![]() ![]() The project was created with anonymous file sharing in mind 156, and to prevent snooping by “authoritarian” governments 157. Riffle incorporates Tor’s onion encryption and ‘shuffles’ traffic to minimise the possibilities of traffic analysis. We can however still expect to see the improvement of existing and the development of new networks as researchers and developers seek to overcome the flaws and limitations of existing networks whilst building on their strengths networks such as Riffle which is under development by MIT 155. There is still a clear preference for Tor, perhaps due to the simplicity of its use, or conversely the technical challenges of moving to I2P. We previously reported the possibility of a wholesale movement from Tor to other networks such as I2P, however this has not happened. Of course, other developers are also looking for ways to plug the security holes to make the system safer for legitimate users. Criminals shelter themselves behind imperfect anonymisation solutions while law enforcement and researchers seek to find ways to penetrate their shields of anonymity, while keeping protection intact for legitimate users. Conversely, the opposite is largely true with regards to the use of Darknets and hidden services. PS: A Tor core developer claims to have already broken Riffle.In other areas of cybercrime, there is a continuous arms race between cybercriminals looking for vulnerabilities to exploit and security professionals looking to defend against them. Riffle will be presented at next week's Privacy Enhancing Technologies Symposium in Germany, and we expect it to be reviewed in depth by experts. The development team says it takes a tenth of the resources to send large files as other anonymizing services and provides much better protection against active and passive monitoring. They do one expensive shuffle using known protocols, but then they bootstrap off of that to enable many subsequent shufflings."Īs a result, the system is strong and efficient, in theory. "One of the contributions of this paper is that they showed how to use more efficient symmetric-key techniques to accomplish the same thing. Jonathan Katz, director of the Maryland Cybersecurity Center and a professor of computer science at the University of Maryland, added: "The idea of mixnets has been around for a long time, but unfortunately it's always relied on public-key cryptography and on public-key techniques, and that's been expensive. ![]() Servers can then independently check for tampering." So with Riffle, users send their initial messages to not just the first server in the mixnet but all of them, simultaneously. Verifying the proof does require checking it against copies of the messages the server received. "The encryption can be done in such a way that the server can generate a mathematical proof that the messages it sends are valid manipulations of the ones it receives. Because of the onion encryption, the messages that each server forwards look nothing like the ones it receives," MIT's Larry Hardesty explained. "Riffle uses a technique called a verifiable shuffle. At that point, the alarm can be raised to stop people from being identified. Ultimately, if just one of the computers routing a Riffle connection remains uncompromised, that one machine will detect when the mathematical proof has been broken, signaling that someone has tried to tamper with the traffic. The point is to establish a means to verify network-wide that traffic is not being interfered with. Steps are taken to streamline this process as much as possible. To do this, each Riffle client sends an initial message to all nodes in the mesh simultaneously to establish that mathematical proof – which sounds impractical but we're assured it works. Riffle tries to tackle this by adding anti-tamper mechanisms to its design.Įach node can mathematically prove that data passing through it hasn't been meddled with. Active surveillance is a real problem, though: malicious or hacked nodes in the network can tamper with the traffic they receive to eventually deduce where a connection originated. ![]()
0 Comments
Leave a Reply. |
AuthorWrite something about yourself. No need to be fancy, just an overview. ArchivesCategories |