Source-linked AI summary
Lacan: Making Accountability in Anonymous Networks Real
Naoya Takada, Yutaro Yoshinaka, Kentaro Kita, Junji Takemasa, Yuki Koizumi, Toru Hasegawa
TL;DR
Internet anonymity and accountability appear contradictory, while existing approaches impose trust or costly per-packet operations. Lacan reconciles them through contract-based anonymity and indirect four-stage linking by an off-path verifier. The paper analyzes, implements, and evaluates the protocol, reporting a realistic reconciliation under its stated assumptions.
Problem
Existing approaches to Internet anonymity and accountability rely on on-path trustees, per-packet authorization or public-key cryptography, or per-session central intervention.
Method
Lacan lets a sender remain anonymous while complying with a receiver’s contract, then uses traceable signatures, successor proofs, path validation, and encryption to link violations through session, path, packet, and plaintext.
Results
The paper presents security analysis, implementation, and performance evaluation supporting Lacan’s realistic reconciliation of anonymity and accountability.
Takeaways & Limitations
Accountability can revoke a violating sender’s anonymity while leaving compliant communication anonymous, subject to Lacan’s threat model and contract framework.
Takeaways & Limitations
Lacan does not aim to provide properties that inherently conflict with its primary goals, and its accountability limits include collusion with a majority of on-path relays.
Abstract
from arXiv · showhide
Anonymity and accountability are essential properties for our everyday activity on the Internet. However, they appear contradictory, and their reconciliation remains far from reality. Existing approaches fall short in this regard, as they either rely on an on-path trustee, per-packet authorization, per-packet public-key cryptography, or per-session intervention by a central authority. We propose Lacan, a protocol that reconciles anonymity and accountability within a realistic design. In Lacan, a sender enjoys anonymity provided by on-path relays, as long as she complies with a contract established with the receiver. Upon a contract violation, the verifier, an off-path trustee on behalf of the receiver, links the malicious message to the sender's identity indirectly via the packet, path, and session, thereby reducing public-key operations from per-packet to per-session. This linkage remains robust even against malicious relays and receivers, grounded in our novel chain of successor proofs for accountable path reconstruction, together with traceable signatures, path validation, and key-committing encryption. We analyze the anonymity and accountability, implement the protocol, and evaluate the performance.
I. Introduction
Lacan targets the tension between Internet anonymity and accountability by defining contract-based anonymity that can be revoked after violations. Its design combines session-level cryptographic linking, accountable path reconstruction, security analysis, implementation, and evaluation.
- Motivation: Lacan addresses abusive online behavior by linking contract-violating messages to senders while preserving anonymity for compliant communication.The protocol targets settings where users need privacy but services need to identify malicious users.
- Design assumptions: The protocol operates under mutual distrust, with a threat model combining a local adversary assumption for anonymity and an honest majority assumption for accountability.Network parties may behave maliciously, so cooperation must be technically enforced rather than assumed.
- Protocol design: Four-stage message linking reduces signature computation from per-packet to per-session by composing links across the message, packet, path, and session.The verifier links the session to the sender, the path to the session, the packet to the path, and the plaintext to the packet.
- Protocol design: A chain of successor proofs enables the verifier to reconstruct the communication path despite dishonest relays.The chain is part of Lacan’s accountable path-reconstruction mechanism.
- Evaluation and scope: Lacan is supported by security analysis, an implementation, and performance evaluation, with near-ideal performance when sessions carry sufficiently large data and violations are infrequent.The paper considers single-packet messages, while stating that extension to multi-packet messages is natural.
- Contract model: Contracts are deterministic, publicly evaluable functions over message plaintexts that determine whether messages comply with receiver-defined acceptance rules.Receivers publish contracts, and each session remains bound to the contract active when communication begins.
C. Anonymity Goals
Lacan seeks to preserve relationship and session anonymity while enabling accountability for contract-violating senders and misbehaving participants. It departs from prior approaches by using an off-path trustee without per-packet public-key operations, while accepting loss of bitwise unlinkability.
- Relationship anonymity keeps sender and receiver identities unlinkable, including when a compromised party inevitably learns one endpoint.
- Session unlinkability hides whether two sessions share a sender unless that sender previously violated the contract.
- After a contract violation, the receiver can identify the sender of the offending plaintext and link that sender’s future sessions.
- Prior designs rely on on-path trustees, per-session reconstruction, or per-packet proofs, exposing identities, enabling framing, or retaining expensive per-packet cryptography.
- Lacan provides sender and participant accountability through an off-path trustee while avoiding per-packet public-key cryptography and authorization.
- The protocol sacrifices bitwise unlinkability because relays must recognize identical packets to verify traversal without per-packet signatures.
B. Threat Model
The threat model considers active, polynomial-time, bitwise adversaries with bounded compromise, alongside standard cryptographic primitives and trusted infrastructure. Accountability relies on an honest majority of on-path relays, while anonymity follows a local adversary assumption.
- Adversaries may eavesdrop, alter, redirect, inject, and drop messages, but cannot obtain timing or side-channel information.
- For an honest sender, at most one party among the path relays and receiver may be corrupted; for a malicious sender, fewer than half the relays may be corrupted.
- The verifier and public directory are trusted, while off-path parties may be compromised arbitrarily.
- The protocol uses encryption, MACs, signatures, traceable signatures, undeniable signatures, authenticated key exchange, and key-committing authenticated encryption.
- Accountability is defined as an unforgeable, non-repudiable plaintext-to-sender link built indirectly across sessions, paths, and packets.
B. Linking Sessions to Senders
Lacan first links a session to the sender with an anonymous traceable signature, then supports accountable reverse path reconstruction using successor proofs. These mechanisms preserve anonymity until a violation while making malicious relay behavior non-repudiable.
- Linking Sessions to Senders: A traceable signature on sid, the hash of the sender’s ECDH public key, lets the verifier open the sender’s identity without revealing it to the receiver.
- Linking Paths to Sessions: Successor proofs are built by adjacent relays and bind their claimed adjacency and successor relationship to auxiliary session data.
- Linking Paths to Sessions: The chain of successor proofs enables the verifier to reconstruct the path in reverse order from receiver to sender.
- Linking Paths to Sessions: Successor-proof chains are unforgeable and indistinguishable, and valid chains are non-repudiable when the verifier is trusted.
- Linking Paths to Sessions: Relays must confirm or disavow proofs, allowing the verifier to identify misbehavior without falsely blaming an honest relay.
- Linking Paths to Sessions: Under the local adversary assumption, an honest sender cannot be held responsible for a path she did not establish, despite possible path diversion.
D. Linking Packets to Paths
Lacan links packets to paths through MAC-based path validation and majority voting, then links plaintexts to ciphertexts with key-committing authenticated encryption. Under an honest majority, these links resist forgery and repudiation.
- D. Linking Packets to Paths: For each packet and relay, sender-to-relay and relay-to-receiver MACs ensure ciphertext integrity across forwarding.
- D. Linking Packets to Paths: The path-establishment phase guarantees secrecy of sender–relay and relay–receiver session keys.
- D. Linking Packets to Paths: A majority of affirmative relay responses causes the verifier to conclude that a ciphertext traversed the path.
- D. Linking Packets to Paths: The packet–path links cannot be forged against an honest sender or repudiated against an honest receiver under the honest majority assumption.
- D. Linking Packets to Paths: The sender encrypts plaintext with the session key using key-committing authenticated encryption before transmission.
- D. Linking Packets to Paths: Key commitment lets the verifier uniquely link a reported plaintext to its ciphertext even when a malicious receiver selects the decryption key.
V. Lacan: Proposed Protocol
Lacan defines a packet-based protocol with shared headers, phase-specific fields, and encrypted payloads. Parties initialize keys and contracts, while receivers may rotate published credentials and contracts.
- Packet format: Lacan packets use a common header inside the encrypted TLS payload, followed by phase- and direction-specific fields.Path establishment uses distinct headers and payloads by direction; forward data transmission adds a dedicated header and encrypted data payload.
- Notation: The protocol notation includes long-term and ephemeral keys, session keys, traceable signatures, contracts, and timestamps.The notation table distinguishes sender, node, receiver, and group cryptographic material used throughout the protocol.
- Initialization: The verifier initializes group keys once and publishes the group public key.Initialization runs TSetup with security parameter 𝜅 before protocol participation begins.
- Party setup: New parties obtain a membership secret through the group manager and generate protocol key pairs.Parties acting as receivers also specify contracts before publishing their resulting public keys and contract in the public directory.
- Party setup: Published keys and contracts can be rotated at any time.The public directory stores the resulting credentials and receiver contract.
C. Path Establishment Phase
Path establishment builds an authenticated, encrypted route between sender and receiver while recording cryptographic material for later validation and tracing. Relays extend the path with successor proofs, commitments, and confirmations before the receiver replies.
- Path selection: Lacan selects relays from the public directory; three provide relationship anonymity, while at least five separate relays learning the sender and receiver.Each relay learns its two-hop-ahead successor, motivating the larger relay count.
- Forward establishment: The sender creates an ephemeral ECDH key, session identifier, traceable signature, and encrypted forwarding information for the path.The forwarding information communicates path length, relay position, and immediate predecessors and successors.
- Forward establishment: Each relay derives its sender-side key, validates predecessor material, generates an ECDH key, and appends proofs and commitments before forwarding.The relay updates K, C, Π, τ_i, and ρ_i as the packet advances.
- Receiver reply: The receiver verifies the sender signature, trapdoor non-traceability, and final path proofs, then stores the complete path evidence with K.It derives the sender-receiver session key and relay-specific keys before replying.
- Backward establishment: Relays derive their receiver-side session keys on the return path, while the sender derives the end-to-end key and verifies the receiver signature.The backward procedure completes authenticated session establishment.
D. Data Transmission Phase
Data transmission encrypts contract-compliant plaintext end to end and authenticates the ciphertext separately to each relay and the receiver. Relays forward verified packets while recording ciphertext hashes for possible reporting.
- Forward transmission: The sender encrypts plaintext with key-committing authenticated encryption and computes one MAC for each relay.The resulting packet contains the MAC list M and ciphertext c_t.
- Forward transmission: Each relay verifies its sender-side MAC, adds a receiver-side MAC, forwards the packet, and records the ciphertext hash.The hash record supports later traversal checks during violation reporting.
- Storage: Receivers may report packets for T seconds after session establishment or use probabilistic storage with a constant error.The example reporting window is T = 86400 seconds.
- Receiver processing: The receiver verifies every relay MAC, decrypts the ciphertext, and checks plaintext compliance with the contract at the timestamp.Contract evaluation occurs after authenticated delivery and decryption.
- Backward transmission: Backward packets are forwarded in reverse under end-to-end encryption, with the receiver encrypting and the sender decrypting.Relays only forward the ciphertext in this direction.
E. Violation Report Phase
When a receiver detects a contract violation, it submits the message and path evidence to the verifier. The verifier validates the report, reconstructs traversal through relay responses, and assigns blame or reveals the sender’s trapdoor only after all checks succeed.
- Report submission: A receiver reports the violating plaintext, ciphertext, session material, path evidence, signatures, and final relay identity to the verifier.The report includes K, (C, Π), τ_n, and the sender’s ephemeral public key and traceable signature.
- Report validation: The verifier first checks contract violation, decryption, sender signature, and final predecessor proof before querying relays.Failure makes the report invalid and holds the receiver accountable.
- Path reconstruction: Relay responses verify successor-proof disavowals, commitments, predecessor proofs, and ciphertext traversal records.The verifier uses these checks to detect trace disruption or diversion during path reconstruction.
- Accountability outcome: Only when every reconstruction condition succeeds does the verifier provide the receiver with the sender’s trapdoor and hold the sender accountable.Otherwise, the protocol assigns responsibility to the receiver or a relay according to the failed verification.
- Post-report action: The receiver stores the sender’s trapdoor to block future path establishment from that sender.This occurs after successful sender attribution.
A. Anonymity
Lacan preserves anonymity against non-participating parties and individual relays, while enabling a verifier to identify malicious senders or misbehaving relays after contract violations. Its accountability remains robust against path diversion, framing attempts, and several forms of repudiation under stated assumptions.
- Anonymity: Non-participating parties learn no relationship anonymity, while sessions remain unlinkable because Lacan protects inter-party messages with TLS and hides sessions.A single relay learns only limited local path information, including its position and nearby nodes.
- Anonymity: The receiver does not learn the sender’s identity unless it successfully reports a violation, although it learns the message plaintext.This plaintext leakage is outside the protocol’s upper-layer scope.
- Accountability: Traceable signatures prevent malicious senders from evading accountability, while the verifier can identify the sender or last misbehaving relay under the honest majority assumption.The sender submits a valid traceable signature during session establishment, enabling later identification through unforgeability.
- Accountability: Successor-proof manipulation, packet-traversal denial, and path diversion still preserve participant accountability, including when tracing reaches a different malicious sender.A diverted reconstruction may hold the alternate sender accountable rather than the sender originally opened by the traceable signature.
- Accountability: Lacan detects framing attempts and prevents retroactive accusations or forged links under the honest majority assumption.Contracts bind communications to the contract active when the session begins, and traceable signatures resist framing.
- Limitations: Anonymity against end-to-end observers is outside Lacan’s scope because packet-path linkage requires relays to recognize identical packets.The protocol protects against adversaries observing only a partial path segment, not both ends of the path.
2) Security without honest majority:
Lacan’s performance and deployment tradeoffs center on moving cryptographic work from packets to sessions while retaining an off-path verifier. The implementation demonstrates efficient data forwarding, but the design depends on explicit assumptions and incurs storage and reporting costs.
- Potential Extensions: Lacan restricts contracts to well-defined predicates and cannot ensure accountability when a malicious sender colludes with a majority of on-path relays.The latter limitation follows from eliminating per-packet signatures.
- Computation and Communication: Data transmission processing is approximately four orders of magnitude lighter than the other phases because Lacan eliminates per-packet public-key cryptography.For n=3, each node processes a data packet in around 10^4 cycles, versus roughly 10^7–10^8 cycles during path establishment.
- Computation and Communication: With 8 cores and 1322-byte data, relay throughput reaches 14.37 Gbps, while relay latency remains below 10^4 cycles across forwarding rates from 10% to 100%.The latency measurements use n=3 and 512- or 1322-byte data.
- Computation and Communication: Violation-report performance depends on contract-evaluation cost and verifier communication, with overall latency dominated by the sum of n round-trip times.Baseline costs are around 10^6, 10^7, and 10^8 cycles at relays, the receiver, and the verifier, respectively.
- Computation and Communication: At 5.4 Gbps for 512-byte packets over T=86400 seconds, packet hashes require 3.6 TB of storage and 42 MB/s sustained write bandwidth.The paper states that this storage and write rate fit commodity server-grade HDD capacity.
- No trusted verifiers: Distributing the verifier across m parties relaxes central trust by requiring at least t_V > m/2 honest verifiers for threshold traceability.The extension replaces traceable signatures with group signatures and identifies a sender only through sufficient verifier cooperation.
- Conclusion: The paper concludes that security analysis, implementation, and performance evaluation demonstrate a realistic reconciliation of anonymity and accountability.This conclusion summarizes the protocol-level claim rather than a particular benchmark.