Seldom: An Anonymity Network with Selective Deanonymization

Eric Wagner,Roman Matzutt,Martin Henze

2024-12-02

Abstract:While anonymity networks such as Tor provide invaluable privacy guarantees to society, they also enable all kinds of criminal activities. Consequently, many blameless citizens shy away from protecting their privacy using such technology for the fear of being associated with criminals. To grasp the potential for alternative privacy protection for those users, we design Seldom, an anonymity network with integrated selective deanonymization that disincentivizes criminal activity. Seldom enables law enforcement agencies to selectively access otherwise anonymized identities of misbehaving users, while providing technical guarantees preventing these access rights from being misused. Seldom further ensures translucency, as each access request is approved by a trustworthy consortium of impartial entities and eventually disclosed to the public (without interfering with ongoing investigations). To demonstrate Seldom's feasibility and applicability, we base our implementation on Tor, the most widely used anonymity network. Our evaluation indicates minimal latency, processing, and bandwidth overheads compared to Tor, while Seldom's main costs stem from storing flow records and encrypted identities. With at most 636 TB of storage required in total to retain the encrypted identifiers of a Tor-sized network for two years, Seldom provides a practical and deployable technical solution to the inherent problem of criminal activities in anonymity networks. As such, Seldom sheds new light on the potentials and limitations when integrating selective deanonymization into anonymity networks.

Cryptography and Security,Networking and Internet Architecture

What problem does this paper attempt to address?

This paper attempts to solve the problems existing in anonymous networks (such as Tor). That is, although these networks provide valuable privacy protection, they are also used for various criminal activities. This causes many innocent citizens to be reluctant to use such technologies to protect their privacy for fear of being associated with criminals. To solve this problem, the author has designed a new type of anonymous network named Seldom, which integrates the function of selective deanonymization to reduce the occurrence of criminal activities.

### Core Problems of the Paper

1. **Criminal Activities in Anonymous Networks**
- Anonymous networks such as Tor, while providing strong privacy protection, have also become hotbeds for criminals to carry out illegal activities. For example, it has been reported that more than 10% of Ahmia.fi searches involve child sexual abuse materials (CSAM), and more than 50% of market listings are related to illegal drugs.

2. **Public Concerns about Anonymous Networks**
- Due to the large number of illegal activities in anonymous networks, many users are uneasy about using these networks, fearing that they will be misidentified as part of the criminals. Research shows that 61% of American citizens hope to improve privacy protection, but only 2% have ever used an anonymous network like Tor.

3. **Balancing Privacy and Security**
- How to protect users' privacy while allowing law - enforcement agencies to deanonymize suspicious users when necessary, so as to effectively combat criminal activities, is a problem that needs to be solved urgently.

### Design Goals of Seldom

- **Selective Deanonymization**
- Seldom allows law - enforcement agencies, with justifiable reasons and after being approved by a coalition of trusted third parties, to access the anonymous identities of specific users.

- **Transparency and Accountability**
- All deanonymization requests will go through an open and transparent process and will eventually be disclosed to the public (without affecting ongoing investigations) to ensure that power is not abused.

- **Low - Performance Overhead**
- Seldom is designed to minimize latency, processing time, and bandwidth overhead, making the user experience almost the same as that of Tor.

### Technical Implementation

- **Blind Authentication Protocol**
- Seldom introduces a blind authentication protocol, which associates each outbound traffic with the user identity encrypted by the threshold. This protocol ensures that the user's privacy can be maximally protected even during the deanonymization process.

- **Semi - Transparent Ledger**
- To provide transparency, Seldom introduces a semi - transparent ledger, which records all activities and discloses them to the public at an appropriate time, thus ensuring public supervision and transparency.

### Summary

Seldom aims to protect the privacy of most legitimate users and provide law - enforcement agencies with effective tools to combat crime by integrating the function of selective deanonymization. This design not only solves the crime problems existing in anonymous networks but also increases the public's trust in anonymous technologies.