doesn't want to rely on a narrow broadcast window. Neither Alice nor Bob want any other party (Carol) to spot that Alice is notifying someone of something.

So Bob tells Alice to do the following:

  1. The message is to be a short collection of random characters that makes prearranged sense to Alice and Bob. For example, 94e3d5b0f1 for "Yes / Proceed" and 32b6422292 for "No / Stop".
  2. Alice responds to or uses a twitter account with lots of followers. For example, a popular celebrity or topic.
  3. Alice creates a relevant tweet on any relevant topic which involves a URL link for more information.
  4. The URL link is created using a custom URL shortener. The custom URL ends with the desired message. For example, http://url.short/94e3d5b0f1

Alice can not find out who Bob is amongst the thousands or millions of followers. Other followers, such as Carol, have no idea that a Boy Band tweet or someone replying to a Boy Band tweet actually acknowledged for example, a fugitive amnesty for Bugs Bunny.

Would this be a viable method for anonymous signal reception?

share|improve this question

migrated from crypto.stackexchange.com Sep 3 '13 at 16:25

This question came from our site for software developers, mathematicians and others interested in cryptography.

2 Answers 2

The protocol you describe does not fit your assumptions in the beginning.

At first, you assume Alice does not know who Bob is, but then you assume that Alice and Bob have a secret mapping of "random short messages" to some meaningful statements. This is not impossible, but then you need a way for Bob to send this mapping to Alice in the first place anonymously, and Alice to accept this... without being able to verify who Bob is.

And then, you say that you don't want Carol to know that any message has been sent at all. This isn't an anonymous receiver protocol, but a steganographic channel, where the message is entirely hidden. But for methods like these, its security depends mainly on the fact that the attacker does not know the method.

Additionally, this scheme does not scale at all for multiple receivers, because Alice would have to send a tweet for each receiver (she can't give Bob the random mapping, if she has no other way to send him messages;so each receiver had to choose his own). Now Eve can detect "secret communication messages" by simply evaluating the frequency of tweets. The only way to circumvent this is by sending more random tweets in general (and they all have to be of the "secret message possible" format)... which has to be checked by every receiver if this was a secret code for some message.

Moreover, what is keeping Eve from "subscribing" to the hidden channel herself?

Overall, using Twitter as public broadcast channel is possible. Steganography in url shorteners would also work, but steganography is always about "hiding in the crowd": If you only use this scheme for secret messages (and the attacker knows this), then your messages are no longer hidden at all. Additionally, you are limited to your previously shared secret with the receiver, which is the mapping from random urls to signals/messages. But the "anonymous receiver" part makes this really inefficient for all involved parties: Alice has to create a lot of spam-tweets, to hide sending of messages, possibly to multiple parties. And each receiver has to test every single tweet in his own "secret message mapping".

share|improve this answer
    
To clarify: a) As Alice doesn't know Bob, verification of Bob is irrelevant as long as Alice is otherwise incentivised to reply to Bob. b) Mechanisms for future verification occurs at Bob's discretion during initial contact. c) Bob doesn't care if Alice has to do this with other people. d) Steganography is the practice of hiding in plain sight. As Alice depletes one-shot random code words, the most insight conveyed to any paranoid follower is whether a hidden meta-context may be occurring - depending on how inconsistent URL usage or tweet timing is. e) Note that Bob is following public tweets. –  LateralFractal Sep 2 '13 at 13:51
    
A humorous example: Suppose Kardashian was communicating with her secret alien overlords through Twitter; in practice we couldn't prove it providing she used her alien one-shot code book correctly. After all, each shortened URL retains its primary legitimate purpose. –  LateralFractal Sep 2 '13 at 14:01
    
@LateralFractal I guess in that case Kardashian and her secret alien overlords wouldn't use Twitter because telepathy and mind-control techniques would be so much faster and it would certainly represent a 100% cryptographically secure channel as no one else on planet Earth has that "technology". In fact, you could even skip the key and authentication problems. ;) –  e-sushi Sep 2 '13 at 17:01
    
If you assume Charlie to know absolutely nothing about the communication channel, he won't notice anything unusual about this "hidden channel". But this is similar to "ciphertext only" attacks in cryptanalysis, and it should not be considered secure in any way. If you grant Charlie the knowledge of the existance of the channel, you need steganography to hide the existance of signals from charlie: hiding real signals in a lot of fake ones (indistinguishable for Charlie, who does not know which codewords are in the alien codebook). –  tylo Sep 3 '13 at 15:19

Problems with this protocol:

  1. How does Bob give Alice the keywords without disclosing his identity?
  2. How does Alice know that this message from Bob was not compromised by Carol?

    These are the traditional problems of public key crypto: distributing and verifying public keys. So here you are trying to solve the hard PKC problems by not using PKC.

  3. You assume that Bob has completely covered his tracks by getting the tweets exclusively via Tor/I2P. (This is probably a reasonable assumption, but should be stated instead of assumed.)

While I have only begun my study of anonymity networks, I seems to me you are trying to reinvent Freenet. I'll be interested to know why Freenet would not work for your purpose.

share|improve this answer
    
1) Indeed. Bob might be an anonymous receiver but the anonymity of the initial contact with Alice (phone booth, postal letter, onion-routed email, etc) depends on Alice's capacity to backtrace a contact without prior warning. 2) Without a trust chain with at least one non-anonymous verifier or person Alice chooses the trust on prior conduct; this is a legitimate risk. Whether Bob considers that the initial message drop was intercepted by Carol, would depend on the likelihood from Bob's viewpoint. 3) Freenet isn't universally installed; Bob couldn't plausibly deny to third parties. –  LateralFractal Sep 2 '13 at 21:55
    
asksteved.com/stats Freenet is averaging 14k nodes weekly. That's a big crowd, but not as big as the millions you are talking about for a celebrity twitter following. –  Teris Riel Sep 3 '13 at 15:47
    
Is Bob concerned about Alice or Carol knowing that he got the message or not or that he acted on the information? –  Teris Riel Sep 3 '13 at 15:52

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.