Store which parts of an IP address, for user to remain anonymous?

Question

I'm thinking about building a very anonymous forum, where people can comment and upvote each other's comments anonymously. People are supposed to remain anonymous even if the forum's database contents becomes publicly available. As one step to prevent vote fraud, I'm thinking about storing parts of the IP address. Only parts of it — if I were to store the whole IP, the forum would no longer be so very anonymous.

IP addresses are like 111.222.333.444. Which parts of the IP address would you recommend that I store? (If any?)

And what about IPv6, which parts of an IPv6 number?

As far as I know, the initial part of the IP address identifies the Internet Service Provider. And the last digits identify the computer within the ISP's network. What about storing parts _22 and _44, ___._22.___._44?

(Hashing the IP doesn't seem like an option, since there are only 4e9 IPs and it therefore would be relatively easy to crack the hash, i.e. test all 4e9 IPs and find out which one results in a given hash. And hashing a secret value + the IP also won't work, since people are supposed to remain anonymous even if the secret value is exposed.)

(Bloom filters is an option, but I'm thinking they'd require rather much storage space, something like 5KB per comment.)

Answer 1

For IPv4, there isn't a good option. The address space is effectively entirely in use, so any partial storage means that one person voting can potentially block others from voting. The numbers towards the left generally represent ISP, geographic area, etc. -- things that an attacker might be able to figure by other means. The numbers towards the right generally represent individual users.

Which parts of the address you store determines the pattern of which users' votes block which other users, and to some extent how much privacy is provided. For example, if you store the three right-most parts of the address, a user can't block other people from his ISP from voting but will block random people scattered around the globe; an attacker who can guess the user's ISP can figure out their full IP address. On the other hand, storing the three left-most parts means an attacker knows immediately which ISP and probably geographic location a user is from, but can't identify the individual; one voter from a small ISP (or the nation of Qatar) can block all others.

IPv6 is different. Essentially, the upper half of the address is assigned by the ISP to the user, while the lower half is generated by the individual device (see IPv6 stateless autoconfiguration and IPv6 privacy extensions).

If you store only the lower half of the address, someone who gets a copy of the database may be able to confirm that someone they suspect is participating actually is, but can't go the other direction and generate a list of participants. If the user has an OS with privacy extensions enabled, confirmation is impossible, but so is preventing duplicate voting.

If you store only the upper half (or only part of the upper half), the situation is essentially the same as with IPv4.

Answer 2

I could hash the IP to 16 bits and store those 16 bits. Then there'd be 65 536 possible hashed values, and for each one of those hashes, there'd be roughly 65 536 possible IPs that maps to that value.

Or hash the IP to only 8 bits, so that there'd be only 256 possible hashes, each one stemming from any one of roughly 2^(32 - 8) = 16 777 216 IPs.

This would hide all parts of the original IP.

However, 1) given an IP number, it would be possible to find out if it had likely visited the website, by hashing it and looking for the hash. Also, 2) if the website (with the database with the IP hashes) is related to a certain not-very-large city, then an attacker with access to the IP hashes could enumerate all IP addresses in vicinity of the city, and then only a few of those IPs would match the hashes in the database. In this way, it might be possible to find the real IPs of the people in the city who visited the website. — So, for small villages, one could/should use shorter hashes.

---

This would be for regular users (i.e. non-anonymous users). I wouldn't want to keep their IP addresses forever, so after a while the IPs could be converted to hashes instead. For truly anonymous users, nothing should be remembered I suppose.

(Answering my own question.)