On the Complexity of Anonymous Communication Through Public Networks

TL;DR

This paper introduces the first onion routing protocol that guarantees fault-tolerance, efficiency, and anonymity even against active adversaries controlling a fraction of the network, with polylogarithmic complexity.

Contribution

The paper presents a novel onion routing protocol that achieves fault-tolerance, efficiency, and anonymity simultaneously under active adversarial conditions.

Findings

Protocol tolerates polylogarithmic onion drops while maintaining delivery.

Requires polylogarithmic rounds and onions per participant for security.

Introduces new security properties: mixing and equalizing, which imply anonymity.

Abstract

Onion routing is the most widely used approach to anonymous communication online. The idea is that Alice wraps her message to Bob in layers of encryption to form an "onion," and routes it through a series of intermediaries. Each intermediary's job is to decrypt ("peel") the onion it receives to obtain instructions for where to send it next, and what to send. The intuition is that, by the time it gets to Bob, the onion will have mixed with so many other onions, that its origin will be hard to trace even for an adversary that observes the entire network and controls a fraction of the participants, possibly including Bob. In spite of its widespread use in practice, until now no onion routing protocol was known that simultaneously achieved, in the presence of an active adversary that observes all network traffic and controls a constant fraction of the participants, (a) fault-tolerance, where even if a few of the onions are dropped, the protocol still delivers the rest; (b) reasonable communication and computational complexity as a function of the security parameter and the number of participants; and (c) anonymity. In this paper, we give the first onion routing protocol that meets these goals: our protocol (a) tolerates a polylogarithmic (in the security parameter) number of dropped onions and still delivers the rest; (b) requires a polylogarithmic number of rounds and a polylogarithmic number of onions sent per participant per round; and (c) achieves anonymity. We also show that to achieve anonymity in a fault-tolerant fashion via onion routing, this number of onions and rounds is necessary. Of independent interest, our analysis introduces two new security properties of onion routing -- mixing and equalizing -- and we show that together they imply anonymity.

Tables

Table 1. Table 1: A comparison of properties of provably secure onion routing (and similar) protocols. Our protocol Π ⋈ subscript Π ⋈ \Pi_{\bowtie} is the first construction shown to be simultaneously practical, fault tolerant, and anonymous in the active adversary setting. In the table entries: 𝗉𝗈𝗅𝗒𝗅𝗈𝗀 ​ ( λ ) = def γ 1 ​ log 1 + γ 2 ⁡ λ superscript def 𝗉𝗈𝗅𝗒𝗅𝗈𝗀 𝜆 subscript 𝛾 1 superscript 1 subscript 𝛾 2 𝜆 \mathsf{polylog}(\lambda)\mathrel{\stackrel{{\scriptstyle\makebox[0.0pt]{\mbox{\tiny def}}}}{{=}}}\gamma_{1}\log^{1+\gamma_{2}}\lambda for any γ 1 , γ 2 > 0 subscript 𝛾 1 subscript 𝛾 2 0 \gamma_{1},\gamma_{2}>0 ; N 𝑁 N denotes the number of participants; n 𝑛 n denotes the number of servers; and | G | 𝐺 |G| denotes the size of a group of servers. In general, we want n 𝑛 n and | G | 𝐺 |G| to be at least 𝗉𝗈𝗅𝗒𝗅𝗈𝗀 ​ ( λ ) 𝗉𝗈𝗅𝗒𝗅𝗈𝗀 𝜆 \mathsf{polylog}(\lambda) to ensure that at least one server in each group is honest.

Protocol	Server load	# of rounds	Fault tolerant?	Security
${\Pi }_p$ [ALU18]	$\mathrm{𝗉𝗈𝗅𝗒𝗅𝗈𝗀}\left(\lambda \right)$	$\mathrm{𝗉𝗈𝗅𝗒𝗅𝗈𝗀}\left(\lambda \right)$	not applicable	(passive) anonymity
Vuvuzela [vdHLZZ15]	$N$	$n$	no	diff. privacy
Stadium [TGL+17]	$\text{bigsmallO}\frac{N}{\left|G\right|}$	$\text{bigsmallO}\left|G\right|$	no	diff. privacy
Atom [KCDF17]	$\text{bigsmallO}\frac{N\left|G\right|}{n}$	$\text{bigsmallO}\left|G\right|$	#1: no	anonymity
			#2: yes	$k$-anonymity
${\Pi }_a$ [ALU18]	$\mathrm{𝗉𝗈𝗅𝗒𝗅𝗈𝗀}\left(\lambda \right)$	$\mathrm{𝗉𝗈𝗅𝗒𝗅𝗈𝗀}\left(\lambda \right)$	yes	diff. privacy
${\Pi }_{\bowtie }$ (this work)	$\mathrm{𝗉𝗈𝗅𝗒𝗅𝗈𝗀}\left(\lambda \right)$	$\log N\mathrm{𝗉𝗈𝗅𝗒𝗅𝗈𝗀}\left(\lambda \right)$	yes	anonymity

Equations

$$E(B)=\{((P,i),(Q,i+1))$$

$$P_s$$

$$O^0$$

$$O^1$$

$${\mathsf{Adv}}_{\text{adv}}$$

$$\text{expect}W$$

$$=N^{\prime }-N^{\prime }{\left(1-\frac{1}{N^{\prime }}\right)}^X$$

$$>N^{\prime }-N^{\prime }\left(1-\frac{X}{N^{\prime }}+\frac{X(X-1)}{{N^{\prime }}^2}\right)$$

$$=X\left(1-\frac{X-1}{N^{\prime }}\right)\ge \frac{X}{2},$$

$$Z_i=\text{expect}X|Y_1,\dots ,Y_i.$$

$$\text{prob}X-\text{expect}X\ge \delta \text{expect}W$$

$$\le \mathsf{exp}\left(-\frac{{\delta }^2(X/2{)}^2}{2X}\right)$$

$$=\mathsf{exp}\left(-\frac{{\delta }^{2}X}{8}\right)$$

$$\le \mathsf{exp}\left(-\frac{(\log \lambda -2{)}^2\alpha {\log }^2\lambda }{8{\log }^2\lambda }\right)$$

$$=\mathsf{exp}\left(-\frac{\alpha (\log \lambda -2{)}^2}{8}\right)$$

$$=\text{negl},$$

$$X-\text{expect}X\le \delta \text{expect}W.$$

$$W$$

$$=\left(1-\frac{\log \lambda -2}{\log \lambda }\right)\text{expect}W$$

$$=\frac{2}{\log \lambda }\text{expect}W$$

$$\ge \frac{X}{\log \lambda },$$

$${\nu }_{e+1}$$

$$=2(1-\delta )\left(\frac{{\nu }_e^2}{2}+(1-\alpha ){\nu }_e(1-{\nu }_e)\right)$$

$$=(1-\delta ){\nu }_e^2+2(1-\delta ){\nu }_e-2(1-\delta ){\nu }_e^2-2(1-\delta )\alpha {\nu }_e+2(1-\delta )\alpha {\nu }_e^2$$

$$\stackrel{\text{makebox}[0.0pt]\text{mbox}def}{=}{\xi }_{e+1}.$$

$${\nu }_{e+2}$$

$$=2(1-\delta )\left(\frac{{\xi }_{e+1}^2}{2}+\left(1-\beta \right){\xi }_{e+1}(1-{\xi }_{e+1})\right)$$

$$=2(1-\delta )\left(1-\beta \right){\xi }_{e+1}+2(1-\delta )\left(\beta -\frac{1}{2}\right){\xi }_{e+1}^2$$

$$\stackrel{\text{makebox}[0.0pt]\text{mbox}def}{=}{\xi }_{e+2}.$$

$$\frac{\partial {\xi }_{e+2}}{\partial \alpha }$$

$$=\left(2(1-\delta )\left(1-\beta +(2\beta -1){\xi }_{e+1}\right)\right)\left(2(1-\delta )\left({\nu }_e^2-{\nu }_e\right)\right)$$

$$=4(1-\delta {)}^2\left({\nu }_e^2-{\nu }_e\right)\left(1-\beta +(2\beta -1){\xi }_{e+1}\right)$$

$$\le 0,$$

$$\text{expect}{w}_i=\text{prob}{w}_i=1=\frac{\left(\genfrac{}{}{0ex}{}{2u-2}{2v-2}\right)}{\left(\genfrac{}{}{0ex}{}{2u}{2v}\right)}$$

$$=\frac{2v(2v-1)}{2u(2u-1)},$$

$$\text{expect}w$$

$$\text{expect}W=\left(\frac{2v-1}{2u-1}\right)|\mathcal{V}|=\left(\frac{2v-1}{2v-\nu }\right)\left(\frac{\nu (2u-1)}{2u-1}\right)|\mathcal{V}|=\left(\frac{2v-1}{2v-\nu }\right)\nu |\mathcal{V}|.$$

$$Z_i=\text{expect}W|Y_1,Y_2,\dots ,Y_i.$$

$$\text{prob}|W-\text{expect}W|\ge \delta \text{expect}W\le 2\exp \left(-\frac{{\delta }^2\text{expect}{W}^2}{{\sum }_{i=1}^{2v}1}\right)$$

$$=2\exp \left(-\text{bigsmallO}1\cdot 2v\right)$$

$$=\mathsf{negl}(\lambda ).$$

$$\text{expect}{\zeta }_1$$

Full text

In spite of its widespread use in practice, until now no onion routing protocol was known that simultaneously achieved, in the presence of an active adversary that observes all network traffic and controls a constant fraction of the participants, (a) fault-tolerance, where even if a few of the onions are dropped, the protocol still delivers the rest; (b) reasonable communication and computational complexity as a function of the security parameter and the number of participants; and (c) anonymity.

In this paper, we give the first onion routing protocol that meets these goals: our protocol (a) tolerates a polylogarithmic (in the security parameter) number of dropped onions and still delivers the rest; (b) requires a polylogarithmic number of rounds and a polylogarithmic number of onions sent per participant per round; and (c) achieves anonymity. We also show that to achieve anonymity in a fault-tolerant fashion via onion routing, this number of onions and rounds is necessary.

Of independent interest, our analysis introduces two new security properties of onion routing — mixing and equalizing — and we show that together they imply anonymity.

Keywords: Anonymity, privacy, onion routing.

1 Introduction

Suppose that Alice wishes to send a message anonymously to Bob. Informally, by anonymously, we mean that no one (not even Bob) can distinguish the scenario in which Alice sends a message to Bob from an alternative scenario in which it is Allison who sends a message to Bob. To begin with, Alice can encrypt the message and send the encrypted message to Bob so that only Bob can read the message. However, an eavesdropper observing the sequence of bits coming out of Alice’s computer and the sequence of bits going into Bob’s computer can still determine that Alice and Bob are communicating with each other if the sequences of bits match. Thus, encryption is not enough.

Onion routing [Cha81] is the most promising approach to anonymous channels to date. In onion routing, messages are sent via intermediaries and wrapped in layers of encryption, resulting in so-called onions; each intermediary’s task is to “peel off” a layer of encryption and send the resulting onion to the next intermediary or its final destination. The onion’s layers are unlinkable to each other, and so its route through the network cannot be traced from merely observing the sequences of bits that Alice transmits and Bob receives. However, even with Alice sending her message to Bob encoded as an onion, her communication can still be tracked by a resourceful eavesdropper with an extensive view of the network traffic (e.g., an ISP-level or an AS-level adversary) who can observe all Internet traffic.

An adversary who can observe all network traffic is called a network adversary. An adversary who, in addition to observing all network traffic, controls a subset of the participants, is called the passive adversary if it follows the prescribed protocol, or active if it does not. The three adversary models — the network adversary, the passive adversary, and the active adversary — are standard for analyzing cryptographic protocols such as multi-party computation (MPC) [GMW87]. The most desirable goal is to achieve security in the presence of the most powerful of these three adversaries, i.e., the active adversary, corrupting as large a fraction of the participants as possible.

It was known how to construct an onion routing protocol that is both efficient and anonymous from the passive adversary who corrupts a constant fraction of the parties; an example of this is the protocol $\Pi_{p}$ [ALU18]. In $\Pi_{p}$, each user forms an onion bearing his message to its recipient; the users’ onions are routed independently and uniformly at random through a network of servers. $\Pi_{p}$ is anonymous from the passive adversary provided that the onions travel for a superlogarithmic (in the security parameter) number of rounds, and the average number of onions per server per round is also superlogarithmic [ALU18] . However, $\Pi_{p}$ isn’t anonymous from the active adversary who causes the parties under his control to deviate from the protocol. To see why this is the case, consider the following attack: Suppose that the adversary $\adv$ suspects that Alice is communicating with Bob. Because $\adv$ is active, he can disrupt Alice’s communication by dropping Alice’s outgoing onion in the event that Alice’s first intermediary is corrupt (the probability of this event is identical to the fraction of parties that are under the adversary’s control). If Bob doesn’t receive an onion at the end of the protocol, then $\adv$ can infer that her suspicion was correct: Alice’s interlocutor is Bob!

So what can we do instead? Of course, we could use general-purpose multi-party computation (MPC) [GMW87]. Every party will receive as input a message and its destination, and every party will receive as output the messages that were meant for him/her. In addition to perfect anonymity, this approach provides fault tolerance: in MPC that is secure against the active adversary, the honest parties are guaranteed to receive their output no matter how much the adversary deviates from the protocol. The problem with this approach that relies on general-purpose MPC is that it is too inefficient: the most efficient general MPC protocol still requires that at least some of the participants send and receive $\Omega(N)$ bits, where $N$ is the number of participants. (See Cramer, Damgård, and Nielsen [CDN15].)

Recently proposed protocols, Stadium [TGL*+*17] and Atom [KCDF17], are more efficient. However, they are not fault-tolerant: honest parties will abort the protocol run whenever even a single message packet is dropped. Thus, while this approach provides anonymity from the active adversary, it is also extremely fragile: if just one message is dropped (which could be the result of an innocuous fault), the entire network suffers a catastrophic failure. In contrast, we would like to design onion routing protocols that can tolerate faults. Thus, compared to MPC and Stadium-Atom-type protocols, onion routing appears attractive from the efficiency and fault tolerance points of view.

In this paper, we answer these fundamental questions: (1) Can an onion routing protocol be simultaneously anonymous, fault-tolerant, and efficient? (2) What is the communication complexity sufficient for anonymous and fault-tolerant onion routing? (3) What is the communication complexity required for this? We provide a lower bound and match it with a nearly optimal protocol.

1.1 Problem setting

Before describing our results in detail, let us first define our problem setting. Let $\mathcal{P}\mathrel{\stackrel{{\scriptstyle\makebox[0.0pt]{\mbox{\tiny def}}}}{{=}}}\{P_{1},P_{2},\dots,P_{N}\}$ denote the set of $N$ parties, participating in an onion routing protocol. We assume that the protocol progresses in global rounds and that an onion sent at round $r$ arrives at its destination prior to round $r+1$. Moreover, the adversary is modelled with rushing, i.e., the adversary receives onions sent in round $r$ instantaneously in round $r$.111 We do not consider the asynchronous communication model [CR93] in which Alice’s outgoing onions (including her onion to her recipient Bob) can be delayed indefinitely. In such a case, we cannot even guarantee correctness (i.e., message delivery when no party deviates from the protocol). We assume that the number $N$ of participants and every other quantity in the protocol is polynomially bounded in the security parameter $\lambda$.

Setup.

We define an onion routing protocol to be a protocol in which the honest parties form and process only message packets that are cryptographic onions. To do this, the honest parties use a secure onion encryption scheme, which is a triple of algorithms: $(\mathsf{Gen},\mathsf{FormOnion},\mathsf{ProcOnion})$. See Section 2.1 for more details and Camenisch and Lysyanskaya’s paper [CL05] and follow-up papers [KBS19, AL20] for formal definitions, including security definitions.

During setup of an onion routing protocol, each honest party $P$ generates a public-key pair $(\pk(P),\sk(P))\leftarrow\mathsf{Gen}(1^{\lambda})$ using the onion encryption scheme’s key generation algorithm $\mathsf{Gen}$. Each party $P$ publishes his/her public key $\pk(P)$ to a public directory so that everyone knows everyone else’s public keys.

Inputs: the simple input/output setting.

Let $\mathcal{M}$ be the space of fixed-length messages.

An input $\sigma=(\sigma_{1},\dots,\sigma_{N})$ to the protocol is a vector of inputs, where $\sigma_{i}$ is a set of message-recipient pairs for party $P_{i}$. For $m\in\mathcal{M}$ and $P_{j}\in\mathcal{P}$, the inclusion of a message-recipient pair $(m,P_{j})$ in input $\sigma_{i}$ means that party $P_{i}$ is instructed to send message $m$ to recipient $P_{j}$.

In this paper, we consider the following “benchmark” input space, dubbed the simple input/output setting (I/O). An input $\sigma=(\sigma_{1},\dots,\sigma_{N})$ is in the simple I/O setting if there exists a permutation function $\pi:\mathcal{P}\mapsto\mathcal{P}$ such that each party $P\in\mathcal{P}$ is instructed to send a message to party $\pi(P)$ and no other message, i.e., $\forall P\in\mathcal{P}$, $\exists m_{P}\in\mathcal{M}$ s.t. $\sigma_{P}=\{(m_{P},\pi(P))\}$.222 Why do we need a benchmark? As the following shows, without appropriately constraining the input space, the onion cost can be arbitrarily high: Suppose that the adversary observes the traffic (i.e., the onions) on all links but does not corrupt any of the parties. The adversary knows that each party will send a fixed-length message to the “central hub” $H\in\mathcal{P}$ (and no one else) but doesn’t know which party is $H$. A protocol that is anonymous in this setting necessarily incurs a large communication overhead. This is because a party who receives fewer than $N$ onions cannot be $H$, and so, all but one party must receive at least $N$ dummy onions.

The simple I/O setting is a superset of the spaces considered in prior works [vdHLZZ15, TGL*+*17, KCDF17, ALU18].

Adversary model.

Unless stated otherwise, the adversary is active and can observe the traffic on all communication channels and, additionally, can non-adaptively corrupt and control a constant fraction of the parties. By non-adaptively, we mean that the corruptions are made independently of any protocol run.333 If we were to allow the adversary to adaptively corrupt parties, then the adversary could easily block all of Alice’s onions. For every onion $O$ sent by Alice, the adversary can corrupt the party $P$ who receives $O$ in time to direct $P$ to drop the onion obtained from processing $O$ before the next round.

Without loss of generality, this type of corruption is captured by allowing the adversary to select the set $\mathsf{Bad}$ of corrupted parties prior to the beginning of the protocol. Once the adversary corrupts a party, the adversary can observe the internal state and computations of the corrupted party and arbitrarily alter the behavior of the party.

Views and outputs.

By $\mathsf{V}^{\Pi,\adv}{(1^{\lambda},\sigma)}$, we denote the adversary $\adv$’s view from interacting with protocol $\Pi$ on input the security parameter $1^{\lambda}$ and the instructions $\sigma$. The view consists of all the observations that $\adv$ makes during the run: the values and positions of every onion at every round, the states and computations of every corrupted party between every pair of consecutive rounds, the randomness used by $\adv$, and the numbers of messages received by the honest parties. The view does not include the honest parties’ randomness. $\mathsf{V}^{\Pi,\adv,\mathsf{Bad}}{(1^{\lambda},\sigma)}$ denotes $\adv$’s view given its choice $\mathsf{Bad}$ for the corrupted parties. At the end of the protocol run, each honest party $P_{i}$ outputs the set $\mathsf{O}^{\Pi,\adv}_{i}{(1^{\lambda},\sigma)}$ of (non-empty) messages from the message space $\mathcal{M}$ that $P_{i}$ receives from interacting with adversary $\adv$ in a run of protocol $\Pi$ on input $\sigma$. We define the output $\mathsf{O}^{\Pi,\adv}{(1^{\lambda},\sigma)}$ of protocol $\Pi$ in an interaction with adversary $\adv$ on input $\sigma$ as the $N$ parties’ outputs:444Technically, the view and the output may depend on other parameters, such as the public parameters (denoted, $\mathsf{pp}$) and the parties’ states (denoted, $\mathsf{states}$). Thus, we could be more precise by denoting the view and the output as $\mathsf{V}^{\Pi,\adv}{(1^{\lambda},\mathsf{pp},\state,\sigma)}$ and $\mathsf{O}^{\Pi,\adv}{(1^{\lambda},\mathsf{pp},\mathsf{states},\sigma)}$, but we will use the simpler notation for better readability. $\mathsf{O}^{\Pi,\adv}{(1^{\lambda},\sigma)}\mathrel{\stackrel{{\scriptstyle\makebox[0.0pt]{\mbox{\tiny def}}}}{{=}}}(\mathsf{O}^{\Pi,\adv}_{1}{(1^{\lambda},\sigma)},\mathsf{O}^{\Pi,\adv}_{2}{(1^{\lambda},\sigma)},\dots,\mathsf{O}^{\Pi,\adv}_{N}{(1^{\lambda},\sigma)}).$

1.2 Our results

We now describe our results in more detail. Our construction pertains to the problem setting described in Section 1.1. Our lower bound applies more generally to any arbitrary input set (not necessarily constrained to the simple I/O setting).

Anonymity, mixing, and equalizing.

Following prior work [vdHLZZ15, TGL*+*17, KCDF17, ALU18], we use a natural game-based definition of anonymity: A protocol is anonymous if the adversary cannot distinguish the scenario in which Alice sends a message to Bob while Carol sends one to David, from one in which Alice’s message goes to David while Carol’s goes to Bob. (See Definition 3.) More precisely, for any pair of inputs $(\sigma^{0},\sigma^{1})$ that agree on the inputs and outputs for the adversarial participants, $\mathsf{O}^{\Pi,\adv}{(1^{\lambda},\sigma^{0})}\approx\mathsf{O}^{\Pi,\adv}{(1^{\lambda},\sigma^{1})}$, where “$\approx$” denotes computational indistinguishability.

We relate anonymity of an onion routing protocol to two new concepts: An onion routing protocol mixes if it sufficiently shuffles the honest users’ onions making it infeasible for the adversary to trace a received message back to its sender. A protocol equalizes if the adversary cannot determine the input from the numbers of messages received by the parties; in other words, the number of messages output by each participant — or the fact that a participant did not receive an output at all — are random variables that are computationally unrelated to the input vector $\sigma$. (See Definitions 4 and 5.)

We show that in many cases, mixing and equalizing implies anonymity, i.e., an onion routing protocol that mixes and equalizes is anonymous. (See Theorem 1 for the formal theorem statement.) We use this to prove that our protocol is anonymous. Anonymity also implies equalizing; this observation is useful for proving a lower bound that (almost) matches our protocol.

Efficient, robust, and anonymous onion routing.

As we just explained, our strategy is to construct a protocol that mixes and equalizes.

Intuitively, mixing is the easier one to achieve: the onions need to sufficiently shuffle with other onions traveling over the network to ensure that each of them is hard to trace. This intuition is essentially correct, with the caveat that an active adversary can strategically interfere with this process by dropping onions. To ensure that each onion shuffles with a sufficiently large number of onions (formed by an honest party) a sufficiently large number of times, our protocol uses checkpoint onions [ALU18] that each intermediary expects to receive, and if a constant fraction (e.g., one-third) of them don’t arrive because the adversary dropped them, the protocol aborts.

An active adversary who controls a fraction of the participants can try to “isolate” an honest party Alice from the rest of the network by dropping all of the messages/onions received directly from Alice. In a fault-tolerant network protocol, the remaining participants may still be able to get their messages through to their destinations. Thus, based on who received an output, an adversary can infer who Alice’s intended recipient was. This attack explains why equalizing is difficult to achieve.

To overcome this attack, we introduce a new type of onions, called merging onions. When two merging onions belonging to the same pair arrive at some intermediary $I$, $I$ recognizes that they are from the same pair (although, other than their next layer and destination, $I$ does not learn anything else about them). The protocol directs $I$ to discard one of them (chosen at random) while sending its mate along. If only one onion of the pair arrived at $I$ while its mate is missing (i.e. the adversary dropped it some time earlier in the protocol run), then $I$ simply sends along the mate that survived, and there is nothing to discard.

Why does this help? Suppose that both Alice and Allison created $2^{h}$ merging onions; at rounds $r_{1}$, $r_{2}$, $\ldots$, $r_{h}$ each of these onions (if it hasn’t been deleted yet) will meet a mate. Say, exactly one of Alice’s onions is dropped by the adversary at some point prior to round $r_{1}$, so its mate (the onion it was supposed to pair with at round $r_{1}$) was not dropped. Also, suppose that none of Allison’s onions were dropped. Then at round $r_{1}$ all but one of Alice’s remaining merging onions will meet a mate, and half of them will be dropped, so exactly $2^{h-1}$ of Alice’s onions will remain in the system — which is exactly how many of Allison’s onions remain. Additional $h-1$ opportunities to merge account for the possibility that the adversary has dropped a larger number of Alice’s onions. Merging onions ensure that the number of Alice’s onions that remain in the system at the end of the protocol is the same as the number of Allison’s onions, i.e., that the protocol equalizes. The fact that Alice was targeted and many of her onions had been dropped doesn’t matter, because the protocol discards all but one of them anyway! (See Section 4 for a more in-depth description of merging onions and how to construct them.)

Positive result: We construct an onion routing protocol $\Pi_{\bowtie}$, pronounced “Pi-butterfly,” because it uses a butterfly network. $\Pi_{\bowtie}$ takes advantage of the merging onions technique described above. It is (1) anonymous from the active adversary who can corrupt up to a constant fraction $\kappa<\frac{1}{2}$ of the parties and (2) robust, i.e. whenever the adversary drops at most logarithmic (in the security parameter) number of message packets (i.e. onions), $\Pi_{\bowtie}$ delivers the messages from honest senders with overwhelming probability. Moreover, (3) during the execution of the protocol, every honest party transmits up to a polylog (in the security parameter) number of onions: specifically $\gamma_{1}\log N\log^{3+\gamma_{2}}\lambda$ onions, where $N$ is the number of participants, and $\lambda$ is the security parameter. $\gamma_{1}$ and $\gamma_{2}$ are parameters that can be set as desired: increasing them increases the rate at which the maximum distance in the adversarial views for any two inputs shrinks. (See Theorem 3 for the precise relationship.)

Matching negative result.

Our protocol is essentially optimal as far as both the round complexity and the number of onions each participant sends out are concerned. For why anonymity requires superlogarithmic round complexity, we refer the reader to prior work [DMMK20, Chr20]. In Section 7, we explain why a protocol that is robust and anonymous in the presence of an active adversary that corrupts a constant fraction of participants requires a polylogarithmic number of onions sent out per participant.

1.3 Related work

Our work is inspired by the fact that Tor [DMS04], the most widely adopted anonymous communication system, is also known to have numerous security flaws [ØS06, JWJ*+*13, SEV*+*15, WSJ*+*18]: Tor is based on a highly efficient design that favors practicality over security and is not secure even from the passive adversary [DMMK18]. Moreover, it has been shown to be vulnerable to network traffic correlation attacks [ØS06, JWJ*+*13, SEV*+*15, WSJ*+*18]. Thus, our goal was to design a protocol that was as close to Tor’s efficiency and fault tolerance as possible, while also being provably anonymous.

We consider a very specific and narrow problem in the much larger field of anonymous messaging systems. Although our definition of anonymity and adversary models are standard in cryptography, other definitions have been considered [BKM*+*13, BFT04, CPP08, DRS04, AAC*+*11] and positive results for alternative models are known [BFT04, BGKM12, BKM*+*13].

Atom [KCDF17] is a current state-of-the-art anonymous protocol in the active adversary setting. It is similar to an onion-routing protocol555Like a cryptographic onion, each message packet in Atom is layered encryption object but without a sender-defined routing path. and comes in two variants. Atom uses a known random permutation network (e.g., a square network) to mix the message packets. Each node of the random permutation network is really a sufficiently large random sample of the parties, such that the probability that all parties in the sample are corrupt is very small. In Atom #1, to shuffle message packets at a node, every member of the node verifiably shuffles [FS01] the packets and broadcasts a proof to every other member of the node. If an honest party detects a discrepancy, the party aborts the protocol. This guarantees anonymity. The downside is that Atom #1 is highly fragile; the honest parties abort the protocol even if only a single packet is dropped. The second variant, Atom #2, uses threshold cryptography and so can tolerate some dropped messages at a cost in privacy; it only guarantees $k$-anonymity.

A slightly older system, called Vuvuzela [vdHLZZ15], assumes that all messages travel through the same set of dedicated servers and is therefore impractical compared to Tor. Their solution is also highly fragile and cannot tolerate a single dropped onion. Stadium [TGL*+*17] is a distributed solution that uses verifiable shuffling as its underpinning. Unlike Vuvuzela, Stadium is a properly load-balanced solution but, like Vuvuzela, also suffers from fragility.

Vuvuzela, Stadium, and Atom #2 were not shown to be anonymous. In fact, since these protocols are unable to efficiently equalize, from Theorem 1, they cannot be anonymous: In Vuvuzela and in Stadium, the numbers of onions received at a dead-drop (an address at one of the servers) is a function of the number of conversing parties. Thus, adding a random (but polynomially-bounded) number of dummy onions can provide differential privacy but not anonymity. In Atom #2, the adversary can drop an honest message packet upfront (at its first hop) and know that any message received in the end was not sent by a particular sender. See Table 1.

Other provably anonymous systems exist [Cha88, RS93, CB95, CBM15], but they are not nearly as efficient. Achieving anonymous channels using heavier cryptographic machinery has been considered also. One of the earliest examples is Chaum’s dining cryptographer’s protocol [Cha88]. Rackoff and Simon [RS93] use secure multiparty computation for providing security from active adversaries. Other cryptographic tools used in constructing anonymity protocols include oblivious RAM (ORAM) and private information retrieval (PIR) [CB95, CBM15]. Corrigan-Gibbs et al.’s Riposte solution makes use of a global bulletin board with a latency of days [CBM15].

We are not the first to look into lower bounds on the complexity of anonymous messaging protocols (e.g., [DMMK18]). However, all other lower bounds are for the setting where every participant is guaranteed to receive an output, and don’t apply to protocols that allow aborts or that allow some participants to receive an output while others’ output doesn’t make it through.

2 Preliminaries: Onion routing protocols

For a set $\mathcal{S}$, we denote the cardinality of $\mathcal{S}$ by $|\mathcal{S}|$, and $s\sample\mathcal{S}$ denotes that $s$ is chosen from $\mathcal{S}$ uniformly at random. For an algorithm $A(x)$, $y\leftarrow A(x)$ is the (possibly probabilistic) output $y$ from running $A$ on the input $x$. In this paper, $\log(x)$ is the logarithm of $x$ base $2$.

We say that a function $f:\mathbb{N}\mapsto\mathbb{R}$ is negligible in the parameter $\lambda$, written $f(\lambda)=\negl$, if for a sufficiently large $\lambda$, $f(\lambda)$ decays faster than any inverse polynomial in $\lambda$. When $\lambda$ is the security parameter, an event $E_{\lambda}$ is said to occur with (non-)negligible probability if the probability of $E_{\lambda}$ can(not) be bounded above by a function negligible in $\lambda$. An event occurs with overwhelming probability (abbreviated, w.o.p.) if its complement occurs with negligible probability. We use the standard notion of a pseudorandom function [Gol01, Chapter 3.6].

2.1 Onion encryption schemes

Our work on onion routing builds upon a secure onion encryption scheme [CL05, KBS19, AL20]. Recall that an onion encryption scheme is a triple: $(\mathsf{Gen},\mathsf{FormOnion},\mathsf{ProcOnion})$. The algorithm $\mathsf{Gen}$ generates a participant key pair, i.e., a public key and a secret key. The algorithm $\mathsf{FormOnion}$ forms onions, and the algorithm $\mathsf{ProcOnion}$ processes onions.

Let $\mathcal{P}$ be a set of participants, and let $\mathsf{Bad}\subseteq\mathcal{P}$ be the set of corrupt parties. For every honest $P\in\mathcal{P}\setminus\mathsf{Bad}$, let $(\pk(P),\sk(P))\leftarrow\mathsf{Gen}(1^{\lambda},\mathsf{pp},P)$ be the key pair generated for party $P$, where $\lambda$ is the security parameter, and $\mathsf{pp}$, the public parameters. For every corrupt party $P\in\mathsf{Bad}$, let $\pk(P)$ denote $P$’s public key.

Let $\mathcal{M}$ be the message space consisting of messages of the same fixed length, and let the nonce space $\mathcal{S}$ consist of nonces of the same fixed length. These lengths may be a function of the security parameter $\lambda$. Here, a nonce is really any metadata associated with an onion layer.

The algorithm $\mathsf{FormOnion}$ takes as input a message $m\in\mathcal{M}$, an ordered list $(Q_{1},\dots,Q_{0pt-1},R)$ of parties from $\mathcal{P}$, the public keys $(\pk(Q_{1}),\dots,\pk(Q_{0pt-1}),\pk(R))$ associated with these parties, and a list $(s_{1},\dots,s_{0pt-1})$ of (possibly empty) nonces from $\mathcal{S}$ associated with the layers of the onion.666Technically, the input/output syntax and constructions of [CL05, AL20] do not include the sequence $(s_{1},\dots,s_{0}pt)$ of nonces but can easily be extended to do so; if we use layered CCA2-secure encryption instead of onion encryption — which is fine for this application — then incorporating the nonces is trivial. The party $R$ is interpreted as the recipient of the message, and the list $(Q_{1},\dots,Q_{0pt-1},R)$ is the routing path. The output of $\mathsf{FormOnion}$ is a sequence $(O_{1},\dots,O_{0pt})$ of onions. Such a sequence is referred to as an evolution, but every $O_{i}$ in the sequence is an onion. Because it is convenient to think of an onion as a layered encryption object where processing an onion $O_{i}$ produces the next onion $O_{i+1}$, we sometimes refer to the process of revealing the next onion as “decrypting the onion” or “peeling the onion.”

For every $i\in[0pt-1]$, only intermediary party $Q_{i}$ can peel onion $O_{i}$ to reveal the next layer, $(O_{i+1},Q_{i+1},s_{i+1})\leftarrow\mathsf{ProcOnion}(\sk(Q_{i}),O_{i},Q_{i}),$ which contains the peeled onion $O_{i+1}$, the next destination $Q_{i+1}$ of the onion, and the nonce $s_{i+1}$. Only the recipient $R$ can peel the innermost onion $O_{d}$ to reveal the message, $m\leftarrow\mathsf{ProcOnion}(\sk(R),O_{0pt},R).$

In our constructions, a sender of a message $m$ to a recipient $R$ “forms an onion” by generating nonces and running the $\mathsf{FormOnion}$ algorithm on the message $m$, a routing path $(Q_{1},\dots,Q_{0pt-1},R)$, the keys $(\pk(Q_{1}),\dots,\pk(Q_{0pt-1}),\pk(R))$ associated with the parties on the routing path, and the generated nonces; the formed onion is the first onion $O_{1}$ from the list of outputted onions. The sender (i.e., the party who formed the onion) can send $O_{1}$ to the first party $Q_{1}$ on the routing path, who can process $O_{1}$ and send the peeled onion $O_{2}$ to the next destination $Q_{2}$, and so on. When the last onion $O_{0pt}$ is received by the recipient $R$, $R$ can processes it to obtain the message $m$.

Secure onion encryption.

Suppose that (honest) Alice generates an onion carrying a message $m$ for Bob. That is, she generates a string of nonces and runs the algorithm $\mathsf{FormOnion}$ on the inputs: the message $m$, the routing path $(Q_{1},\dots,Q_{i-1},I,Q_{i+1},\dots,Q_{0pt-1},\text{Bob})$, the public keys associated with the routing path, and the nonces. Let $O$ denote the onion for intermediary party $I$, i.e., $O$ is the $i^{\textit{th}}$ onion in the outputted evolution.

Suppose that (honest) Carol runs the algorithm $\mathsf{FormOnion}$ on the inputs: the message $m^{\prime}$, the routing path $(Q^{\prime}_{1},\dots,Q^{\prime}_{j-1},I,Q^{\prime}_{j+1},\dots,Q^{\prime}_{e-1},\text{David})$, the public keys associated with the routing path, and some nonces. Let $O^{\prime}$ denote the onion for intermediary party $I$.

Provided that the onion encryption scheme is secure, if party $I$ receives onions $O$ and $O^{\prime}$ in the same round and consequently processes the two onions in the same batch, then the adversary cannot tell which processed onion resulted from processing $O$, and which resulted from processing $O^{\prime}$. In other words, onions formed by honest parties “mix” at honest parties. For a precise, cryptographic definition of secure onion encryption, see the recent paper by Ando and Lysyanskaya [AL20].

Remark.

Note that, in our protocol, the adversary already knows how many layers each onion has to begin with and how many remain at each round. Thus, the secure onion routing definitions [CL05, KBS19, AL20] give us even more security than we need. Onion encryption that satisfies them is good for our purposes, but a simpler and potentially more efficient construction will work too. Forming $O_{i}$ by encrypting $(O_{i+1},Q_{i+1},s_{i+1})$ under the public key of $Q_{i+1}$ using a CCA2-secure cryptosystem will also work for our purposes.

2.2 Formal definition of an onion routing protocol

In an onion routing protocol, all the packets sent between protocol participants are treated as onions; i.e., upon receipt, they are fed to $\mathsf{ProcOnion}$. Moreover, internally, there are type checks that ensure that these onions are processed properly.

There are two cases for processing an honestly formed onion properly: the case where peeling the onion reveals its next layer and destination, and the case where it reveals the message of which the processing party is the destination.

In an onion routing protocol, if $Q_{i}$ runs $\mathsf{ProcOnion}$ and outputs the next layer of the onion $O_{i+1}$ (together with its destination $Q_{i+i}$ and nonce $s_{i+1}$), then the only two options for what an onion routing protocol permits $Q_{i}$ to do with $O_{i+1}$ is either send it to $Q_{i+1}$, or drop it (if $Q_{i+1}=Q_{i}$ then this send step is internal to $Q_{i}$). Which of these actions are taken depends on the specifics of the algorithm, and also on the values $(Q_{i+1},s_{i+1})$, but those are the only options. In other words, the protocol for an onion routing scheme cannot have an onion sent to incorrect destinations or fed as input to another algorithm.

Further, if $Q_{i}$ runs $\mathsf{ProcOnion}$ and outputs a message $m\neq\bot$, then this message becomes (ultimately, at the end of the protocol) part of its output, i.e., it will be on the list of messages that have been sent to $Q_{i}$. In other words, the message $m$ that is the output of $\mathsf{ProcOnion}$ cannot be internal to the protocol, it must be the message that someone sent to $Q_{i}$ via the protocol. Conversely, in an onion routing protocol, the only way that a message $m$ can be on the list of messages received by $Q_{i}$ is if $Q_{i}$ obtained it by peeling one of the onions it received.

These restrictions on protocol design are natural. Indeed, any implementation of onion routing would ensure that it is adhered to by using type checking of the objects created, sent, and processed by the algorithm. Without such a restriction, any protocol can be thought of as an instance of onion routing protocol, so limiting our attention in this way is meaningful.

Note that this places restrictions just on the protocol that the honest parties are executing; the adversary is still free to do anything he wishes: to mismatch types, to route onions incorrectly, to try to rewrap onions, to form and process onions adversarially, etc.

Correct and indifferent onion routing.

Onion routing serves a purpose: to route messages from senders to recipients. Therefore, it needs to satisfy correctness:

Definition 1**.**

A messaging protocol \Pi(1^{\lambda},\mathsf{pp},\mathsf{states},\,\sigma)$ is correct if in an interaction with a passive adversary (i.e., when the adversary doesn’t deviate from the protocol), it delivers all the messages with overwhelming probability.

In this paper, we will consider only correct onion routing protocols, but we will analyze their interactions with active adversaries. Further, the protocols we design in this paper have an additional attractive property of being indifferent:

Definition 2** (Indifference).**

An onion routing protocol \Pi(1^{\lambda},\mathsf{pp},\mathsf{states},\,\sigma)$is indifferent if two properties hold: (1) The routing path corresponding to each honestly formed onion is of a fixed length. (2) The sequence of intermediaries, including the recipients of dummy onions, and the sequence of nonces corresponding to each honestly formed onion do not depend on the input. (An onion is a dummy if it reveals the empty message “$\bot$” when it is peeled all the way.)

The intuition behind this notion is that the contents of the messages sent and received between parties have no bearing on how the messages are routed and transmitted. For protocol design, indifference is an attractive property that allows components of an onion to be in place (and possibly the bulk of the cryptographic computation finished) before the message contents even becomes known. Another attractive feature of indifferent protocols is that their security properties are easier to analyze, as we will explore in the next section.

Our negative results apply to all onion routing schemes, indifferent or not.

3 Security definitions: anonymity, equalizing, and mixing

A motivating example.

Consider Ando, Lysyanskaya, and Upfal’s very simple protocol $\Pi_{p}$ ($p$, for passive) in the passive adversary setting [ALU18]. Recall that corrupted parties also follow the protocol in this setting.

Let $\mathsf{Servers}\subseteq\mathcal{P}$ be the set of servers which is a subset of $\mathcal{P}$.

During the onion-forming phase, every party $P$ generates an onion from the message-recipient pair $(m,R)$ in $P$’s input by first choosing $0pt-1$ servers $(S_{1},\dots,S_{0pt-1})$, each chosen independently and uniformly at random from $\mathsf{Servers}$. Next, $P$ forms an onion $O$ by running $\mathsf{FormOnion}$ on the message $m$, the routing path $P^{\rightarrow}=(S_{1},\dots,S_{0pt-1},R)$, the public keys associated with $P^{\rightarrow}$, and the sequence of empty nonces. At the first round of the execution phase, each party $P$ sends its formed onion $O$ to the first server $S_{1}$ on the routing path. For every round $r\in[0pt]$, each server $S$ does the following:

• •

Between the $r^{\textit{th}}$ and $(r+1)^{\textit{st}}$ rounds, $S$ processes all the onions it received at the $r^{\textit{th}}$ round.

• •

At the $(r+1)^{\textit{st}}$ round, $S$ sends the processed onions to their respective next destinations.

At the $0pt^{\textit{th}}$ round, each party receives an onion that, once processed, reveals a message $m$ for the party.

$\Pi_{p}$ is anonymous if the protocol sufficiently shuffles the onions during the execution phase. In prior work [ALU18], Ando, Lysyanskaya, and Upfal showed that sufficient shuffling occurs when the server load (i.e., the average number of onions received by a server at a round: $\frac{N}{|\mathsf{Servers}|}$) and the number of rounds (i.e., $0pt$) are both superlogarithmic in the security parameter.

However, there is no parameter setting for which $\Pi_{p}$ can be anonymous from the active adversary. If $\kappa N$ out of $N$ participants are corrupted, then with probability $\kappa$, the adversary can determine the recipient of any honest party, say Alice: Suppose that during the onion-forming phase, Alice picks a routing path that begins with an adversarial party $S_{1}$. During the execution phase, the adversary can direct $S_{1}$ to drop Alice’s onion before the second round. In this case, the adversary can figure out who Alice’s recipient is (say, it’s Bob) by observing who does not receive an onion at the end of the protocol run.

The motivating example illustrates that while mixing (i.e. sufficiently shuffling onions) is helpful for achieving anonymity, it is not enough. To be anonymous, the protocol must also guarantee that the numbers of messages received by the parties don’t reveal the input. We call this property, equalizing.

Relating equalizing and mixing to anonymity.

Here, we provide formal game-based definitions of anonymity (Section 3.1), equalizing (Section 3.2), and mixing (Section 3.3). Given these definitions, it can be shown that for indifferent onion routing protocols, equalizing and mixing imply anonymity:

Theorem 1**.**

For any adversary class $\mathbb{A}$, an indifferent (Definition 2) onion routing protocol that mixes and equalizes for $\mathbb{A}$ in the simple I/O setting is anonymous for $\mathbb{A}$ in the simple I/O setting, provided that the underlying onion encryption is secure (i.e., UC-realizes the ideal functionality for onion encryption [AL20]).

The proof is by a reduction and can be found in Appendix A. We will use Theorem 1 to prove our upper bound in Section 6.3.

3.1 Anonymity

Anonymity is a property of a messaging protocol $\Pi$ (i.e., $\Pi$ doesn’t have to be an onion routing protocol).

The definition of anonymity is standard indistinguishability. Recall that indistinguishability is defined using a security game in which the adversary chooses any two inputs to the system: $\sigma^{0}$ and $\sigma^{1}$. The system is secure if no adversary can distinguish between the two scenarios: running the system on input $\sigma^{0}$ (scenario 0) and running the system on input $\sigma^{1}$ (scenario 1).

In the anonymity game (for defining anonymity), the adversary necessarily learns the corrupt parties’ inputs and received messages. For example, let $N=4$, and let $P_{3}$ be a corrupt party.

• •

Suppose that the adversary chooses as inputs $\sigma^{0}=(\sigma_{1}^{0},\sigma_{2}^{0},\sigma_{3}^{0},\sigma_{4}^{0})$ and $\sigma^{1}=(\sigma_{1}^{1},\sigma_{2}^{1},\sigma_{3}^{1},\sigma_{4}^{1})$ such that $\sigma_{3}^{0}\neq\sigma_{3}^{1}$. Then, the adversary can determine the input from $P_{3}$’s input.

• •

Suppose that the adversary chooses as inputs $\sigma^{0}$ and $\sigma^{1}$ such that $\sigma^{0}$ contains an instruction to send message $m^{0}$ to $P_{3}$, whereas $\sigma^{1}$ contains an instruction to send message $m^{1}\neq m^{0}$ to $P_{3}$. Then, the adversary can determine the input from $P_{3}$’s received message.

Thus, the adversary’s choice for $(\sigma^{0},\sigma^{1})$ is constrained to pairs of inputs that differ only in the honest parties’ inputs and “outputs.” We define this formally by first defining equivalence classes for inputs as follows:

Input equivalence classes.

Let $\Sigma$ be a set of input vectors. Let $\adv$ be the adversary, and let $\mathsf{Bad}$ be the set of parties controlled by $\adv$. Fixing $\mathsf{Bad}$ imposes an equivalence class on $\Sigma$. Each equivalence class is defined by a vector $(e_{1},e_{2},\dots,e_{N})$. For each corrupted party $P_{i}\in\mathsf{Bad}$, $e_{i}=(\sigma_{i},\mathcal{M}_{i})$ “fixes” the input $\sigma_{i}$ for $P_{i}$ and also, the set $\mathcal{M}_{i}$ of messages instructed to be sent from honest parties to $P_{i}$. For each honest party $P_{i}\in\mathcal{P}\setminus\mathsf{Bad}$, $e_{i}=V_{i}$ “fixes” the number $V_{i}$ of messages instructed to be sent from honest parties to $P_{i}$. An input vector belongs to the equivalence class $(e_{1},e_{2},\dots,e_{N})$ if for every $P_{i}\in\mathsf{Bad}$, the input for $P_{i}$ is $\sigma_{i}$, the set of messages from honest parties to $P_{i}$ is $\mathcal{M}_{i}$, and $e_{i}=(\sigma_{i},\mathcal{M}_{i})$; and if for every $P_{i}\in\mathcal{P}\setminus\mathsf{Bad}$, the number of messages from honest parties to $P_{i}$ is $V_{i}$, and $e_{i}=V_{i}$. Two input vectors $\sigma^{0}$ and $\sigma^{1}$ are equivalent w.r.t. the adversary’s choice $\mathsf{Bad}$ for the corrupted parties, denoted $\sigma^{0}\equiv_{\mathsf{Bad}}\sigma^{1}$, if they belong to the same equivalence class imposed by $\mathsf{Bad}$.

We define anonymity using the anonymity game (below) in which the adversary picks two inputs from the same equivalence class; the protocol is anonymous if this induces indistinguishable adversarial views.

The anonymity game.

The anonymity game $\mathsf{AnonymityGame}(1^{\lambda},\Pi,\adv,\Sigma)$ is parametrized by the security parameter $1^{\lambda}$, a protocol $\Pi$, an adversary $\adv$, and a set $\Sigma$ of input vectors.

First, the adversary $\adv$ and the challenger $\cdv$ set up the parties’ keys: $\adv$ chooses a subset $\mathsf{Bad}\subseteq\mathcal{P}$ of the parties to corrupt and sends $\mathsf{Bad}$ to the challenger $\cdv$. For each honest party in $\mathcal{P}\setminus\mathsf{Bad}$, $\cdv$ generates a key pair for the party; the public keys $\pk(\mathcal{P}\setminus\mathsf{Bad})$ of the honest parties are sent to $\adv$. $\adv$ picks the keys for the corrupted parties and sends the corrupted parties’ public keys $\pk(\mathsf{Bad}))$ to $\cdv$.

Next, the input is selected: $\adv$ picks two input vectors $\sigma^{0},\sigma^{1}\in\Sigma$ such that $\sigma^{0}\equiv_{\mathsf{Bad}}\sigma^{1}$ and sends them to $\cdv$. $\cdv$ chooses a random bit $b\sample\bin$ and interacts with $\adv$ in an execution of protocol $\Pi$ on input $\sigma^{b}$ with $\cdv$ acting as the honest parties adhering to the protocol and $\adv$ controlling the corrupted parties.

At the end of the execution, $\adv$ computes a guess $b^{\prime}$ for $b$ from its view $\mathsf{V}^{\Pi,\adv,\mathsf{Bad}}{(1^{\lambda},\sigma^{b})}$ and wins the anonymity game if $b^{\prime}=b$. See Figure 1.

The standard notion of anonymity is defined as follows:

Definition 3** (Anonymity).**

A messaging protocol \Pi(1^{\lambda},\mathsf{pp},\mathsf{states},\,\sigma)$is anonymous from the adversary class$\mathbb{A}$w.r.t. the input set$\Sigma$if every adversary$\adv\in\mathbb{A}$wins the anonymity game$\mathsf{AnonymityGame}(1^{\lambda},\Pi,\adv,\Sigma)$with only negligible advantage, i.e.,$\left|\prob{\text{$\adv$ wins $\mathsf{AnonymityGame}(1^{\lambda},\Pi,\adv,\Sigma)$}}-\frac{1}{2}\right|=\negl.$

The protocol is computationally (resp. statistically) anonymous if the adversaries in $\mathbb{A}$ are computationally bounded (resp. unbounded).

3.2 Equalizing

Here, we introduce a new concept called equalizing, which is closely related to anonymity. Like anonymity, equalizing is a property of a messaging protocol $\Pi$.

Informally, $\Pi$ equalizes if observing how many messages each party received during the protocol run does not reveal whether the protocol ran on $\sigma^{0}$ or $\sigma^{1}$. In $\Pi_{p}$ (in our motivating example), whether Bob receives a message or not exposes who was sending Bob the message: Alice or another party, Allison; so $\Pi_{p}$ does not equalize. Instead, in an equalizing protocol, the probability that Bob receives a message doesn’t depend on the sender’s identity. Put another way, Bob is expected to receive the same number of messages in the scenario where Alice is the sender as the one where it is Allison. Formally, equalizing is defined with respect to the equalizing game (below).

The equalizing game.

The equalizing game $\mathsf{EqualizingGame}(1^{\lambda},\Pi,\adv,\ddv,\Sigma)$ is parametrized by the security parameter $1^{\lambda}$, a protocol $\Pi$, an adversary $\adv$, a distinguisher $\ddv$, and a set $\Sigma$ of input vectors.

The challenger for the equalizing game first interacts with the adversary exactly the same way as the challenger for the anonymity game. (See the previous section, Section 3.1, for the description of the anonymity game.)

Recall that at the end of the anonymity game, each honest party $P_{r}$ outputs the set $\mathsf{O}^{\Pi,\adv}_{r}{(1^{\lambda},\sigma^{b})}$ of (non-empty) messages from the message space $\mathcal{M}$ that it obtained during the execution from processing onions. Let $v_{r}$ be the number of messages that $P_{r}$ received during the run, i.e., $v_{r}\mathrel{\stackrel{{\scriptstyle\makebox[0.0pt]{\mbox{\tiny def}}}}{{=}}}|\mathsf{O}^{\Pi,\adv}_{r}{(1^{\lambda},\sigma^{b})}|$. (These statistics are part of the adversary’s view in the anonymity game.)

We define the statistics for the corrupt parties differently since $\cdv$ does not get to observe how many messages the corrupt parties output; indeed it is not even clear what it means for a corrupt party to produce an output. For each recipient $P_{r}\in\mathsf{Bad}$, let $v_{r}$ correspond to the number of onions that $\cdv$ has routed to an adversarial participant $P^{\prime}$ such that (1) they had been formed by an honest participant with $P_{r}$ as the recipient; and (2) all the participants after $P^{\prime}$ on the remainder of this onion’s route are controlled by the adversary. In other words, $v_{r}$ is the number of onions from honest participants that $P_{r}$ would receive if, internal to the adversary, all the onions are processed and delivered to their next destinations. We define this formally below.

Let $\mathsf{msPairs}(P_{r})$ denote the set of message-sender pairs for $P_{r}$. That is, for every $(m,P_{s})\in\mathsf{msPairs}(P_{r})$, the input $\sigma_{s}$ for $P_{s}$ includes the message-recipient pair $(m,P_{r})$, i.e., $(m,P_{r})\in\sigma_{s}$. Let $\mathsf{receivableOnions}(P_{r})$ be the following set of onions: An onion $O$ is in $\mathsf{receivableOnions}(P_{r})$ if there exists a message-sender pair $(m,P_{s})\in\mathsf{msPairs}(P_{r})$ such that

1. i.

$O$ was formed by $\cdv$ (on behalf of $P_{s}$) by running $\mathsf{FormOnion}$ on input the message $m$, a routing path $P^{\rightarrow}=(Q_{1},\dots,Q_{0pt-1},P_{r})$ ending in $P_{r}$, the public keys $\pk(P^{\rightarrow})$ of the parties on the path, and a sequence $s^{\rightarrow}$ of nonces, i.e., $O\in\{O_{1},\dots,O_{0pt}\}$ where $(O_{1},\dots,O_{0pt})\leftarrow\mathsf{FormOnion}(m,(P^{\rightarrow}),\pk(P^{\rightarrow}),s^{\rightarrow});$ 2. ii.

letting $i$ denote the position of $O$ in the output of the $\mathsf{FormOnion}$ call, either $i=1$, or the $(i-1)^{\textit{st}}$ intermediary $Q_{i-1}$ on the routing path is honest; and 3. iii.

$O$ is “peelable all the way” by $\adv$; i.e., $Q_{i},\dots,Q_{0pt-1},P_{r}$ are all adversarial.

For each adversarial recipient $P_{r}\in\mathsf{Bad}$, we define the statistic $v_{r}$ to be the number of onions in $\mathsf{receivableOnions}(P_{r})$ that the challenger sent out during the execution.

Let $\mathbf{v}=(v_{1},v_{2},\dots,v_{N})$. $\cdv$ provides these statistics $\mathbf{v}$ alone (and not the rest of the view) to the distinguisher $\ddv$, who outputs a guess $b^{\prime}$ for the challenge bit and wins the game if $b^{\prime}=b$, i.e. if it correctly determines whether the challenger ran the protocol on input $\sigma^{0}$ or $\sigma^{1}$. See Figure 2.

The definition for equalizing is as follows.

Definition 4** (Equalizing).**

A messaging protocol \Pi(1^{\lambda},\mathsf{pp},\mathsf{states},\,\sigma)$equalizes for the adversary class$\mathbb{A}$w.r.t. the input set$\Sigma$if for every adversary$\adv\in\mathbb{A}$and distinguisher$\ddv$,$\ddv$wins$\mathsf{EqualizingGame}(1^{\lambda},\Pi,\adv,\ddv,\Sigma)$with negligible advantage, i.e.,$\left|\prob{\text{$\ddv$ wins $\mathsf{EqualizingGame}(1^{\lambda},\Pi,\adv,\ddv,\Sigma)$}}-\frac{1}{2}\right|=\negl.$

The protocol computationally (resp. statistically) equalizes if the adversaries and the distinguishers are computationally bounded (resp. unbounded).

Clearly, a protocol that satisfies anonymity must equalize:

Theorem 2**.**

For any adversary class $\mathbb{A}$, a protocol that is anonymous for $\mathbb{A}$ w.r.t. the input set $\Sigma$ equalizes for $\mathbb{A}$ w.r.t. $\Sigma$.

Proof: If $\ddv$ can guess $b$ based on the statistics $\mathbf{v}$ alone, then the adversary $\adv$ who has access to the entire view of its interaction with $\cdv$ can guess $b$ also. It is also easy to see that a protocol need not satisfy anonymity in order to satisfy equalizing. Thus, equalizing is necessary but not sufficient to achieve anonymity.

3.3 Mixing in the simple I/O setting

Mixing is a property of onion routing protocols. Informally, an onion routing protocol mixes if the protocol sufficiently shuffles the honest parties’ “message-bearing” onions. That is, once an honestly generated onion has traveled far enough, getting peeled at every intermediary, the adversary cannot trace it to the original sender. If the adversary is the recipient of the message contained in the onion, it should not be able to trace it to the sender provided the message itself does not reveal the sender.

Formally, mixing is defined with respect to the mixing game. To keep things simple, we present the definition in the simple I/O setting. This can be extended to any arbitrary input set.

The mixing game.

Let $\mathcal{OE}=(\mathsf{Gen},\mathsf{FormOnion},\mathsf{ProcOnion})$ be a secure onion encryption scheme. The mixing game $\mathsf{MixingGame}(1^{\lambda},\Pi,\adv)$ is parametrized by the security parameter $1^{\lambda}$, an onion routing protocol $\Pi$, and an adversary $\adv$.

First, the adversary $\adv$ and the challenger $\cdv$ set up the parties’ keys (exactly as we described above for the anonymity game): $\adv$ chooses a subset $\mathsf{Bad}\subseteq\mathcal{P}$ of the parties to corrupt and sends $\mathsf{Bad}$ to $\cdv$. For each honest party in $\mathcal{P}\setminus\mathsf{Bad}$, $\cdv$ generates a key pair for the party by running the onion encryption scheme’s key generation algorithm $\mathsf{Gen}$ and sends the public keys $\pk(\mathcal{P}\setminus\mathsf{Bad})$ of the honest parties to the adversary $\adv$. $\adv$ picks the keys for the corrupted parties and sends the public-key portions $\pk(\mathsf{Bad})$ to $\cdv$.

Next, the input is selected: $\adv$ identifies a set $\mathsf{S}\subseteq\mathcal{P}\setminus\mathsf{Bad}$ of honest target senders and a set $\mathsf{R}\subseteq\mathcal{P}$, $|\mathsf{R}|=|\mathsf{S}|$ of target receivers. In addition to $\mathsf{S}$ and $\mathsf{R}$, $\adv$ also decides part of the input; for every non-target sender $P_{s}\in\mathcal{P}\setminus\mathsf{S}$, $\adv$ chooses a message $m$ and a unique non-target recipient $P_{r}\in\mathcal{P}\setminus\mathsf{R}$ such that $P_{s}$’s input becomes $\sigma_{s}=\{(m,P_{r})\}$; and for every target recipient $P_{r}\in\mathsf{R}$, $\adv$ chooses a message $m_{r}$ to be sent to $P_{r}$. We call the portion of the input that $\adv$ decides “the partial input vector,” and denote it $\tilde{\sigma}$. $\adv$ sends $(\mathsf{S},\mathsf{R},\tilde{\sigma})$ to the challenger $\cdv$. $\cdv$ supplies the rest of the input vector $\sigma=(\sigma_{1},\dots,\sigma_{N})$ by choosing a random bijection $g$ from $\mathsf{S}$ to $\mathsf{R}$; each $P_{s}\in\mathsf{S}$ is instructed to send the message $m_{g(P_{s})}$ to $g(P_{s})\in\mathsf{R}$, i.e., $\sigma_{s}=\{(m_{g(P_{s})},g(P_{s})\}$ where the message $m_{g(P_{s})}$ was supplied by $\adv$ as part of the partial input vector.

Next, $\cdv$ interacts with $\adv$ in an execution of protocol $\Pi$ on input $\sigma$ with $\cdv$ acting as the honest parties adhering to the protocol and $\adv$ controlling the corrupted parties. Whenever the protocol $\Pi$ specifies for an onion to be formed or processed, $\cdv$ runs the onion encryption scheme’s onion-forming algorithm $\mathsf{FormOnion}$ or onion-processing algorithm $\mathsf{ProcOnion}$.

Let $\mathsf{O}_{\mathsf{R}}$ be the set of onions received by the parties in $\mathsf{R}$.

At the end of the execution, $\adv$ chooses two onions $O_{s},O_{\bar{s}}\in\mathsf{O}_{\mathsf{R}}$ and a target sender $P_{s}\in\mathsf{S}$ and outputs $(O_{s},O_{\bar{s}},P_{s})$.

Let an onion $O$ be a “valid challenge onion” if (i) there exists a message $m_{r}\in\mathcal{M}$ and a target recipient $P_{r}\in\mathsf{R}$ such that $m_{r}$ is $\adv$’s choice for the message to be sent to $P_{r}$, and (ii) $O$ is the last onion to be received by the recipient over the network in the onion evolution generated by $\cdv$ on behalf of one of the target senders running $\mathsf{FormOnion}$ on the message $m_{r}$ and a routing path ending in $P_{r}$.

Let $\mathsf{sender}(O_{s})$ be the sender of $O_{s}$, and let $\mathsf{sender}(O_{\bar{s}})$ be the sender of $O_{\bar{s}}$. To maximize his chances of winning the game, the adversary wants both $O_{s}$ and $O_{\bar{s}}$ to be valid challenge onions such that $O_{s}$ was sent by $P_{s}$, while $O_{\bar{s}}$ was not. Formally, if $\adv$ chose two valid challenge onions, and $\{P_{s}\}\subset\{\mathsf{sender}(O_{s}),\mathsf{sender}(O_{\bar{s}})\}\subseteq\mathsf{S}$, then $\adv$ wins iff $P_{s}=\mathsf{sender}(O_{s})$. Otherwise, if $\adv$ did not choose two valid challenge onions, or if $\{P_{s}\}\not\subset\{\mathsf{sender}(O_{s}),\mathsf{sender}(O_{\bar{s}})\}$ or $\{\mathsf{sender}(O_{s}),\mathsf{sender}(O_{\bar{s}})\}\not\subseteq\mathsf{S}$, then $\adv$ wins with probability one-half. See Figure 3 for a quick reference to the mixing game.

We now define mixing as follows.

Definition 5** (Mixing).**

An onion routing protocol \Pi(1^{\lambda},\mathsf{pp},\mathsf{states},\,\sigma)$mixes conditioned on the event$E$for the adversary class$\mathbb{A}$if given$E$, every adversary$\adv\in\mathbb{A}$wins$\mathsf{MixingGame}(1^{\lambda},\Pi,\adv)$with negligible advantage, i.e.,$\left|\prob{\text{$\adv$ wins $\mathsf{MixingGame}(1^{\lambda},\Pi,\adv)$}\mid E}-\frac{1}{2}\right|=\negl.$

The protocol computationally (resp. statistically) mixes if the adversaries in $\mathbb{A}$ are computationally bounded (resp. unbounded).

Now that we have defined mixing formally, let us walk the reader through our definitional choices. The starting intuition is that this definition needs to capture that it should be hard for the adversary to pinpoint the origin of an onion received by one of the target recipients. This goal comes with a caveat that of course an adversary can determine the sender of an onion that one of the target senders has just created, or, more generally, that hasn’t traveled very far and hasn’t had a chance to mix with any onions from other target senders. Hence, we need to restrict the set of onions on which the adversary can win to a set of onions that have traveled far and have already had a chance to mix with other onions. This is why we have the requirement that the onion be a valid challenge onion. Intuitively, a valid challenge onion is one that was formed by a target sender and has already arrived at its destination, a target recipient, and now the adversary’s job is to figure out where it came from.

Next, let us explain why, to win the game, the adversary must produce two valid challenge onions, and correctly attribute one of them to a sender $P_{s}$, while the other must have originated with another target sender. What does it mean that the adversary cannot trace an onion? One intuitive approach would be to say: the adversary’s chances of winning the game where he picks just one onion and guesses its origin are close to a simulator’s chances of winning a game where he just guesses a sender, and the challenger picks the onion uniformly at random and independently of the simulator’s guess. The problem with this approach is that we don’t know the best strategy for such a simulator and with what probability it would succeed.

So our approach is to have the adversary pick a sender and two onions. “Mixing” means that, if it so happens that exactly one of them comes from $P_{s}$ and the other comes from another target sender, then try as he may, the adversary cannot tell which is which any better than by guessing randomly. And if it doesn’t happen that way, then the adversary wins with probability one-half.

4 Main tools: checkpoint onions and merging onions

We describe the main ingredients for our constructions: checkpoint onions (a tool that was introduced in prior work [ALU18]) and a new tool: merging onions.

4.1 Checkpoint onions

Our goal is to achieve anonymity by ensuring that our protocol mixes and equalizes in the presence of an active adversary that drops onions. The challenge is: if the adversary drops too many onions, then the remaining ones don’t have enough onions to mix with, and so the resulting protocol will not mix. Checkpoint onions give the honest participants a way of checking that there are still enough onions in the system for mixing to be possible.

A checkpoint onion $O$ is a dummy onion formed by a party $P$ that travels through the network until, at a pre-determined checkpoint round $r$, it arrives at the intermediary $I$, who is expecting it. If it fails to arrive, then $I$ is alerted to the activity of an active adversary.

More precisely, let $F_{\cdot}(\cdot,\cdot)$ be a pseudo-random function over two inputs, keyed by $\sk(P,I)$ which is a secret key shared between $P$ and $I$. Let $b$ be a binary predicate. Let $\mathcal{D}$ be the diagnostic rounds; the honest parties test whether enough onions remain in the system after these rounds. For each intermediary $I$ and each round $r\in\mathcal{D}$, $P$ determines whether or not to create a checkpoint onion that will arrive at $I$ at round $r$ by computing $f=F(\sk(P,I),(r,0))$, and then checking if $b(f)=1$; if so, $P$ creates this checkpoint onion. Similarly, the intermediary $I$ will know to expect a checkpoint onion from $P$ at round $r$ by computing $f=F(\sk(P,I),(r,0))$, and then checking if $b(f)=1$.

$P$ forms $O$ by running $\mathsf{FormOnion}$ on input the empty message “$\bot$,” a randomly chosen routing path $P^{\rightarrow}=(I_{1},\dots,I_{0pt})$, the public keys associated with parties on $P^{\rightarrow}$, and a sequence $(s_{1},\dots,s_{0pt-1})$ of nonces. The nonce $s_{r}$ which will be received by $I$, is the value that $I$ will know to expect: $s_{r}=F(\sk(P,I),(r,1))$; the rest are random nonces. The reason that $I$ will know to expect $s_{r}$ is that $I$ can compute it too, since $\sk(P,I)$ is shared between $P$ and $I$.

Of course, the shared key $\sk(P,I)$ need not be set up in advance: it can be generated from an existing PKI, e.g., using Diffie-Hellman (see prior work for details on checkpoint onions [ALU18]).

If the adversary drops an onion belonging to the same evolution as $O$ before it reaches $I$, $I$ will detect it: it will detect that no onion with nonce $s_{r}$ was received in round $r$. (Since $F$ is pseudorandom, it is highly unlikely that another onion peels to the same nonce value.)

Note: The number of checkpoint onions that $P$ generates is a pseudorandom variable that depends on the pseudo-random function $F$ and the binary function $b$. For our mixing mechanism to work, we should choose $F$ and $b$ such that the frequency of forming a checkpoint onion for random party $I$ and a random round $r$ is $\frac{\bigOmega{\text{polylog}\,\lambda}}{N|\mathcal{D}|}$, where by “$\text{polylog}\,\lambda$,” we mean polylogarithmic in the the security parameter $\lambda$, and so the expected number of checkpoints that $P$ generates is $\bigOmega{\text{polylog}\,\lambda}$. This ensures a strong correlation between the number of missing checkpoints observed by a party and the total number of checkpoint onions that have been dropped before the observation was made.

4.2 Merging onions

Checkpoint onions help with mixing, but not with equalizing. If our routing protocol just has every sender form one “message-bearing” onion to its recipient and send it along in addition to a set of checkpoint onions (as in the protocol $\Pi_{a}$ of Ando, Lysyanskaya and Upfal [ALU18]), then an adversary who targets the sender Alice can cause Alice’s recipient Bob to receive the message with a smaller probability than her alternative recipient, Bill; so this protocol will not equalize, and from Theorem 2 has no hope of achieving anonymity.

So how can we design a protocol that equalizes? One approach is to detect when the adversary drops any onions at all (e.g., using verifiable shuffling) [TGL*+*17, KCDF17], and abort when that happens. While this approach equalizes, it is not at all fault-tolerant. To achieve fault tolerance and equalizing, the protocol must be able to react to the adversary dropping onions in a way that is less dramatic than total abort. This can be accomplished by using a new tool: merging onions.

The idea here is that a sender $P$ can create two onions, $O_{1}$ and $O_{2}$ that bear the same message to the same recipient $R$. Further, they will be routed through the same intermediary $I$, arriving at $I$ at the same round $r$. Let $O^{\prime}_{1}$ (resp. $O^{\prime}_{2}$) denote the $r^{\mathit{th}}$ layer of $O_{1}$ (resp. $O_{2}$) that arrives at $I$ at round $r$. When $I$ peels both $O^{\prime}_{1}$ and $O^{\prime}_{2}$, $I$ discovers that they are (essentially) the same onion, and only forwards one of them to the next destination. If $I$ receives just one of them (because the other one had been dropped by the adversary), then it forwards it to the next destination, too.

Why does this approach help with equalizing? Suppose we have a protocol in which every participant creates two message-bearing onions that merge at round $r$. Suppose that the adversary targets the sender Alice and succeeds in dropping one of her two outgoing merging onions. Since these onions were supposed to merge at round $r$, after round $r$, there are just as many onions for which Alice was the sender (namely, just one onion) as for any other participant.

In general, of course, the adversary may drop more than one onion belonging to Alice. In fact, in order to guarantee that any of Alice’s onions survive with overwhelming probability when the adversary controls a constant fraction of the network’s nodes, Alice needs to send out a superlogarithmic (in the security parameter $\lambda$) number of onions. In order to equalize the number of onions that make it to each destination, our protocol will have to create not a pair, but $2^{h}=\bigOmega{\text{polylog}\,\lambda}$ merging onions, organized in a binary tree of height $h$.

We now illustrate how to form $2^{h}$ merging onions through a toy example for $h=3$. We first construct a binary tree graph of height $3=\log 8$. We label the root vertex of the tree $v$, and the left-child and right-child of $v$, $v_{0}$ and $v_{1}$. More generally, the left-child of a vertex $v_{w}$ is $v_{w0}$, and the right-child of $v_{w}$ is $v_{w1}$, so that the leaf vertices are: $v_{000}$, $v_{001}$, $v_{010}$, $v_{011}$, $v_{100}$, $v_{101}$, $v_{110}$, and $v_{111}$. Each of these leaf vertices corresponds to a separate onion.

Let $y$ denote a fixed number of rounds; this will later correspond to the length of an “epoch.” Next, for each vertex $v_{i}$ of the graph, we choose a random sequence $I^{\rightarrow}_{i}=(I_{i}^{1},\dots,I_{i}^{y})$ of $y$ parties and a random sequence $s^{\rightarrow}_{i}=(s_{i}^{1},\dots,s_{i}^{y})$ of $y$ nonces, i.e., $\forall j\in[y]$, $I_{i}^{j}\sample\mathcal{P}$ and $s_{i}^{j}\sample\mathcal{S}$.

Let the “direct path from a leaf vertex $v_{\ell}$ to the root” be the path that begins with $v_{\ell}$ and recursively moves to its parent vertex until the root vertex $v$ is reached. For example, the direct path from $v_{101}$ to the root is $(v_{101},v_{10},v_{1},v)$.

Let the “sequence of intermediaries corresponding to leaf vertex $v_{\ell}$” be the sequence of parties corresponding to the parties on the direct path from $v_{\ell}$ to the root, e.g., for $v_{101}$, it is $(I^{\rightarrow}_{101},I^{\rightarrow}_{10},I^{\rightarrow}_{1},I^{\rightarrow}),$ where $I^{\rightarrow}$ is the sequence of parties assigned to the root. See Figure 4.

Let the “sequence of nonces corresponding to leaf vertex $v_{\ell}$” be the sequence of nonces corresponding to the parties on the direct path from $v_{\ell}$ to the root, e.g., for $v_{101}$, it is $(s^{\rightarrow}_{101},s^{\rightarrow}_{10},s^{\rightarrow}_{1},s^{\rightarrow}),$ where $s^{\rightarrow}$ is the sequence of nonces assigned to the root.

For each leaf vertex $v_{\ell}$, we form an onion $O_{\ell}^{1}$ using the message $m$ from the input, the routing path $(I^{\rightarrow}_{101},I^{\rightarrow}_{10},I^{\rightarrow}_{1},I^{\rightarrow},R)$ where $R$ is the recipient from the input, the public key associated with the routing path, and the sequence $(s^{\rightarrow}_{101},s^{\rightarrow}_{10},s^{\rightarrow}_{1},s^{\rightarrow})$ of nonces. We can generalize this idea to generate an arbitrarily large set of merging onions by using an appropriately large binary tree.

5 A stepping stone construction, $\Pi_{\triangle}$

Let us extend the toy example construction we just saw to a protocol, $\Pi_{\triangle}^{x,y,t}$, which is a stepping stone for our main construction. $\Pi_{\triangle}^{x,y,t}$ is pronounced “Pi-tree” from the fact that the onions’ routing paths are structured like a binary tree graph and is parametrized by the number $x$ of merging onions per sender (this is also the expected number of checkpoint onions per sender), the number $y$ of rounds per epoch, and the threshold $t$ for missing checkpoint nonces per diagnostic round. (We will generally omit the superscript for better readability.)

The setup phase.

We use a secure onion encryption scheme $(\mathsf{Gen},\mathsf{FormOnion},\mathsf{ProcOnion})$ as a building block (see Section 2 for a description of onion encryption schemes). During the setup phase, the participants set up their keys. Every honest party $P$ sets up his/her keys $(\pk(P),\sk(P))$ by running the onion encryption scheme’s key generation algorithm $\mathsf{Gen}$.

The onion-forming phase.

During the onion-forming phase, each honest party $P$ creates two types of onions: merging onions and checkpoint onions.

• •

On input $\{(m,R)\}$, $P$ forms a set of $x$ merging onions using the number $y$ of rounds in an epoch, the message $m$, and the recipient $R$.

• •

In addition to merging onions, $P$ generates (on average) $x$ checkpoint onions using the set $\mathcal{D}=\{y,2y,\dots,(\log x+1)y\}$ as the diagnostic rounds. (Appropriate functions are chosen for $F_{\cdot}(\cdot,\cdot)$ and $b(\cdot)$ such that $P$ generates $x$ checkpoint onions in expectation. See Checkpoint onions in Section 4 to recall how these functions are used for generating checkpoint onions.)

For both merging onions and checkpoint onions, the length of the routing path is fixed; it is $(\log x+1)y+1$. See Figure 5 for a summary of the setup and onion-forming phases.

Remark: The onion layers are tagged with their respective round number to prevent replay attacks. If by peeling an onion received at round $r$, an honest relaying party observes a round number $r^{\prime}\neq r$, the party “drops” the onion (doesn’t relay it to its next destination).

The execution phase.

All onions are created during the onion-forming phase and released simultaneously in the first round of the execution phase. After each round $r$ of the execution phase, $P$ peels all onions it received at the $r^{\textit{th}}$ round and merges mergeable onions (i.e., if two onions peel to the same nonce value, drop one of them at random).

If $r$ is a diagnostic round (i.e., $r\in\mathcal{D}$), $P$ runs the following diagnostic test: Let $\mathsf{Ckpts}(P,r)$ denote the set of checkpoints that $P$ expects to see from peeling the onions between rounds $r$ and $r+1$. $P$ counts how many checkpoints from $\mathsf{Ckpts}(P,r)$ are missing. If the number exceeds a fixed threshold value $t$ (i.e., the onions fail the test), then $P$ aborts. Otherwise (if the number of missing checkpoints is below $t$), $P$ continues for another round by sending the processed onions to their respective next destinations in random order.

At the end of the execution phase, $P$ peels the onions it received at the last round and outputs the set of (non-empty) messages it received.

Performance of $\Pi_{\triangle}$.

As shown in Appendix C, $\Pi_{\triangle}^{x,y,t}$ is anonymous from the adversary who corrupts up to $\kappa$ fraction of the parties when (a) the onion encryption scheme is secure, (b) the number $x$ of onions formed by each (honest) party is $\bigOmega{2^{\ceil{\log(\chi(\log\chi+1))}}}$ where $\chi=\max(\sqrt{N\log^{2+\epsilon}\lambda},\log^{2(1+\epsilon)}\lambda)$, (c) the number $y$ of rounds per epoch is $\bigOmega{\log^{1+\epsilon}\lambda}$, and (d) the threshold $t$ is $2(1-\delta)(1-\kappa)^{3}\kappa\log^{1+\epsilon}\lambda$.

The reason that $\Pi_{\triangle}^{x,y,t}$ needs so many onions is that the adversary can target Alice and drop a lot of her onions before the honest participants realize (via checkpoint onions) the presence of an attack and abort. The protocol $\Pi_{\bowtie}$ presented in the next section improves on this by giving the routing paths enough structure that missing onions can be detected sooner.

6 Our main construction, $\Pi_{\bowtie}$

In this section, we present our main construction $\Pi_{\bowtie}$ (pronounced “Pi-butterfly”). $\Pi_{\bowtie}$ uses a variant of a butterfly graph described below.

6.1 The butterfly network and variants

Recall [MU05, Chapter 4.5.2] that the butterfly network $B=(V(B),E(B))$ is a directed graph on $(n+1)2^{n}$ vertices. The vertices are organized into $N=2^{n}$ rows and $n+1$ columns, so each vertex has an address $(r,c)$ where $1\leq r\leq N$ and $0\leq c\leq n$. Vertices in column $i$ represent potential locations of a data packet (here, an onion) at epoch $i$; each participant $P$ has a dedicated row. An edge from $(P,i)$ to $(Q,i+1)$ means that an onion can travel from participant $P$ to participant $Q$ in epoch $i$. The edges of the specific butterfly network that will be useful for us are

[TABLE]

Let $J$ and $J^{\prime}$ be two participants whose binary representation differs in bit $i+1$ only. In $\Pi_{\bowtie}$, epoch $i$ is dedicated to having an onion bounce $y$ times between $J$ and $J^{\prime}$. This way, by the end of the epoch, the onions that $J$ and $J^{\prime}$ held at the beginning of the epoch will be mixed together if one of them is honest. More formally, the onions travel along the edges of a stretched butterfly network, defined as follows: its $N(ny+1)$ vertices are organized into $N$ rows and $ny+1$ columns; and its edges are: E(\beta)=\{((P,j),(Q,j+1))\mid\mbox{for i=\lfloor j/y\rfloor$,$((P,i),(Q,i+1))\in E(B)}\}.

However, what if both $J$ and $J^{\prime}$ are adversarial? Then sending the onions through the stretched butterfly network just once will result in the adversary knowing the $i^{\mathit{th}}$ bit of an onion’s destination! So to prevent this, we will send the onions through the iterated stretched butterfly network. For an integer $z$, let $\beta^{z}$ denote the stretched butterfly network iterated $z$ times. More precisely, $\beta^{z}$ is a directed graph in which the vertices are organized into $N$ rows and $nyz+1$ columns, i.e., a vertex has an address $(r,c)$ where $1\leq r\leq N$ and $0\leq c\leq nyz$. The edges are as follows: E(\beta^{z})=\{((P,j),(Q,j+1))\mid\mbox{for i=j\bmod ny$,$((P,i),(Q,i+1))\in E(\beta)}\}.

To summarize, we begin with a butterfly network $B$, then we stretch it by $y$ to get $\beta$, then we iterate it $z$ times to get $\beta^{z}$; see Figure 6. By a “walk through $\beta^{z}$” we mean a sequence $(J_{0},\ldots J_{nyz})$ such that, for each $i<nyz$, $((J_{i},i),(J_{i+1},i+1))\in E(\beta^{z})$. A random walk from a node $J_{0}$ is a sequence that begins with $J_{0}$ such that for $i>0$, each $J_{i}$ is a walk selected uniformly at random conditioned on the first $i$ elements being $(J_{0},\ldots,J_{i-1})$. A random walk starting at any address can be sampled efficiently. Moreover, we can also efficiently sample a random walk backwards from a given address $J$. And we can sample a random walk that hits a given address $I$ at round $i$ efficiently as well, by walking backwards on the butterfly network from $(J_{i},i)$ to $(J_{0},0)$ and forward from $(J_{i},i)$ to $(J_{nyz},nyz)$.

6.2 Description of the construction

Like $\Pi_{\triangle}^{x,y,t}$, $\Pi_{\bowtie}^{x,y,z,t}$ consists of the setup phase, the onion-forming phase, and the execution phase. It is parameterized by the number $x$ of merging onions per sender, the number $y$ of rounds per epoch, the number $z$ of iterations of a variant of a butterfly graph, and the threshold $t$ for missing checkpoint nonces. (We will generally omit the superscript for better readability.) The execution phase is divided into the mixing sub-phase and the equalizing sub-phase. The iterated stretched butterfly graph determines routing options for the mixing sub-phase.

The setup phase.

Let $\mathcal{OE}=(\mathsf{Gen},\mathsf{FormOnion},\mathsf{ProcOnion})$ be a secure onion encryption scheme. During setup, each honest participant $P$ generates its public key pair $(\pk(P),\sk(P))$ using $\mathcal{OE}$’s key generation algorithm $\mathsf{Gen}$. (This is the same as the setup phase in $\Pi_{\triangle}$. )

The onion-forming phase.

On input $\{(m,R)\}$, each honest party $P$ generates exactly $x$ merging onions and (on average) $x$ checkpoint onions. To form an onion, $P$ first needs to pick a path for it. Each onion will (potentially) travel to $d\mathrel{\stackrel{{\scriptstyle\makebox[0.0pt]{\mbox{\tiny def}}}}{{=}}}(nyz+1)+y\log x+1$ parties to reach its destination: the first $nyz+1$ steps involve a random walk through the iterated stretched butterfly network (the mixing sub-phase), and the next $y\log x+1$ steps will take the onion through the equalizing sub-phase and to the recipient.

To begin with, $P$ generates the $x$ merging onions as follows: Let $T$ be the binary tree of height $\log x$. Let $k$ be an address of a node in $T$ (i.e., $k$ is a binary string of length at most $\log x$); let $v_{k}$ denote this node. I.e., V(T)=\{v_{k}\mid\mbox{k is a binary string, }|k|\leq\log x\}. To each non-leaf vertex $v_{k}$ in $T$, $P$ assigns a sequence of $y$ random parties and $y$ random nonces; let $I^{\rightarrow}_{v_{k}}=(I_{v_{k},1},\ldots,I_{v_{k},y})$ denote the sequence of vertices and $s^{\rightarrow}_{v_{k}}=(s_{v_{k},1},\ldots,s_{v_{k},y})$ denote the sequence of nonces corresponding to vertex $v_{k}$. (Up until this step, this is exactly how merging onions are formed in $\Pi_{\triangle}$.) For each leaf vertex $v_{\ell}$, $P$ picks a random walk through the iterated stretched butterfly $\beta^{z}$ and $nyz+1$ random nonces; let $J^{\rightarrow}_{v_{\ell}}=(J_{v_{\ell},0},\ldots,J_{v_{\ell},nyz})$, denote the random walk, and let $t^{\rightarrow}_{v_{\ell}}=(t_{v_{\ell},0},\ldots,t_{v_{\ell},nyz})$ be the sequence of nonces.

Let $v_{\ell}$ be a leaf of $T$. Let $v_{\ell,i}=v_{k_{i}}$ where $k_{i}$ is the $i$-bit prefix of $\ell$. I.e. $v_{\ell,\ell}=v_{\ell}$ and $v_{\ell,0}=v_{\varepsilon}$, and $(v_{\ell,h},v_{\ell,h-1},\ldots,v_{\ell,0})$ is the path from $v_{\ell}$ to the root of the tree, where $h=\log x$.

$P$ will create an onion $O_{\ell}$ for each leaf $v_{\ell}$. Its routing path is $I^{\rightarrow}_{\ell}=(J^{\rightarrow}_{v_{\ell}},I^{\rightarrow}_{\ell,2},\dots,I^{\rightarrow}_{\ell,h},R)$ where $J^{\rightarrow}_{v_{\ell}}$ is as defined above, $I^{\rightarrow}_{\ell,i}=I^{\rightarrow}_{k_{i}}$ where $k_{i}$ is the $i$-bit prefix of $\ell$, and $R$ is the recipient, and such that $|I^{\rightarrow}_{\ell}|=d$. Similarly, let $s^{\rightarrow}_{\ell}=(t^{\rightarrow}_{v_{\ell}},s^{\rightarrow}_{\ell,2},\dots,s^{\rightarrow}_{\ell,h})$ denote the sequence of nonces corresponding to this path.

To form the onion $O_{\ell}$ corresponding to $v_{\ell}$, $P$ runs the algorithm $\mathsf{FormOnion}$ on the message $m$, the routing path $I^{\rightarrow}_{\ell}$, the public keys associated with the routing path, and the nonce sequence $s^{\rightarrow}_{\ell}$.

After forming the merging onions, $P$ generates the checkpoint onions. Just as in $\Pi_{\triangle}$, the execution phase consists of epochs, and the last round of every epoch is a diagnostic round. Here, each epoch lasts $y$ rounds, thus round $r>0$ is a diagnostic round if $r$ is a multiple of $y$. For each diagnostic round $r$ and for each intermediary $I$, $P$ uses the pseudorandom function $F_{\sk(P,I)}(r,0)$ to determine whether to form a checkpoint onion to send to $I$ at round $r$, and if so, calculates the nonce $s=F_{\sk(P,I)}(r,1)$.

When $F_{\sk(P,I)}(r,0)=1$, $P$ generates a checkpoint onion to be verified by party $I$ in round $r$. Recall that $d\mathrel{\stackrel{{\scriptstyle\makebox[0.0pt]{\mbox{\tiny def}}}}{{=}}}(nyz+1)+y\log x+1$; so round $d$ is the last round of the execution phase. Since the checkpoint onion should not be distinguishable from a merging one during the mixing sub-phase, it needs to travel over the edges of the iterated stretched butterfly network for the first $nyz+1$ rounds, and follow a random path through the network during the equalizing sub-phase, all the way until the last round $d$.

As a result, for $r\geq nyz+1$, $P$ generates the routing path by first picking a random walk $J^{0\rightarrow nyz}=(J_{0},\ldots,J_{nyz})$ through the iterated stretched butterfly network starting at a random node $J_{0}$, and then choosing each participant on the next part of the path $J^{nyz+1\rightarrow r-1}=(J_{nyz+1},\ldots,J_{r-1})$ uniformly at random from $\mathcal{P}$. Next, $J_{r}=I$, and each router on the remaining stretch of the path $J^{r+1\rightarrow d}$ is, again, chosen uniformly at random from $\mathcal{P}$. So the resulting routing path is $J^{\rightarrow}_{I,r}=(J^{0\rightarrow nyz},J^{nyz+1\rightarrow r-1},J_{r},J^{r+1\rightarrow d})$. $P$ chooses the corresponding nonces $\{s_{I,r,j}\}_{j\in\{0,\dots,d-1\}\setminus\{r\}}$ uniformly at random, sets $s_{I,r,r}=s$, and gives the resulting routing path, sequence $(s_{I,r,0},\dots,s_{I,r,d-1})$ of nonces and the empty message to $\mathsf{FormOnion}$ to obtain checkpoint onion $O_{I,r}$.

If $r\leq nyz$, then round $r$ occurs during the mixing sub-phase, as the onion is making its way through the butterfly network. So its path has to be formed in such a way that it arrives at $I$ at round $r$; but it needs to be a randomly chosen path conditioned on this event (so that a checkpoint onion’s path is distributed the same way as one of a merging onion). Let $J^{0\rightarrow nyz}$ be a random walk through $\beta^{z}$ that is at address $I$ at round $r$ (see Section 6.1 for how to sample this walk efficiently). Let each intermediary in the sequence $J^{nyz+1\rightarrow d}$ be chosen uniformly at random from $\mathcal{P}$. Again, for $j\neq r$, $0\leq j\leq d-1$, the nonce $s_{I,r,j}$ is chosen at random, while $s_{I,r,r}=s$. Let $J^{\rightarrow}_{I,r}=(J^{0\rightarrow nyz},J^{nyz+1\rightarrow d})$. Run $\mathsf{FormOnion}$ on input the routing path $J^{\rightarrow}_{I,r}$, sequence of nonces $s^{\rightarrow}_{I,r}$ and the empty message to obtain checkpoint onion $O_{I,r}$. See Figure 7.

Remark: As in $\Pi_{\triangle}$, the onion layers are tagged with their respective round number to prevent replay attacks. If by peeling an onion received at round $r$, an honest relaying party observes a round number $r^{\prime}\neq r$, the party drops the onion. (We can, therefore, assume that replay attacks do not happen. We can safely do so since the security of the onion encryption scheme prevents the adversary from modifying the onions formed by honest participants in any meaningful way. See, for example Ando and Lysyanskaya’s work on onion encryption [AL20], for a sufficiently strong construction.)

The execution phase.

At the beginning of the execution phase, each party $P$ is live. $P$’s status will change from live to aborted if it ever receives a special abort message from another party. An aborted party sends the special abort message to a random sample of $x$ parties. (A slight technicality is that, since all messages must be onions, the special abort message is a specially formed onion.)

For each $r\in\{0,\dots,d-1\}$, each live honest party $P$ first peels all the onions it received at the $r^{\textit{th}}$ round. It merges onions that are mergeable: if it received two onions that have the same nonce, then it drops one of them, selected at random, and sends the other one to its next destination.

If $r$ is a diagnostic round (i.e., a multiple of $y$), then $P$ runs the diagnostic test: $P$ compares the number of checkpoint onions it expects to receive with the number it received. For every participant $Q\in\mathcal{P}$, if $F_{\sk(Q,P)}(r,0)=1$, then $P$ expects to receive a checkpoint onion with nonce $s=F_{\sk(Q,P)}(r,1)$ in this round. In the mixing sub-phase, if fewer than $t$ checkpoint onions are missing so far in the protocol run (not just in this round, but cumulatively), then $P$ continues the run by processing all the other onions. Otherwise, $P$’s status changes: it is no longer live but becomes an aborted party. In the equalizing sub-phase, change status to aborted if there are $t$ or more missing checkpoint onions in this round, else continue.

At the last round (round $d$) of the execution phase, $P$ peels the onions it received and outputs the set of (non-empty) messages it received.

6.3 Proof that $\Pi_{\bowtie}$ is efficient, robust, and anonymous

In this section, we will prove that there exists a parameter setting (for $x$, $y$, $z$, and $t$) such that $\Pi_{\bowtie}$ is simultaneously efficient, fault-tolerant, and anonymous.

Our measure of efficiency is onion cost per user, which measures how many onions are transmitted by each user in the protocol. This is an appropriate measure when the parties pass primarily onions to each other. It is also an attractive measure of complexity because it is algorithm-independent: If we measured complexity in bits, it would change depending on which underlying encryption scheme was used. Since an onion contains as many layers as there are intermediaries, its bit complexity scales linearly with the number of intermediaries. (We assume that every message $m$ can be contained in a single onion.) To translate our lower bound from onion complexity to bits, we will consider onions to be at least as long (in bits) as the message $m$ being transmitted and the routing information. More formally,

Definition 6** (Onion cost).**

Let $\mathsf{out}^{\Pi,\adv}_{i}{(1^{\lambda},\sigma)}$ denote the number of onions formed by an honest party that party $P_{i}$ transmits directly to another party in a protocol run of $\Pi$ with adversary $\adv$, security parameter $\lambda$ and $\sigma$.

The onion cost of $\Pi$ is \mathsf{OC}^{\Pi,\adv}(1^{\lambda},\Sigma)\mathrel{\stackrel{{\scriptstyle\makebox[0.0pt]{\mbox{\tiny def}}}}{{=}}}\mathbb{E}_{\sigma,i,\}\left[\mathsf{out}^{\Pi,\adv}{i}{(1^{\lambda},\sigma)}\right].$The expectation is taken over the input$\sigma\sample\Sigma$, the party$P{i}\sample\mathcal{P}$, and the randomness$$$ of the protocol.

For an adversary class $\mathbb{A}$, the onion cost of $\Pi$ interacting with $\mathbb{A}$ w.r.t. $\Sigma$ is the maximum onion cost over the adversaries in $\mathbb{A}$, i.e., $\mathsf{OC}^{\Pi,\mathbb{A}}(1^{\lambda},\Sigma)\mathrel{\stackrel{{\scriptstyle\makebox[0.0pt]{\mbox{\tiny def}}}}{{=}}}\max_{\adv\in\mathbb{A}}\mathsf{OC}^{\Pi,\adv}(1^{\lambda},\Sigma)$.

Our formal notion of fault tolerance is robustness, defined below:

Definition 7** (Robustness).**

A messaging protocol \Pi(1^{\lambda},\mathsf{pp},\mathsf{states},\,\sigma)$is robust if in every interaction in which the adversary drops at most a logarithmic (in the security parameter) number of message packets,$\Pi$ delivers all messages sent out by honest participants with overwhelming probability.

Let $\mathbb{A}_{\kappa}$ denote the class of active adversaries who can corrupt up to a constant $\kappa$ fraction of the participants. In this section, we will prove the following upper bound on onion cost:

Theorem 3**.**

For any constants $\kappa<\frac{1}{2}$ and $\gamma_{1},\gamma_{2}>0$, there is a setting of $x$, $y$, $z$, and $t$ such that $\Pi_{\bowtie}^{x,y,z,t}$ is robust and anonymous from the adversary class $\mathbb{A}_{\kappa}$ with onion cost at most $\gamma_{1}\log N\log^{3+\gamma_{2}}\lambda$ (in the presence of $\mathbb{A}_{\kappa}$), where $\lambda$ is the security parameter and $N=\omega(\log\lambda)$ is the number of participants.

Proof.

Recall that the number of corruptions is $\kappa<\frac{1}{2}$. Set $\epsilon_{1}$ such that $\gamma_{1}=6\epsilon_{1}^{3}$ and $\epsilon_{2}$ such that $\gamma_{2}=3\epsilon_{2}$. Let $x=y=z=\epsilon_{1}\log^{1+\epsilon_{2}}\lambda$; and let $t=\frac{W}{3}$, where $W=\frac{(1-\kappa)x}{z\log N+\log x}$ is the expected number of (commutable) checkpoint nonces at a party at a diagnostic round.

Having set the parameters, we wish to show that the protocol $\Pi_{\bowtie}^{x,y,z,t}$ (a) is robust; (b) has onion cost $\mathsf{OC}\leq\gamma_{1}\log N\log^{3+\gamma_{2}}\lambda$; and (c) is anonymous, provided that the underlying onion encryption scheme is secure.

Part (a) is true by inspection.

To see why (b) follows, recall that each participant forms $x$ merging onions, and, on average $x$ checkpoint onions; let $X$ be the maximum number of onions formed by an honest party. Each of these onions will need to be processed in each round, so $\mathsf{OC}\leq Xd$, where $d$ is the number of rounds. Using Chernoff bounds, $X<3x$ with overwhelming probability. The number of rounds is $d=(nyz+1)+y\log x+1$; for our setting of parameters, therefore, $\mathsf{OC}\leq 6\epsilon_{1}^{3}\log N\log^{3(1+\epsilon_{2})}\lambda$.

We show part (c) via a series of lemmas that follow. First, we invoke the UC composition theorem of Canetti [Can01] in order to replace cryptographic algorithms for onion encryption with ideal encryption; this allows our further analysis to assume that onions reveal nothing to an intermediary $I$ other than the information that is intended for $I$ (Lemma 1). Let $\Pi_{\bowtie}^{\mathit{ideal}}$ be the resulting protocol. Next, we argue that $\Pi_{\bowtie}^{\mathit{ideal}}$ is an indifferent onion routing protocol (Lemma 2). This is helpful because then we will be able to invoke Theorem 1. Third, we discard, for the purposes of analysis, all the checkpoint onions that are checked by the adversary; we show that if a protocol mixes (resp. equalizes) in this setting, then it mixes (resp. equalizes) (Lemmas 6 and 7 in Appendices B.1 and B.2). Finally, we show that in this setting, $\Pi_{\bowtie}$ mixes (Lemma 3) and equalizes (Lemma 4). Then, putting it all together, we get our desired result. ∎

Lemma 1**.**

Let $\Pi$ be onion routing protocol that makes use of an onion encryption scheme that is UC-secure [Can01] under a computational assumption $A$. Let $\Pi^{\mathit{ideal}}$ be the same protocol, but the onion encryption scheme is replaced by the ideal onion encryption functionality of Camenisch and Lysyanskaya [CL05]. If $\Pi^{\mathit{ideal}}$ is anonymous, then $\Pi$ is anonymous under assumption $A$.

Proof.

The Lemma follows by the UC composition theorem of Canetti [Can01]. ∎

Remark.

Since CCA2-secure public-key encryption UC-realizes the ideal public-key encryption functionality of Canetti, and in $\Pi_{\bowtie}$ the adversary already knows how many layers of a given onion have already been peeled, forming onions by using CCA2-secure encryption to encrypt each layer will also result in an anonymous $\Pi_{\bowtie}$.

Lemma 2**.**

$\Pi_{\bowtie}^{\mathit{ideal}}$* is indifferent.*

Proof.

In $\Pi_{\bowtie}^{\mathit{ideal}}$, the length of each routing path is fixed, and the intermediaries and nonces of honestly formed onion layers do not depend on the input $\sigma$ to the protocol. The procedure for generating intermediaries and nonces (boxed in Figure 5) takes as input only the values $x$, $y$, and $z$. Thus, by definition, $\Pi_{\bowtie}^{\mathit{ideal}}$ is indifferent. ∎

For the subsequent lemmas (Lemmas 3-5), we analyze only commutable onions, where an onion (layer) is commutable if (i) an honest party formed it, and (ii) it is not a checkpoint onion for verification by an adversarial party (more precisely, it does not belong to the same evolution as a checkpoint onion for verification by an adversarial party).

Lemma 3**.**

With parameters $x$, $y$, $z$, and $t$ defined as above, $\Pi_{\bowtie}^{\mathit{ideal}}$ mixes for the adversary who corrupts up to half of the parties.

Proof sketch. If $\Pi_{\bowtie}^{\mathit{ideal}}$ delivers messages in the final round $d$, then w.o.p., the adversary dropped (at most) a constant fraction of the commutable checkpoint onions before the last epoch: The adversary cannot drop more than a constant fraction of all commutable onions without also dropping a proportional number of checkpoint onions. This is because if the adversary were to drop more than a constant fraction of all commutable onions, then, from known probability concentration bounds [HS05], w.o.p., the adversary would drop close to a proportional number of checkpoint onions, which, in turn, would cause all honest parties to abort the run. Combining this with Chernoff bounds we get: during each round of the penultimate epoch $e$, each honest party processed a polylogarithmic (in the security parameter) number of commutable onions. From Chernoff bounds, we also get: during epoch $e$, each commutable onion went to an honest party a polylogarithmic number of times. Thus, either the $\Pi_{\bowtie}^{\mathit{ideal}}$ aborts, or it sufficiently shuffles the commutable onions during the penultimate epoch since shuffling for a polylogarithmic number of rounds with a polylogarithmic number of other onions is sufficient for mixing. Either way, $\Pi_{\bowtie}^{\mathit{ideal}}$ mixes. See Appendix B.1 for the proof of Lemma 3. ∎

Lemma 4**.**

With parameters $x$, $y$, $z$, and $t$ defined as above, $\Pi_{\bowtie}^{\mathit{ideal}}$ equalizes for the adversary who corrupts up to half of the parties, who also receives everything about non-commutable onions as an auxiliary input.

Before proving Lemma 4, let us prove the following:

Lemma 5**.**

Let $\Pi_{\bowtie}^{\mathit{ideal}}$ run with parameters $x$, $y$, $z$, and $t$ are as defined above on input $\sigma$, with $\adv$ corrupting up to half of the participants, and receiving an auxiliary input about non-commutable onions as an auxiliary input. If there is an unaborted honest party at the beginning of the equalizing phase, then with overwhelming probability for each honest party $P$, at least $\frac{1-\kappa}{9}$ of $P$’s merging onions remained undropped by the adversary at the end of the mixing phase. (Recall that $\kappa$ is the corruption rate.)

Proof sketch. In the first round, the adversary $\adv$ knows the sender of each commutable onion. As the protocol progresses, $\adv$ loses track of this information. Thus, $\adv$’s optimal tactic is to target Alice upfront by dropping every onion that might have come from Alice that is routed to an adversarial party during the first three rounds of the first epoch (as well as the last round of the epoch).

In the first round, some of Alice’s onions route to a corrupt party; $\adv$ drops all of these. However, from Chernoff bounds, w.o.p., at least a constant fraction of Alice’s onion go to an honest party first. Let $O$ be such an onion, and let $P$ be the honest party that receives $O$ in the first round. Recall that during each epoch of the mixing phase, $P$ shuffles onions back and forth with another party $P^{\prime}$. $\adv$ can attempt to drop $O$ if $P^{\prime}$ is corrupt. However, even if $P^{\prime}$ is corrupt, $\adv$ cannot drop $O$ if it arrives at $P$ first and remains at $P$ during rounds $2$ and $3$ (and return to $P$ at round $y$) – so, using probability concentration bounds, $\frac{1-\kappa}{9}$ of the time. Thus, even if $\adv$ employs the optimal tactic for dropping Alice’s onions, (at least) $\frac{1-\kappa}{9}$ of Alice’s onions will make it to the equalizing phase. Since $\adv$ cannot do better than this, this proves Lemma 5. (See Appendix B.3 for the full proof.) ∎

Proof sketch of Lemma 4.

From Lemma 5, if $\Pi_{\bowtie}^{\mathit{ideal}}$ continues into the equalizing phase, then a constant fraction of each honest party’s merging onions are still in play at the start of the equalizing phase. However, Lemma 5 does not guarantee that there will be an epoch $i>nyz$ such that the number of Alice’s merging onions at epoch $i$, $\textsf{numMO}_{\textsf{Alice},i}$, will be close to that of Allison’s, $\textsf{numMO}_{\textsf{Allison},i}$. To prove that $\Pi_{\bowtie}^{\mathit{ideal}}$ equalizes, we need to show that there exists an epoch $i\leq d$ such that (for any two parties Alice and Allison), $\textsf{numMO}_{\textsf{Alice},i}\approx\textsf{numMO}_{\textsf{Allison},i}$. If $\adv$ doesn’t drop any commutable onions during the equalizing phase, then this condition is satisfied by the merging of onions.

So what can $\adv$ do? The only information that $\adv$ has for guessing where any commutable onion came from is which onions are part of a mergeable pair and which are not; this is because the onions are shuffled during the mixing phase and each epoch of the equalizing phase. Let a singleton be a commutable onion that is not part of a mergeable pair; note that it can be either a checkpoint onion or a merging onion. W.l.o.g., suppose that $\adv$ dropped more of Alice’s onions upfront (during the mixing phase) than Allison’s. Then, at the start of the equalizing phase, it is likely that more singletons are Alice’s merging onions than Allison’s merging onions. So, $\adv$ can attempt to prevent the numbers of merging onions from evening out by dropping singletons. We can show that the best that $\adv$ can do is to drop as many singletons as possible (without causing the protocol to be aborted) at the beginning of the equalizing phase. (Of course, $\adv$ could also drop onions that belong in a mergeable pair, but this would only help to even out the numbers of merging pairs.) Even if $\adv$ does this, there exists an epoch $i\leq d$ such that $\textsf{numMO}_{\textsf{Alice},i}\approx\textsf{numMO}_{\textsf{Allison},i}$. (See Appendix B.4 for the full proof.)

Armed with Lemma 5 and the above analysis, we can prove that $\Pi_{\bowtie}^{\mathit{ideal}}$ equalizes. If the adversary drops too many onions during the mixing phase, then $\Pi_{\bowtie}^{\mathit{ideal}}$ equalizes since every honest party stops participating (Lemma 5), and so no one receives their message. Otherwise, $\Pi_{\bowtie}^{\mathit{ideal}}$ equalizes since enough of each sender’s merging onions make it to the equalizing phase (Lemma 5), and the numbers of merging onions are eventually evened out by the merging of onions (above). ∎

7 Our lower bound: polylog onion cost is required

In this section, we present our lower bound: an onion routing protocol can be anonymous from the active adversary only if the onion cost is superlogarithmic in the security parameter. Our lower bound holds for protocols that are minimally functional for the active adversary. We call this notion weakly robustness, defined below. The reason this definition is weaker than robustness (Definition 7) is that here we only insist that the protocol guarantee delivery for senders whose onions are never dropped.

Definition 8** (Weakly robust).**

Let \Pi(1^{\lambda},\mathsf{pp},\mathsf{states},\,\sigma)$be an onion routing protocol and let$\adv$be an adversary attacking$\Pi$that drops at most$\bigO{\log(\lambda)}$onions.$\Pi$is weakly robust if whenever$\adv$doesn’t drop any onions sent by honest party$P$,$P$’s message will be delivered to its recipient with overehlming probability.

Theorem 4**.**

If the onion routing protocol \Pi(1^{\lambda},\mathsf{pp},\mathsf{states},\,\sigma)$is weakly robust and (computationally) anonymous from the adversary$\adv$who corrupts up to a constant fraction of the parties and drops at most$f(\lambda)=\bigO{\log(\lambda)}$onions, then the onion cost of$\Pi$interacting with$\adv$is$\smallOmega{f(\lambda)}$.

Let us give the intuition for the proof of this theorem. If an honest $P_{i}$ sends out only $\bigO{\log(\lambda)}$ onions, then an adversary that chooses which participants to corrupt uniformly at random has a $1/\lambda^{\bigO{1}}$ chance of controlling each and every participant that ever receives an onion directly from $P_{i}$. (This is because $\bigO{\log(\lambda)}=\bigO{\log(N)}$, since $\lambda$ and $N$ are polynomially related.) Thus with non-negligible probability it can cut off $P_{i}$ entirely by dropping all of the onions it sends out, guaranteeing that the intended recipient of $P_{i}$’s message never receives the message; yet, by weak robustness (Definition 8), we can show that there will be some recipient whose probability of receiving his message is high. Therefore, $\Pi$ will not equalize (Definition 4): based on who failed to receive the message, it is possible to determine whether $P_{i}$’s intended recipient was Bob or Bill. Since it does not equalize, by Theorem 2, it is not anonymous. The full proof is in Section D.

8 Conclusion and future work

Here, we mention a few extensions of our results: We proved that the required onion cost for an onion routing protocol to provide robustness and (computational) anonymity from the active adversary is polylogarithmic in the security parameter. Our proof for the lower bound can be used to prove the stronger result that polylogarithmic onion cost is required even when (1) the adversary observes the traffic on only $\bigsmallO{1}$ fraction of the links and or when (2) the security definition is weakened to (computational) differential privacy. (3) Also, while we explicitly showed this to be the case for the simple I/O setting, the result holds more generally whenever any party can send a message to any other party.

We also proved the existence of a robust and anonymous onion routing protocol with polylogarithmic (in the security parameter) onion cost. (4) This result also extends beyond the simple I/O setting; our onion routing protocol is anonymous w.r.t. any input set where the size of each party’s input is fixed.

There is a small gap between our lower and upper bounds. A natural direction for future work is to close this gap.

Appendix A Proof that equalizing and mixing $\implies$ anonymity

Proof.

[Proof of Theorem 1] Suppose that $\Pi$ equalizes. We wish to show that in this case, mixing implies anonymity. To show this, we will provide a reduction $\bdv$ that wins the mixing game with non-negligible advantage using an adversary $\adv$ that wins the anonymity game with non-negligible advantage.

Without loss of generality we will only consider $\adv$ that always chooses swap-neighboring input vectors for the challenge input vectors $\sigma^{0}$ and $\sigma^{1}$, where swap-neighboring means that there exist parties $P_{i},P_{j}\in\mathcal{P}$ such that (i) $\sigma^{0}_{k}=\sigma^{1}_{k}$ for every party $P_{k}\notin\{P_{i},P_{j}\}$, (ii) $\sigma^{0}_{i}=\sigma^{1}_{j}$, and (iii) $\sigma^{0}_{j}=\sigma^{1}_{i}$.

By a straightforward hybrid argument, it follows that: The onion routing protocol $\Pi$ anonymizes from the adversary class $\mathbb{A}$ in the simply I/O setting if no every adversary $\adv$ that sets $\sigma^{0}$, $\sigma^{1}$ to be swap-neighboring can win the anonymity game with non-negligible advantage.

So our goal is to construct a reduction $\bdv$ that wins the mixing game $\mathsf{MixingGame}(1^{\lambda},\Pi,\adv)$ with nonnegligible advantage from an adversary $\adv$ that wins the anonymity game with swap-neighboring $\sigma^{0},\sigma^{1}$ with nonnegligible advantage.

Key setup:

• •

The adversary $\adv$ picks the set $\mathsf{Bad}$ of corrupt parties. This information is relayed to the reduction $\bdv$ who forwards it to the challenger $\cdv$ of the mixing game.

• •

$\cdv$ replies to $\bdv$ with the public keys $\pk(\mathcal{P}\setminus\mathsf{Bad})$ of the honest parties. $\bdv$ forwards these public keys to $\adv$.

• •

$\adv$ then picks the keys for the adversarial parties and sends the public-key portions $\pk(\mathsf{Bad})$ to $\bdv$, who relays them to $\cdv$. 2. 2.

Input selection:

• •

$\adv$ picks swap-neighboring input vectors $\sigma^{0}$ and $\sigma^{1}$ such that $\sigma^{0}\equiv_{\mathsf{Bad}}\sigma^{1}$. Let $P_{i}$ and $P_{j}$ be the (necessarily) honest parties whose inputs are swapped in $\sigma^{0}$ and $\sigma^{1}$. $\adv$ sends the input vectors $(\sigma^{0},\sigma^{1})$ to $\bdv$.

• •

Let $R_{i}^{0}$ be the recipient of $P_{i}$ in $\sigma^{0}$, and let $R_{i}^{1}$ be the recipient of $P_{i}$ in $\sigma^{1}$. $\bdv$ converts the information $(\sigma^{0},\sigma^{1})$ to the corresponding partial input vector $\tilde{\sigma}$, i.e., in $\tilde{\sigma}$, $\sigma_{k}=\sigma_{k}^{0}=\sigma_{k}^{1}$ for $k\notin\{i,j\}$. $\bdv$ sends the partial input vector $\tilde{\sigma}$ to $\cdv$.

• •

$\cdv$ picks a random bijection from the set $\mathsf{S}=\{P_{i},P_{j}\}$ to the set $\mathsf{R}=\{R_{i}^{0},R_{i}^{1}\}$ to complete the input vector $\sigma$. 3. 3.

$\adv$, $\bdv$, and $\cdv$ interact in an execution of protocol $\Pi$ on input $\sigma$ (kept secret by $\cdv$) with $\cdv$ acting as the honest parties adhering to the protocol and $\adv$ (via $\bdv$) controlling the corrupted parties. 4. 4.

Let $\mathsf{O}_{i}^{0}$ be the set of honest onions received by $R_{i}^{0}$, and let $\mathsf{O}_{i}^{1}$ be the set of honest onions received by $R_{i}^{1}$. Upon receiving a guess $b^{\prime}$ from $\adv$, $\bdv$ picks onions $O_{s}$ and $O_{\overline{s}}$ and a sender $P_{s}$ as follows:

[TABLE]

$\bdv$ guesses that onion $O_{s}\mathrel{\stackrel{{\scriptstyle\makebox[0.0pt]{\mbox{\tiny def}}}}{{=}}}O^{b^{\prime}}$ was sent by $P_{s}$ and $O_{\overline{s}}\mathrel{\stackrel{{\scriptstyle\makebox[0.0pt]{\mbox{\tiny def}}}}{{=}}}O^{\overline{b^{\prime}}}$ was not.

We now explain why the reduction works.

Let $\mathsf{Adv}_{\adv}$ denote $\adv$’s advantage in winning the anonymity game, and let $(\mathsf{Adv}_{\adv})|_{E}$ denote $\mathsf{Adv}_{\adv}$ conditioned on event $E$. Let $\mathsf{Good}$ be the event that each target recipient receives at least one challenge onion.

Claim: $\mathsf{Good}$ occurs with non-negligible probability, and $(\mathsf{Adv}_{\adv})|_{\mathsf{Good}}$ is non-negligible, i.e., $\prob{\mathsf{Good}}\cdot(\mathsf{Adv}_{\adv})|_{\mathsf{Good}}$.

$\bdv$ wins the mixing game if (i) $\bdv$ picks two valid valid onions (one for $R_{i}^{0}$ and the other for $R_{i}^{1}$), and (ii) $\adv$ wins the anonymity game. Thus, if the claim holds, $\bdv$ wins with non-negligible advantage since (i) occurs with non-negligible probability, and (ii) occurs with non-negligible advantage.

Thus, to prove that the reduction works, it suffices to show that the above claim holds. We do this below.

Let an onion $O$ be a cured onion if it can be processed into a challenge onion, i.e., letting $P$ denote the party who receives $O$ in the execution, $\mathsf{ProcOnion}(\sk(P),O,P)$ produces a challenge onion $O^{\prime}$.

Let $\mathsf{Zero}$ be the event that there are cured onions for one of the target receivers. Given $\mathsf{Zero}$, the adversary $\adv$ has no advantage in winning the anonymity game:

If there are no cured onions for either $R_{i}^{0}$ or $R_{i}^{1}$ during the execution, then $\adv$ doesn’t observes any challenge onion/its destination. Since $\Pi$ is indifferent (and the underlying onion encryption scheme is secure), this implies that everything observable by $\adv$ is statistically the same on input $\sigma^{0}$ as it is on $\sigma^{1}$, and so $\adv$ cannot fare better than a random guess in winning the anonymity game.

The adversary’s advantage is also negligible in the case where there are cured onions for only one of the receivers. This is because a difference in the numbers of cured onions observed during the execution cannot relay any information regarding the input when $\Pi$ is indifferent and equalizes (and the underlying onion encryption scheme is secure).

Let $\overline{\mathsf{Zero}}$ be the complement of $\mathsf{Zero}$. $\mathsf{Adv}_{\adv}$ can be expanded as:

[TABLE]

and so $\prob{\overline{\mathsf{Zero}}}\cdot(\mathsf{Adv}_{\adv})|_{\overline{\mathsf{Zero}}}$ is non-negligible in the security parameter.

Given $\overline{\mathsf{Zero}}$, $\adv$ can reliably drop all challenge onions for one target receiver (w.l.o.g., $R_{i}^{0}$) but leave at least one challenge onion for the other target receiver ($R_{i}^{1}$) only if $\adv$ could directly win the mixing game with non-negligible advantage. This implies our claim above. ∎

Appendix B Proofs of Lemmas 3, 4, and 5, and 7

This section contains the full proofs of the lemmas used to prove that $\Pi_{\bowtie}^{\mathit{ideal}}$ is anonymous (Theorem 3).

We prove that $\Pi_{\bowtie}^{\mathit{ideal}}$ mixes in Appendix B.1 by proving that the protocol mixes commutable onions during the last epoch of the execution phase. In Appendix B.2, we define what it means for an onion routing protocol to equalize from commutable onions (Definition 10) and show that equalizing from commutable onions implies equalizing (Lemma 7). Appendices B.3 and B.4 contain the full proofs for Lemmas 5 and 4: these are used to support our claim that $\Pi_{\bowtie}^{\mathit{ideal}}$ equalizes from commutable onions.

B.1 Proof that $\Pi_{\bowtie}^{\mathit{ideal}}$ mixes

In this section, we prove Lemma 3: $\Pi_{\bowtie}^{\mathit{ideal}}$ mixes.

To do this, we will prove that $\Pi_{\bowtie}^{\mathit{ideal}}$ “sufficiently shuffles” the commutable onions, where a commutable onion is an onion that is formed by an honest party, which is not a checkpoint onion to be verified by an adversarial party. Formally, we define what this means using the following game.

The game.

Let $\mathcal{OE}=(\mathsf{Gen},\mathsf{FormOnion},\mathsf{ProcOnion})$ be a secure onion encryption scheme. The mixing game $\mathsf{CommutableMixingGame}(1^{\lambda},\Pi,\adv,r_{1},r_{2})$ is parametrized by the security parameter $1^{\lambda}$, an onion routing protocol $\Pi$, an adversary $\adv$, and two round numbers $r_{1}$ and $r_{2}\geq r_{1}$.

First, the adversary $\adv$ and the challenger $\cdv$ set up the parties’ keys and select the input $\sigma$ (exactly as we described for the original mixing game in Section 3.3).

Next, $\cdv$ interacts with $\adv$ in an execution of protocol $\Pi$ on input $\sigma$ with $\cdv$ acting as the honest parties adhering to the protocol and $\adv$ controlling the corrupted parties. Whenever the protocol $\Pi$ specifies for an onion to be formed or processed, $\cdv$ runs the onion encryption scheme’s onion-forming algorithm $\mathsf{FormOnion}$ or onion-processing algorithm $\mathsf{ProcOnion}$. Whenever $\cdv$ forms a non-commutable onion (i.e., a checkpoint onion to be verified by an adversarial party), $\cdv$ provides $\adv$ with the input and output of the algorithm $\mathsf{FormOnion}$: the message, the routing path, the keys associated with the parties on the path, the sequence of nonces, and the evolution of onion layers.

Let $\mathsf{O}_{r_{2}}$ be the set of commutable onions received by the parties in round $r_{2}$. Let $\mathsf{O}_{r_{1}}$ be the set of (commutable) onions in round $r_{1}$ that “evolve” into an onion in $\mathsf{O}_{r_{2}}$; that is, an onion $O$ is in $\mathsf{O}_{r_{1}}$ iff a peeled version of $O$ is in $\mathsf{O}_{r_{2}}$.

At the end of the execution, $\cdv$ provides $\adv$ with the following information: for each onion in $\mathsf{O}_{r_{1}}$, the onion’s evolution from the first round to round $r_{1}$; and for each onion in $\mathsf{O}_{r_{2}}$, the onion’s evolution from round $r_{2}$ to the final round. Based on this auxiliary information and its view, $\adv$ chooses two onions $O_{0},O_{1}\in\mathsf{O}_{r_{2}}$. $\cdv$ picks a random bit $b\sample\bin$ and provides $\adv$ with the onion $O^{\prime}_{b}\in\mathsf{O}_{r_{1}}$ that evolves into $O_{b}$, and $\adv$ outputs a guess $b^{\prime}$ for $b$.

If $O_{0}$ and $O_{1}$ were formed by different senders and evolve into valid challenge onions (see the description of the original mixing game in Section 3.3 for a reminder of what a valid challenge onion is), and if $b^{\prime}=b$, then $\adv$ wins with probability one. Otherwise, $\adv$ wins with probability one-half.

We now define what it means for an onion routing protocol to mix commutable onions from round $r_{1}$ to round $r_{2}$.

Definition 9** (Mixing commutable onions from round $r_{1}$ to round $r_{2}$).**

Let \Pi(1^{\lambda},\mathsf{pp},\mathsf{states},\,\sigma)$be an onion routing protocol; let$\adv$be an adversary; and let$r_{1}$and$r_{2}\geq r_{1}$be round numbers. Let$E$be an event in the probability space defined by the experiment,$\mathsf{CommutableMixingGame}(1^{\lambda},\Pi,\adv,r_{1},r_{2})$.$\Pi$mixes commutable onions from round$r_{1}$to round$r_{2}$conditioned on$E$for$\adv$if, given$E$,$\adv$wins$\mathsf{CommutableMixingGame}(1^{\lambda},\Pi,\adv,r_{1},r_{2})$with negligible advantage, i.e.,$\left|\prob{\text{$\adv$ wins $\mathsf{CommutableMixingGame}(1^{\lambda},\Pi,\adv,r_{1},r_{2})$},|,E}-\frac{1}{2}\right|=\negl.$

The protocol computationally (resp. statistically) mixes commutable onions from round $r_{1}$ to round $r_{2}$ if $\adv$ is computationally bounded (resp. unbounded).

We can relate Definition 9 to mixing (Definition 5) as follows:

Lemma 6**.**

Let \Pi(1^{\lambda},\mathsf{pp},\mathsf{states},\,\sigma)$be a indifferent onion routing protocol; let$\adv$be an adversary; and let$r_{1}$and$r_{2}\geq r_{1}$be round numbers. Let$E$be an event in the probability space defined by the experiment,$\mathsf{CommutableMixingGame}(1^{\lambda},\Pi,\adv,r_{1},r_{2})$. If$\Pi$mixes commutable onions from round$r_{1}$to round$r_{2}$conditioned on$E$for$\adv$, then$\Pi$mixes conditioned on$E$for$\adv$.

Proof.

Suppose that $\adv$ can “break” mixing, i.e., $\adv$ can win the mixing game $\mathsf{MixingGame}(1^{\lambda},\Pi,\adv)$ with non-negligible advantage. Then, for any rounds $r_{1},r_{2}\geq r_{1}$, we can construct a reduction $\bdv$ that can win $\mathsf{CommutableMixingGame}(1^{\lambda},\Pi,\adv,r_{1},r_{2})$ with non-negligible advantage as follows:

$\adv$ chooses the set $\mathsf{Bad}$ of parties to corrupt. $\cdv$ generates the keys for the honest parties, and $\adv$ picks the keys for the corrupt parties. Then, the adversary chooses the target senders $\mathsf{S}$, the target receivers $\mathsf{R}$, and the partial input vector $\tilde{\sigma}$, and $\cdv$ samples a random input vector $\sigma$ that “completes” $\tilde{\sigma}$. After interacting in a protocol run with $\cdv$ (via $\bdv$), $\adv$ outputs two onions $O_{s}$ and $O_{\bar{s}}$ received by parties in $\mathsf{R}$ and a party $P_{s}\in\mathsf{S}$. $\bdv$ determines the onions $O_{0},O_{1}\in\mathsf{O}_{r_{2}}$ that “evolve” into $O_{s}$ and $O_{\bar{s}}$. ($\bdv$ can do this since $\Pi$ is indifferent and, therefore, round $r_{2}$ cannot occur after the final round in which $O_{s}$ and $O_{\bar{s}}$ are received.) $\bdv$ relays $(O_{0},O_{1})$ to $\cdv$, and $\cdv$ responds with the onion $O^{\prime}_{b}\in\mathsf{O}_{r_{1}}$. If $O^{\prime}_{b}$ was formed by $P_{s}$, then $\bdv$ guesses $b^{\prime}=0$; otherwise, $\bdv$ outputs a random bit for $b^{\prime}$.

The reduction works since, conditioned on $E$ and $\adv$’s challenge being valid, $\bdv$ wins half of the time that $\adv$ wins (when $b=0$). ∎

We now prove Lemma 3 via Lemma 6.

Proof.

[Proof of Lemma 3] Here, we prove that $\Pi_{\bowtie}^{\mathit{ideal}}$ mixes. From Lemma 6, to prove that $\Pi_{\bowtie}^{\mathit{ideal}}$ mixes, it suffices to show that the protocol mixes commutable onions from the the first round of the penultimate epoch, round $r_{1}$, to the last round of the penultimate epoch, round $r_{2}$.

Case 1. Let $E$ be the event that every honest party aborts by the first round the final epoch, round $r_{2}+1$. Given $E$, $\Pi_{\bowtie}^{\mathit{ideal}}$ mixes since w.o.p., no honestly formed onion will be delivered. (With overwhelming probability, the latter half of each honestly formed onion contains an honest party who has already aborted the run.)

Case 2. Let $\overline{E}$ be the complement of $E$. That is, $\overline{E}$ is the event that there is an unaborted honest party at the first round of the final epoch, round $r_{2}+1$. Let us condition on $\overline{E}$. The adversary cannot drop more than a constant fraction of all commutable onions without also dropping a proportional number of checkpoint onions: if the adversary were to drop more than a constant fraction of all commutable onions, then, from known probability concentration bounds [HS05], w.o.p., the adversary would drop close to a proportional number of checkpoint onions, which, in turn, would cause all honest parties to abort the run. Therefore, the average number of commutable onions routed to any party at a round $r\leq r_{2}$ is superlogarithmic in the security parameter.

Let $\mathsf{O}_{r_{2}}$ be the set of commutable onions at round $r_{2}$. Suppose that $\adv$ is given $\mathsf{O}_{r_{2}}$ and allowed to choose any two onions $O_{0}$ and $O_{1}$ in $\mathsf{O}_{r_{2}}$. Let $O^{\prime}_{0}$ and $O^{\prime}_{1}$ be onions at round $r_{1}$ that “evolve” into $O_{0}$ and $O_{1}$. Below, we prove the claim: even if $\adv$ were provided the set $\{O^{\prime}_{0},O^{\prime}_{1}\}$ (in addition to her view and $\mathsf{O}_{r_{2}}$), the sequence of onion layers that preceded $O^{\prime}_{0}$, and the sequence of onion layers that preceded $O^{\prime}_{1}$, $\adv$ still wouldn’t be able to guess which onion in $\{O^{\prime}_{0},O^{\prime}_{1}\}$ is the peeled version of $O_{0}$ with better than negligible advantage.

Proof of claim: For $r<r_{2}$, let $\mathsf{O}_{r}$ be the set of onions defined as follows: an onion $O_{r}\in\mathsf{O}_{r}$ iff there exists an onion $O_{r_{2}}\in\mathsf{O}_{r_{2}}$ such that we get $O_{r_{2}}$ by “peeling off” layers from $O_{r}$.

For a round $r$ and a party $Q$, let $\mathsf{vol}(Q,r)$ denote the volume (i.e., number) of onions in $\mathsf{O}_{r}$ located at $Q$.

Let $\tilde{O}_{r_{2}}\in\mathsf{O}_{r_{2}}$ be any commutable onion at round $r_{2}$, and let $P$ denote the location of $\tilde{O}_{r_{1}}$ (i.e., the party who receives $\tilde{O}_{r_{1}}$). Let $\mathcal{D}(Q,r)$ denote the (unbounded) adversary’s “best estimate” that the onion $\tilde{O}_{r}\in\mathsf{O}_{r}$ at round $r$ from which $\tilde{O}_{r_{2}}$ evolved is at party $Q$, and define $g(r)\mathrel{\stackrel{{\scriptstyle\makebox[0.0pt]{\mbox{\tiny def}}}}{{=}}}\max_{Q}\frac{\mathsf{vol}(Q,r)}{|\mathsf{O}_{r}|}\mathcal{D}(Q,r)-\min_{Q}\frac{\mathsf{vol}(Q,r)}{|\mathsf{O}_{r}|}\mathcal{D}(Q,r)$. That is, $g(r)$ is the “gap” in probabilities at round $r$; it is the difference between the highest (normalized) probability at round $r$ and the lowest. Assume for a moment that there are no corrupt parties. Then, using Chernoff bounds, we can show that the gap at least halves with every round, i.e., $\frac{g(r)}{g(r+1)}\leq\frac{1}{2}$; the proof is essentially the same argument made for proving an earlier result [ALU18, Theorem 10]. Since $r_{2}-r_{1}$ is superlogarithmic in $\lambda$, this implies that $g(r_{1})$ is negligible in $\lambda$. In other words, $\tilde{O}_{r_{2}}$ cannot be traced back to $P$. This is still true when at most a constant fraction of the parties are corrupt; this is because w.o.p., any pair of commutable onions (formed by honest parties) both route to (possibly different) honest parties for at least a constant fraction of the rounds between $r_{1}$ and $r_{2}$.

In conclusion, $\Pi_{\bowtie}^{\mathit{ideal}}$ mixes either because it was aborted by all honest parties midway through the last epoch of the execution, or because the protocol sufficiently shuffles the commutable onions during the last epoch of the execution. The latter which implies that the protocol mixes conditioned on $\overline{E}$ from Lemma 6. ∎

B.2 Proof that equalizing from commutable onions $\implies$ equalizing

First, we formally define what it means for the distinguisher to win the equalizing game then the adversary knows everything about non-commutable onions.

The game.

The game $\mathsf{CommutableEqualizingGame}(1^{\lambda},\Pi,\adv,\ddv,\Sigma)$ is parametrized by the security parameter $1^{\lambda}$, an onion routing protocol $\Pi$, an adversary $\adv$, a distinguisher $\ddv$, and a set $\Sigma$ of input vectors.

The game starts exactly like the anonymity game (described in Section 3.1): First, the adversary $\adv$ and the challenger $\cdv$ set up the parties’ keys. Then, $\adv$ selects two inputs $\sigma^{0}$ and $\sigma^{1}$ from $\Sigma$ (that are equivalent w.r.t. the set $\mathsf{Bad}$ of corrupted parties), and $\cdv$ picks a random bit $b\sample\bin$.

The parties interact in an execution of protocol $\Pi$ on input $\sigma^{b}$ with $\cdv$ acting as the honest parties adhering to the protocol and $\adv$ controlling the corrupted parties. Whenever the protocol $\Pi$ specifies for an onion to be formed or processed, $\cdv$ runs the onion encryption scheme’s onion-forming algorithm $\mathsf{FormOnion}$ or onion-processing algorithm $\mathsf{ProcOnion}$. Whenever $\cdv$ forms a non-commutable onion (i.e., a checkpoint onion to be verified by an adversarial party), $\cdv$ provides $\adv$ with the input and output of the algorithm $\mathsf{FormOnion}$: the message, the routing path, the keys associated with the parties on the path, the sequence of nonces, and the evolution of onion layers.

At the end of the execution, $\cdv$ computes the statistics $\mathbf{v}=(v_{1},\dots,v_{N})$, where each $v_{r}$ represents the number of messages that party $P_{r}$ received during the execution. (See the description of the original equalizing game in Section 3.2 to recall how the statistics are computed for adversarial parties).

$\cdv$ sends these statistics $\mathbf{v}$ to the distinguisher $\ddv$, who outputs a guess $b^{\prime}$ for $b$ and wins the game if $b^{\prime}=b$. We define equalizing from commutable onions as follows.

Definition 10** (Equalizing from commutable onions).**

An onion routing protocol \Pi(1^{\lambda},\mathsf{pp},\mathsf{states},\,\sigma)$equalizes from commutable onions from the adversary class$\mathbb{A}$w.r.t. the input set$\Sigma$if for every adversary$\adv\in\mathbb{A}$and for every distinguisher$\ddv$,$\ddv$wins the game$\mathsf{CommutableEqualizingGame}(1^{\lambda},\Pi,\adv,\ddv,\Sigma)$with only negligible advantage, i.e.,$\left|\prob{\text{$\ddv$ wins $\mathsf{CommutableEqualizingGame}(1^{\lambda},\Pi,\adv,\ddv,\Sigma)$}}-\frac{1}{2}\right|=\negl.$ The protocol computationally (resp. statistically) equalizes from commutable onions if the adversaries and the distinguishers are computationally bounded (resp. unbounded).

If the distinguisher can win the equalizing game with non-negligible advantage, then she can also win the equalizing game from commutable onions (i.e., when the adversary is given auxiliary information). It follows that,

Lemma 7**.**

If the onion routing protocol \Pi(1^{\lambda},\mathsf{pp},\mathsf{states},\,\sigma)$equalizes from commutable onions from the adversary class$\mathbb{A}$, then$\Pi$equalizes from$\mathbb{A}$.

B.3 Proof of Lemma 5

The adversary’s goal is to prevent the protocol from equalizing. The adversary can win if for any honest parties $P$ and $Q$, there is a strategy for dropping $P$’s message with probability noticeably higher than that of dropping $Q$’s message. At the first round, the adversary still knows the sender of every onion. As the protocol progresses, the onions get shuffled, and the adversary loses track of who sent which onion. Thus, a conceivable attack by the adversary is to drop onions likely to have originated at $P$ upfront.

Lemma 5 states that if the adversary drops at most a logarithmic number of onions during the mixing phase, then a constant fraction of $P$’s onions will remain at the start of the equalizing phase. If the adversary drops many more onions than this, then every honest party will detect the attack and abort the protocol.

We now formally state and prove Lemma 5.

Let $\mathsf{start}\mathrel{\stackrel{{\scriptstyle\makebox[0.0pt]{\mbox{\tiny def}}}}{{=}}}(\log N+1)z$ be the number of epochs in the mixing phase, and let “the start of the equalizing phase” be diagnostic round $\mathsf{start}$. (It is more precisely the end of the mixing phase.)

Formal statement of Lemma 5.

In $\Pi_{\bowtie}^{\mathit{ideal}}$, let the onion encryption scheme be perfectly secure; let $x=y=z=\epsilon_{1}\log^{1+\epsilon_{2}}\lambda$; and let $t=\frac{W}{3}$, where $N$ is the number of participants, $\lambda$ is the security parameter, and $W=\frac{(1-\kappa)x}{z\log N+\log x}$.

Let $0\leq\kappa<\frac{1}{2}$ be a fixed constant, representing the “corruption rate.” Let $\mathsf{Bad}\subseteq\mathcal{P}$ be any set of participants in $\mathcal{P}$ such that $|\mathsf{Bad}|\leq\kappa N$, and let $\adv$ be any active adversary who corrupts the set $\mathsf{Bad}$ of parties.

Let $\sigma$ be any input in the simple I/O setting.

For a party $P$, let $V^{P}_{\mathsf{start}}$ denote the number of $P$’s merging onions that remain at the start of the equalizing phase in an interaction between $\Pi_{\bowtie}^{\mathit{ideal}}$ and $\adv$ on input $\sigma$. If there exists an honest party $Q\in\mathcal{P}\setminus\mathsf{Bad}$ such that $Q$ is unaborted after the start of the equalizing phase, then w.o.p., $V^{P}_{\mathsf{start}}\geq\frac{(1-\kappa)x}{9}$ for all $P\in\mathcal{P}\setminus\mathsf{Bad}$.

Proof.

[Proof of Lemma 5] Fix any target honest party $P$.

We will first consider what happens when the adversary $\adv$ employs the following tactic $T$. (Later on, we will analyze that happens when $\adv$ tries a different tactic.) In between the first and second rounds, $\adv$ drops every onion that $P$ sends to an adversarial party. In between the second and third rounds and between the third and fourth rounds, $\adv$ drops every onion that might have come from $P$. For example, suppose that in the first round, $P$ sends an onion to an honest party. Then, $\adv$ drops every onion that the honest party sends to an adversarial party in the second round.

Let $O$ be any onion that first routes to an honest party, which we will denote $H$. W.l.o.g., assume that $O$ is designed to shuffle between $H$ and an adversarial intermediary $I$ during the first epoch of the mixing phase. More precisely, the position of the peeled version of $O$ shuffles between $H$ and $I$. (We can assume that $I$ is adversarial since otherwise $I$ is also honest.) By design, all honestly formed onions that first go to $H$ or $I$ shuffle randomly between $H$ and $I$ for the first epoch of the mixing phase.

By using tactic $T$, the adversary drops too many onions for the protocol to continue. If $\adv$ drops every onion that $H$ sends to $I$ in the second and third rounds, then w.o.p., $H$ will detect this and abort the protocol run before the second epoch. (This follows from a known probability concentration bound for the hypergeometric distribution [HS05].) $H$ aborting the protocol run, in turn, will cause the network to be flooded with abort messages, and the remaining honest parties to eventually abort. (While at least half of the honest parties are unaborted, the number of aborted honest parties grows super-exponentially w.r.t. the number of rounds. This follows from recasting the problem as a martingale problem and applying the Azuma-Hoeffding inequality; see Lemma 8 below.)

At the end of the first epoch, the adversary can drop almost all of the onions he has. So the $P$’s onions that are “safe” are those that are routed to an honest party in the first round, and again to the same honest party in the second, third, and final rounds of the first epoch.

What fraction of $P$’s onions are “safe?” For an arbitrarily small positive constant $\delta>0$, at least $(1-\delta)(1-\kappa)x$ of $P$’s merging onions go to an honest party at the first round (Chernoff bounds), and at least $\frac{1-\delta}{8}$ fraction of these go to an honest party in the second, third, and final rounds (Chernoff bounds). In particular, these bounds hold for any $\delta\leq 1-\frac{2\sqrt{2}}{3}$. Thus, the answer is: w.o.p., at least $\frac{(1-\kappa)}{9}$.

We now consider what happens when $\adv$ behaves arbitrarily.

For every honest party $Q$, let $I(Q)$ denote the party that $Q$ shuffles onions with during the first epoch. Let $D(Q)$ be the number of onions that $\adv$ drops during the first epoch that would have shuffled between $Q$ and $I(Q)$, and let $D_{\max}\mathrel{\stackrel{{\scriptstyle\makebox[0.0pt]{\mbox{\tiny def}}}}{{=}}}\max_{Q\in\mathcal{P}\setminus\mathsf{Bad}}D(Q)$.

Case 1: If $D_{\max}\geq\frac{(1-\kappa)x}{2}$, then w.o.p., the honest parties will abort the protocol for the same reason that they would in an interaction with an adversary employing tactic $T$: $\adv$ drops too many onions.

Case 2: If $D_{\max}\leq\frac{(1-\kappa)x}{2}$, then $\adv$ either makes fewer targeted drops or delays targeted drops. Either way, $\adv$ cannot eliminate more of $P$’s onions than it would by employing tactic $T$. Thus, in this case, $V^{P}_{\mathsf{start}}\geq\frac{(1-\kappa)x}{9}$. ∎

Lemma 8**.**

Let $\lambda$ be the security parameter, and let ${N^{\prime}}=(1-\kappa)N\leq\poly$ be the number of honest parties (or locations). Let $\mathcal{O}$ be the set of commutable onions at any round $r$ of the protocol execution. If $|\mathcal{O}|=\bigOmega{\log^{2}\lambda}$ and $|\mathcal{O}|\leq({N^{\prime}}+2)/2$, then, with overwhelming probability in $\lambda$, at least $|\mathcal{O}|/\log\lambda$ parties receive at least one onion from $\mathcal{O}$.

Proof.

Let $X=|\mathcal{O}|$ be the size of $\mathcal{O}$.

We recast this problem as a balls-and-bins problems, where the onions in $\mathcal{O}$ are the balls, and the parties (or locations) are the bins. To prove the lemma, we show that when $X=|\mathcal{O}|$ balls are thrown independently and uniformly at random into the ${N^{\prime}}$ bins, with overwhelming probability in $\lambda$, the number of non-empty bins is at least $\frac{X}{\log\lambda}$.

Let $L_{1},\dots,L_{N^{\prime}}$ be the ${N^{\prime}}$ bins. For each $i\in[{N^{\prime}}]$, let $X_{i}$ be the indicator random variable that is one if the $i$-th bin $L_{i}$ is empty (and zero, otherwise). The probability that $L_{i}$ remains empty is given as $\prob{X_{i}=1}=\expect{X_{i}}=\left(1-\frac{1}{{N^{\prime}}}\right)^{X}.$ The total number $X=\sum_{i=1}^{N^{\prime}}X_{i}$ of empty bins is the summation of all the $X_{i}$’s. By the linearity of expectation, $\expect{X}=\sum_{i=1}^{N^{\prime}}\expect{X_{i}}={N^{\prime}}\left(1-\frac{1}{{N^{\prime}}}\right)^{X}.$

Let $W$ be the total number of non-empty bins; i.e., $W={N^{\prime}}-X$. Again by linearity of expectation,

[TABLE]

where (2) holds since $\left(1-\frac{1}{{N^{\prime}}}\right)^{X}$ is strictly less than the first three terms of its Laurent series, and (3) holds since $X\leq\frac{{N^{\prime}}+2}{2}$ by the hypothesis.

For every $i\in[X]$, let $Y_{i}$ be the location of the $i$-th ball, and let

[TABLE]

The sequence $Z_{1},\dots,Z_{X}$ is a Doob martingale by construction, satisfying the Lipschitz condition with constant bound one, i.e., $|Z_{i-1}-Z_{i}|\leq 1$. Thus, we may apply the Azuma-Hoeffding inequality as follows: For $\delta\geq\frac{\log\lambda-2}{\log\lambda}$,

[TABLE]

where (4) follows directly from (3), and (5) holds since $\delta\geq\frac{\log\lambda-2}{\log\lambda}$ and $X\geq\alpha\log^{2}\lambda$ from the hypothesis.

In other words, with overwhelming probability in $\lambda$,

[TABLE]

Thus, it follows that, with overwhelming probability in $\lambda$,

[TABLE]

where (6) follows directly from (3). ∎

B.4 Proof of Lemma 4.

Let $\epsilon>0$ be any small constant such that $\frac{1+\epsilon}{1-\epsilon}\leq 1+\epsilon_{2}$.

Recall that “$\mathsf{start}$” is the start of the equalizing phase. Let the “partway point” be the diagnostic round in epoch $\mathsf{partway}$, where $\mathsf{partway}\mathrel{\stackrel{{\scriptstyle\makebox[0.0pt]{\mbox{\tiny def}}}}{{=}}}\mathsf{start}+\ceil{\log x/\epsilon}$.

In this section, we prove the following: provided that there are enough of each honest sender’s merging onions at epoch $\mathsf{start}$, there exists an epoch $\mathsf{start}<e\leq\mathsf{partway}$ such that w.o.p., for any honest parties $P$ and $Q$, the number of $P$’s merging onions will be statistically-close to $Q$’s by the $e^{\textit{th}}$ epoch:

Formal statement of Lemma 4.

In $\Pi_{\bowtie}^{\mathit{ideal}}$, let the onion encryption scheme be secure; let $x=y=z=\epsilon_{1}\log^{1+\epsilon_{2}}\lambda$; and let $t=\frac{W}{3}$, where $N$ is the number of participants, $\lambda$ is the security parameter, and $W=\frac{(1-\kappa)x}{z\log N+\log x}$.

Let $0\leq\kappa<\frac{1}{2}$ be a fixed constant. Let $\mathsf{Bad}\subseteq\mathcal{P}$ be any set of participants in $\mathcal{P}$ such that $|\mathsf{Bad}|\leq\kappa N$, and let $\adv$ be any active adversary who corrupts the set $\mathsf{Bad}$ of parties.

Let $\sigma$ be any input in the simple I/O setting.

For any party $P$ and epoch $e$, let $V^{P}_{e}$ be the number of $P$’s merging onions that remain at the $e^{\textit{th}}$ diagnostic round in an interaction between $\Pi_{\bowtie}^{\mathit{ideal}}$ and $\adv$ on input $\sigma$. If for all $P\in\mathcal{P}\setminus\mathsf{Bad}$, $V^{P}_{\mathsf{start}}=\bigsmallO{x}$, then w.o.p., $\Delta(V^{P}_{\mathsf{partway}},V^{Q}_{\mathsf{partway}})\leq\negl$ for all $P,Q\in\mathcal{P}\setminus\mathsf{Bad}$, where $\Delta(\cdot,\cdot)$ denotes the total variation (a.k.a. statistical) distance.

Proof.

[Proof of Lemma 4] A pair of commutable onions is mergeable if the onions arrive at the same place and time and produce the same nonce when processed (once). Let an commutable onion be a singleton if it does not belong in any mergeable pair.

At every round, $\adv$ observes some statistics on singletons and pairs of mergeable onions. With overwhelming probability, these are the only categories of commutable onions in the system; e.g., w.o.p., there cannot be three onions that produce the same nonce when peeled (once). This is because a pair of mergeable onions at the start of an epoch cannot remain unmerged for too long. Either $\adv$ drops one or both of the onions, or w.o.p., within the epoch (lasting $y=\text{polylog}\,\lambda$ rounds), an honest party merges the pair. This last fact follows from Chernoff bounds.

During the mixing phase and during each epoch of the equalizing phase, $\Pi_{\bowtie}^{\mathit{ideal}}$ sufficiently shuffles the commutable onions. This produces the effect that the only useful information that $\adv$ has for determining the sender of an onion is whether it is a singleton or a merging onion. $\adv$ may know that fewer merging onions from one honest party, say $P$, remain in the system compared with those from another honest party, $Q$; in which case, $\adv$ might bet that more singletons are $P$’s merging onions than $Q$’s. In an attempt to prevent the protocol from equalizing, $\adv$ might try dropping singletons during the equalizing phase. (See Appendix B.4.2 for a precise definition of what we mean by sufficiently shuffling and for the proof that $\Pi_{\bowtie}^{\mathit{ideal}}$ sufficiently shuffles commutable onions.)

To prove Lemma 4, we will prove,

Claim. The adversary cannot prevent $\Pi_{\bowtie}^{\mathit{ideal}}$ from equalizing by attacking singletons. No matter how many singletons the adversary drops and when, w.o.p., the probability that $P$’s recipient receives $P$’s message can be only negligibly different from that of $Q$’s recipient receiving $Q$’s message.

Proof of claim. Let $\mathcal{I}_{e}$ be the set of commutable singletons in the first round of the ${e}^{\textit{th}}$ epoch, and let $Y$ be the (total) number of commutable checkpoint onions that are formed.

Suppose that for every epoch ${e}$, the adversary drops $\alpha_{e}$ fraction of the onions in $\mathcal{I}_{e}$. We expect that the adversary drops $\alpha_{1}$ of the $Y$ commutable checkpoint onions during epoch $1$, and another $\alpha_{2}$ of the remaining $(1-\alpha_{1})Y$ commutable checkpoint onions during epoch $2$, and so on. Following this logic, by the ${e}^{\textit{th}}$ epoch, we expect that $\expect{\zeta_{e}}$ fraction of the $Y$ commutable checkpoint onions have been dropped, where $\expect{\zeta_{e}}$ is defined recursively as follows: $\expect{\zeta_{1}}=0$, and $\expect{\zeta_{e}}=\sum_{\tau=1}^{{e}-1}(1-\expect{\zeta_{\tau}})\alpha_{\tau}$ for all $e\geq 2$.

Case 1: if $\expect{\zeta_{\mathsf{partway}}}\geq\frac{1}{2}$. In this case, the adversary drops “many” onions. From repeated applications of probability concentration bounds, we can show that (1) the adversary essentially drops a random sample from the remaining singletons, (2) w.o.p., the actual fraction $\zeta$ of dropped commutable checkpoint onions is close to $\expect{\zeta}$, and (3) w.o.p., the number of missing checkpoint onions at a party and round is strongly correlated with $\zeta$. Thus, when $\expect{\zeta_{\mathsf{partway}}}\geq\frac{1}{2}$, w.o.p., every honest party aborts the protocol run by the partway point, i.e., $V^{P}_{\mathsf{partway}}=0$ for every honest $P$. (See Lemma 10 in Appendix B.4.2 for the formal proofs of these claims.)

Case 2: if $\expect{\zeta_{\mathsf{partway}}}<\frac{1}{2}$. In this case, the adversary drops relatively few onions.

Fix any honest party $P\in\mathcal{P}\setminus\mathsf{Bad}$.

Let ${e}$ be any epoch between the start of the equalizing phase and the partway point, and let $\nu_{{e}}\mathrel{\stackrel{{\scriptstyle\makebox[0.0pt]{\mbox{\tiny def}}}}{{=}}}\frac{V_{{e}}}{U_{{e}}}$ be the ratio between the actual number $V_{{e}}$ of $P$’s onions at the ${e}^{\textit{th}}$ diagnostic round and its upper bound, $U_{{e}}\mathrel{\stackrel{{\scriptstyle\makebox[0.0pt]{\mbox{\tiny def}}}}{{=}}}\frac{x}{2^{{e}-\mathsf{start}}}$, which is necessarily superlogarithmic in the security parameter.

Fix $0\leq\expect{\zeta}\leq\frac{1}{2}$, and let $0\leq\alpha\leq\expect{\zeta}$ be any fraction between zero and $\expect{\zeta}$. We will first analyze what happens when the adversary $\adv$ drops $\alpha$ fraction of the remaining singletons during the $({e}+1)^{\textit{st}}$ epoch (between the ${e}^{\textit{th}}$ diagnostic and the $({e}+1)^{\textit{st}}$ diagnostic) and another $\frac{\expect{\zeta}-\alpha}{1-\alpha}$ fraction of the remaining singletons during the $({e}+2)^{\textit{nd}}$ epoch.

At the ${e}^{\textit{th}}$ diagnostic round, there are an expected (approx.) $\nu_{{e}}^{2}U_{e}$ paired onions and an expected (approx.) $\nu_{e}(1-\nu_{e})U_{e}$ singletons. Since the actual quantities of mergeable pairs are close to the expected values (see Lemma 9 in Appendix B.4.1), if the adversary $\adv$ drops $\alpha$ fraction of the singletons, then for any small constant $\delta\geq\frac{V_{\mathsf{partway}}}{V_{\mathsf{partway}}-1}-1$, w.o.p.,

[TABLE]

At the $({e}+1)^{\textit{st}}$ diagnostic round, there are an expected (approx.) $\nu_{{e}+1}^{2}U_{{e}+1}$ paired onions and an expected (approx.) $\nu_{{e}+1}(1-\nu_{{e}+1})U_{{e}+1}$ singletons. So if the adversary $\adv$ drops $\beta\mathrel{\stackrel{{\scriptstyle\makebox[0.0pt]{\mbox{\tiny def}}}}{{=}}}\frac{\expect{\zeta}-\alpha}{1-\alpha}$ fraction of the singletons, then (from Lemma 9 in Appendix B.4.1) w.o.p.,

[TABLE]

Taking the derivative of $\xi_{{e}+2}$ with respect to $\alpha$, we get

[TABLE]

since $\frac{\partial\xi_{{e}+1}}{\partial\alpha}=2(1-\delta)\left(1-\beta+(2\beta-1)\xi_{{e}+1}\right)$ from (7). This last inequality follows because $(1-\delta)^{2}\geq 0$, $\left(\nu_{e}^{2}-\nu_{e}\right)\leq 0$ since $\nu_{e}\leq 1$, and $\xi_{{e}+1}\leq\frac{1-\beta}{1-2\beta}$ since $\beta=\frac{\expect{\zeta}-\alpha}{1-\alpha}\leq\frac{1}{2}$.

From (8), the best that the adversary can do is to drop at most half of all the singletons upfront, in the $(\mathsf{start}+1)^{\textit{st}}$ epoch, in which case $V^{P}_{\mathsf{partway}}=U_{\mathsf{partway}}$ for every honest $P$. This last follows from a known concentration bound for the hypergeometric distribution [HS05]. This concludes our proof of the claim.

From the analysis above, to complete our proof of Lemma 4, it suffices to show that it doesn’t help $\adv$ to also drop mergeable pairs.

Fix an epoch $e$ between the start of the equalizing phase (i.e., $e>\mathsf{start}$) and the partway point (i.e., $e\leq\mathsf{partway}$).

Let $P,Q\in\mathcal{P}\setminus\mathsf{Bad}$ be any two honest parties. Let $U\mathrel{\stackrel{{\scriptstyle\makebox[0.0pt]{\mbox{\tiny def}}}}{{=}}}\frac{1}{2^{e-\mathsf{start}}}$. Let $V^{P}\mathrel{\stackrel{{\scriptstyle\makebox[0.0pt]{\mbox{\tiny def}}}}{{=}}}\nu^{P}U$ be the number of $P$’s merging onions at the first round of the $e^{\textit{th}}$ epoch so that $\nu^{P}$ is the ratio between the number of $P$’s merging onions (i.e., $V^{P}$) and the maximum it could be (i.e., $U$). Likewise, let $V^{Q}\mathrel{\stackrel{{\scriptstyle\makebox[0.0pt]{\mbox{\tiny def}}}}{{=}}}\nu^{Q}U$ be the number of $Q$’s merging onions at the first round of the $e^{\textit{th}}$ epoch.

The adversary $\adv$ can identify an onion to be part of a mergeable pair only if she observes it to be so. The only mergeable onions that $\adv$ can drop are those that first arrive at adversarial parties (at the first round of the $e^{\textit{th}}$ epoch). (Those that first arrive at honest parties are merged into singletons before the adversary can drop them.) Thus, $\adv$ can drop up to a random half of all mergeable onions since w.o.p., at least half of all mergeable pairs go to honest parties in the first round the epoch (Chernoff bounds).

If $\adv$ drops $\alpha\leq\frac{1}{2}$ fraction of the mergeable pairs, then the expected number $\mathbb{V}^{P}$ of $P$’s mergeable onions at the second round is given by $\mathbb{V}^{P}=V^{P}-\alpha\nu^{P}V^{P}=\nu^{P}U-\alpha(\nu^{P})^{2}U$, and the expected number $v^{Q}$ of $Q$’s mergeable onions at the second round is given by $\mathbb{V}^{Q}=\nu^{Q}U-\alpha(\nu^{Q})^{2}U$. W.l.o.g., let $V^{P}\leq V^{Q}$. (That is, we expect there to be fewer mergeable pairs among $P$’s merging onions than among $Q$’s merging onions.) It can easily be checked that $0\leq\mathbb{V}^{Q}-\mathbb{V}^{P}\leq{V^{Q}}-{V^{P}}$.

Since the actual quantities of mergeable pairs are close to the expected values (Lemma 9 in Supplementary materials), this implies that the protocol equalizes faster when $\adv$ also drops mergeable pairs compared to the scenario in which the adversary drops only singletons. ∎

This completes our proof of our upper bound, Theorem 3.

B.4.1 Lemma 9

To prove Lemma 4, we make use of Lemma 9, below. A consequence of Lemma 9 is that w.o.p., the number of an honest party’s mergeable pairs at the start of any epoch is close to what is expected given the number of the party’s merging onions at the start of the epoch.

Lemma 9**.**

Let $\mathcal{U}$ be a set of $2u$ balls paired into $u=\mathrm{polylog}(\lambda)$ distinct pairs of balls, and let $\mathcal{V}$ be a random subset of $\mathcal{U}$, such that $\nu=|\mathcal{V}|/|\mathcal{U}|$ is a constant factor. For any constant $\frac{2v-\nu}{2v-1}-1<\delta\leq 1$, w.o.p. in $\lambda$, the number $W$ of paired balls in $\mathcal{V}$ is at least $(1-\delta)\nu|\mathcal{V}|$ and at most $(1+\delta)\nu|\mathcal{V}|$.

Proof.

Let $v=\frac{|\mathcal{V}|}{2}$. For every $i\in[u]$, let ${w}_{i}$ be one if both onions that comprise the $u^{\textit{th}}$ pair in $\mathcal{U}$ are in $\mathcal{V}$, and zero otherwise.

[TABLE]

since there are $\binom{2u-2}{2v-2}$ ways to choose $2v-2$ balls from $2u-2$ balls; and likewise, there are $\binom{2u}{2v}$ ways of choosing $2v$ balls from $2u$ balls.

Let ${w}$ denote the number of pairs in $\mathcal{V}$ From the linearity of expectation,

[TABLE]

Recall that $\nu=\frac{v}{u}=\frac{|\mathcal{V}|}{|\mathcal{U}|}$. It follows that

[TABLE]

For each $i\in[2v]$, let $Y_{i}$ be the $i^{\textit{th}}$ chosen ball in $\mathcal{V}$, and let

[TABLE]

Then, $Z_{0},Z_{1},\dots,Z_{2v}$ is a Doob martingale by construction satisfying the Lipschitz condition with bound $1$. Thus, from the Azuma-Hoeffding inequality, for any $0<\delta\leq 1$,

[TABLE]

This completes our proof. ∎

B.4.2 Lemma 10

For all of the lemmas in this section: let $e$ be a round between the start of the equalizing phase, “$\mathsf{start}$,” and partway through the equalizing phase, “$\mathsf{partway}$,” and let $\kappa\leq\frac{1}{2}$ be the upper bound on the corruption rate.

Recall that an commutable onion is either an honest merging onion or an honest checkpoint onion with a checkpoint for verification by an honest party, and that a singleton is an onion that does not belong in any mergeable pair; it is either a checkpoint onion, or a merging onion without a “mate.”

Let $\mathcal{I}_{e^{\prime}}$ be the set of commutable singletons (onion evolutions) at epoch ${e^{\prime}}$, and let $Y$ be the number of commutable checkpoint onions (onion evolutions) that are formed.

Suppose that, for every epoch ${e^{\prime}}$, the adversary drops $\alpha_{e^{\prime}}$ fraction of the onions in $\mathcal{I}_{e^{\prime}}$. Then, we expect that the adversary drops $\alpha_{1}$ of the $Y$ commutable checkpoint onions during epoch $1$, and another $\alpha_{2}$ of the remaining $(1-\alpha_{1})Y$ commutable checkpoint onions during epoch $2$, and so on. Following this logic, by epoch ${e^{\prime}}$, we expect that $\expect{\zeta_{e^{\prime}}}$ fraction of the $Y$ commutable checkpoint onions have been dropped, where $\expect{\zeta_{e^{\prime}}}$ is defined recursively as follows:

[TABLE]

From repeated applications of probability concentration bounds, we can show that if the adversary drops singletons during the equalizing phase, then (1) the adversary essentially drops a random sample from the remaining singletons (Lemma 11), (2) w.o.p., the actual fraction $\zeta$ of dropped commutable checkpoint onions is close to $\expect{\zeta}$ (Lemma 12), and (3) w.o.p., the number of missing checkpoint onions at a party and round is strongly correlated with $\zeta$ (Lemma 13). From these, it follows that,

Lemma 10**.**

In $\Pi_{\bowtie}^{\mathit{ideal}}$: Let $\alpha_{e}$ be the fraction of remaining commutable singletons that the adversary $\adv\in\mathbb{A}_{\kappa}$ drops during the ${e}^{\textit{th}}$ epoch, and let $\expect{\zeta_{e}}$ be as defined by (9) and (10).

1. i

If $\expect{\zeta_{e}}\geq\frac{1}{2}$, then w.o.p., every honest party aborts by the ${e}^{\textit{th}}$ diagnostic. 2. ii

Conversely, if there is an unaborted honest party after the ${e}^{\textit{th}}$ diagnostic, then w.o.p., at least half of the commutable checkpoint onions remain in the system at the ${e}^{\textit{th}}$ diagnostic round.

Below, we formally state and prove Lemmas 11-13, starting with Lemma 11.

Lemma 11**.**

In $\Pi_{\bowtie}^{\mathit{ideal}}$: No matter how many and which singletons the adversary $\adv\in\mathbb{A}_{\kappa}$ drops, $\adv$ essentially drops a random sample of the remaining singletons at the start of the epoch.

We will prove Lemma 11 by showing that $\Pi_{\bowtie}^{\mathit{ideal}}$ sufficiently shuffles the commutable onions during the prior epoch. Before proceeding with the proof, below, we formally define what we mean by “sufficiently shuffles” using the following game.

The game

Let $\mathcal{OE}=(\mathsf{Gen},\mathsf{FormOnion},\mathsf{ProcOnion})$ be a secure onion encryption scheme. The mixing game $\mathsf{CommutableShufflingGame}(1^{\lambda},\Pi,\adv,r_{1},r_{2})$ is parametrized by the security parameter $1^{\lambda}$, an onion routing protocol $\Pi$, an adversary $\adv$, and two round numbers $r_{1}$ and $r_{2}\geq r_{1}$.

First, the adversary $\adv$ chooses a subset $\mathsf{Bad}\subseteq\mathcal{P}$ of the parties to corrupt and sends $\mathsf{Bad}$ to the challenger $\cdv$. For each honest party in $\mathcal{P}\setminus\mathsf{Bad}$, $\cdv$ generates a key pair for the party by running the onion encryption scheme’s key generating algorithm $\mathsf{Gen}$ and sends the public keys $\pk(\mathcal{P}\setminus\mathsf{Bad})$ of the honest parties to the adversary $\adv$. $\adv$ picks the keys for the corrupted parties and sends the public keys portions $\pk(\mathsf{Bad})$ to $\cdv$.

Next, $\adv$ picks the input vector $\sigma$ and sends its choice to $\cdv$. $\cdv$ interacts with $\adv$ in an execution of protocol $\Pi$ on input $\sigma$ with $\cdv$ acting as the honest parties adhering to the protocol and $\adv$ controlling the corrupted parties. Whenever the protocol $\Pi$ specifies for an onion to be formed or processed, $\cdv$ runs the onion encryption scheme’s onion-forming algorithm $\mathsf{FormOnion}$ or onion-processing algorithm $\mathsf{ProcOnion}$. Whenever $\cdv$ forms a non-commutable onion (i.e., a checkpoint onion to be verified by an adversarial party), $\cdv$ provides $\adv$ with the input and output of the algorithm $\mathsf{FormOnion}$: the message, the routing path, the keys associated with the parties on the path, the sequence of nonces, and the evolution of onion layers.

Let $\mathsf{O}_{r_{2}}$ be the set of commutable singletons received by the parties in round $r_{2}$. Let $\mathsf{O}_{r_{1}}$ be the set of (commutable) onions in round $r_{1}$ that “evolve” into an onion in $\mathsf{O}_{r_{2}}$; that is, an onion $O$ is in $\mathsf{O}_{r_{1}}$ iff a peeled version of $O$ is in $\mathsf{O}_{r_{2}}$.

At the end of the execution, $\cdv$ provides $\adv$ with the following information: for each onion in $\mathsf{O}_{r_{1}}$, the onion’s evolution from the first round to round $r_{1}$; and for each onion in $\mathsf{O}_{r_{2}}$, the onion’s evolution from round $r_{2}$ to the final round. Based on this auxiliary information and its view, $\adv$ chooses two onions $O_{0},O_{1}\in\mathsf{O}_{r_{2}}$. $\cdv$ picks a random bit $b\sample\bin$ and provides $\adv$ with the onion $O^{\prime}_{b}\in\mathsf{O}_{r_{1}}$ that evolves into $O_{b}$, and $\adv$ outputs a guess $b^{\prime}$ for $b$ and wins if $b^{\prime}=b$.

We now define what it means for an onion routing protocol to shuffle commutable singletons from round $r_{1}$ to round $r_{2}$.

Definition 11** (Shuffling commutable singletons from round $r_{1}$ to round $r_{2}$).**

An onion routing protocol \Pi(1^{\lambda},\mathsf{pp},\mathsf{states},\,\sigma)$shuffles commutable singletons from round$r_{1}$to round$r_{2}$conditioned for the adversary class$\mathbb{A}$if for every adversary$\adv\in\mathbb{A}$,$\adv$wins$\mathsf{CommutableShufflingGame}(1^{\lambda},\Pi,\adv,r_{1},r_{2})$with negligible advantage, i.e.,$\left|\prob{\text{$\adv$ wins $\mathsf{CommutableShufflingGame}(1^{\lambda},\Pi,\adv,r_{1},r_{2})$}}-\frac{1}{2}\right|=\negl.$

The protocol computationally (resp. statistically) shuffling commutable singletons from round $r_{1}$ to round $r_{2}$ if the adversaries in $\mathbb{A}$ are computationally bounded (resp. unbounded).

We now prove Lemma 11.

Proof of Lemma 11.

To prove the lemma, it suffices to show that $\Pi_{\bowtie}^{\mathit{ideal}}$ shuffles singletons from prior to the $e^{\textit{th}}$ epoch. We do this by cases.

Case 1. In the first case, epoch $e$ is the first epoch of the equalizing phase. We show that $\Pi_{\bowtie}^{\mathit{ideal}}$ sufficiently shuffles the commutable singletons during the mixing phase; that is, w.o.p., the adversary cannot trace any commutable singleton $O$ at the end of the mixing phase back to its sender:

Let $O_{r}$ denote the $r^{\textit{th}}$ layer of the evolution to which $O$ belongs.

Let $P$ be the location of $O_{1}$, and let $\mathsf{binary}(P,i)$ be the $i^{\textit{th}}$ bit of the binary representation of $P$. Let the rounds that “affect $\mathsf{binary}(P,i)$” be those that correspond to the $i^{\textit{th}}$ stage of $B$; these are the rounds in epochs $i$, $n+i$, $2n+i$, …, $(z-1)n+i$. From the hypothesis, the number $z$ of iterations of the butterfly network is polylogarithmic in the security parameter; thus, from Chernoff bounds, w.o.p., every honestly formed onion goes to at least one honest party $Q$ during a round $j$ that affects each $\mathsf{binary}(P,i)$. Moreover, $Q$ mixes the onion with other onions (from honest parties) unless the adversary drops most onions that were meant to shuffle between $Q$ and $Q$’s shuffling partner during the $j^{\textit{th}}$ epoch, in which case $Q$ will detect this from the diagnostic test at the end of the epoch and abort. (This follows from a known probability concentration bound for the hypergeometric distribution [HS05].) $Q$ aborting the protocol run, in turn, will cause the network to be flooded with abort messages, and the remaining honest parties to eventually abort. (While at least half of the honest parties are unaborted, the number of aborted honest parties grows super-exponentially w.r.t. the number of rounds. This follows from recasting the problem as a martingale problem and applying the Azuma-Hoeffding inequality; see Lemma 8 in Supplementary materials.)

Thus, from the adversary’s perspective, every bit of $\mathsf{binary}(P)$ is equally likely to be zero as it is one.

Case 2. When epoch $e$ is after the first epoch of the equalizing phase, $\Pi_{\bowtie}^{\mathit{ideal}}$ shuffles commutable singletons from the start of epoch $e-1$ to the end of epoch $e-1$ using an identical argument as our proof of Lemma 3. ∎

This next lemma states that the actual fraction $\zeta_{e}$ is close to the expected, $\expect{\zeta_{e}}$.

Lemma 12**.**

In $\Pi_{\bowtie}^{\mathit{ideal}}$: Let $\alpha_{e}$ be the fraction of remaining commutable singletons that the adversary drops during the ${e}^{\textit{th}}$ epoch, and let $\expect{\zeta_{e}}$ be as defined by (9) and (10). The fraction $\zeta_{e}$ of all commutable checkpoint onions that the adversary drops by the ${e}^{\textit{th}}$ epoch is close to $\expect{\zeta_{e}}$, i.e., for all $0<\delta\leq 1$, with overwhelming probability,

[TABLE]

Proof.

The proof is by induction.

Base case (${e}=2$). This follows from a known concentration bound [HS05] for the hypergeometric distribution.

Inductive step (${e}>2$). Assume that $(1-\delta)\expect{\zeta_{{e}-1}}\leq\zeta_{{e}-1}\leq(1+\delta)\expect{\zeta_{{e}-1}}$.

Let $\alpha^{\prime}_{e}$ be the fraction of the (remaining) commutable checkpoint onions that the adversary drops during the ${e}^{\textit{th}}$ epoch.

[TABLE]

where (11) follows from the inductive hypothesis, (12) follows from a known concentration bound [HS05] for the hypergeometric distribution, and (13) follows because $1-\delta^{2}\geq 1-\delta$.

We obtain the upper bound in a similar fashion. ∎

If the adversary drops $\zeta_{e}$ fraction of the commutable checkpoint onions by the ${e}^{\textit{th}}$ diagnostic round, then every party would observe, on average, $(1-\kappa)\zeta_{e}\frac{x}{\mathsf{start}+h}$ missing checkpoints at the ${e}^{\textit{th}}$ diagnostic, where $h\mathrel{\stackrel{{\scriptstyle\makebox[0.0pt]{\mbox{\tiny def}}}}{{=}}}\log x+1$ denotes the number of epochs in the equalizing phase. We now prove that, with overwhelming probability, the actual number of missing checkpoint onions is close to this expected quantity.

Lemma 13**.**

In $\Pi_{\bowtie}^{\mathit{ideal}}$: Suppose that the adversary drops at least a constant $0\leq\zeta_{e}\leq 1$ fraction of all commutable checkpoint onions before the ${e}^{\textit{th}}$ diagnostic round (i.e., the ${e}y^{\textit{th}}$ round). If $F$ is a truly random function, then for all $0<\delta\leq 1$, with overwhelming probability, each party $P_{k}$ will notice at least between $(1-\delta)(1-\kappa)\zeta_{e}\frac{x}{\mathsf{start}+h}$ and $(1+\delta)(1-\kappa)\zeta_{e}\frac{x}{\mathsf{start}+h}$ missing checkpoints at the ${e}^{\textit{th}}$ diagnostic round.

Proof.

We recast this problem as a two-colored-balls problem. The different categories of balls correspond to different categories of onions (explained below).

Fix a party $P_{k}$ and a diagnostic round ${{e}y}$.

The green balls/onions, $\mathcal{Z}$, are all the commutable checkpoint onions for verification by party $P_{k}$ at the ${e}^{\textit{th}}$ diagnostic; let $Z=|\mathcal{Z}|$.

Let $\mathcal{Y}\supseteq\mathcal{Z}$ be all the commutable checkpoint onions, including those in $\mathcal{Z}$; and let $Y=|\mathcal{Y}|$. The white onions/balls are the onions in $\mathcal{Y}\setminus\mathcal{X}$; these are the commutable checkpoint onions not for verification by $P_{k}$ at the ${e}^{\textit{th}}$ diagnostic.

Since the onions in $\mathcal{Y}$ are commutable, if the adversary drops $\zeta$ fraction of them, the adversary eliminates (or drops) a random sample $\mathcal{E}\subseteq\mathcal{Y}$ of size $\zeta Y$.

Using a known concentration bound [HS05] for the hypergeometric distribution, when the expected number $\expect{W}=\zeta Z$ of green balls in $\mathcal{E}$ is at least polylogarithmic in the security parameter, with overwhelming probability, the actual number $W$ of green balls in $\mathcal{E}$ is close to $\expect{W}$, i.e., $W=(1\pm\delta^{\prime})\expect{W}$.

Let $X$ be the number of non-commutable checkpoint onions. If

Claim 1**.**

$X$, $Y$, and $Z$ are close to their respective expected values, i.e., for any $0<\delta^{\prime}\leq 1$, with overwhelming probability, $X=(1\pm\delta^{\prime})\expect{X}$, $Y=(1\pm\delta^{\prime})\expect{Y}$, and $Z=(1\pm\delta^{\prime})\expect{Z}$;

then with overwhelming probability, at least $(1-\delta)(1-\kappa)\zeta_{e}\frac{x}{\mathsf{start}+h}$ checkpoints onions will be missing for party $k$ at the ${e}^{\textit{th}}$ diagnostic.

To complete the proof, we now prove the claim above:

Let $\mathcal{Y}_{1}$ be the set of all (for all $i$’s) commutable checkpoint onions formed by party $P_{i}$ for verification by party $P_{i}$, excluding the (possible) onion formed by party $P_{k}$ for verification by party $P_{k}$ at the ${e}^{\textit{th}}$ diagnostic. Let $Y_{1}^{\prime}=|\mathcal{Y}_{1}|$.

Let $\mathcal{Y}_{2}$ be the set of all (for all $i$’s and all $j$’s) commutable checkpoint onions formed by party $P_{i}$ for verification by party $P_{j}$, $j>i$, excluding any onion for verification by party $P_{k}$ at the ${e}^{\textit{th}}$ diagnostic as well as any onion formed by party $P_{k}$ for verification at the ${e}^{\textit{th}}$ diagnostic. Let $Y_{2}^{\prime}=|\mathcal{Y}_{2}|$.

For every triple $(i,j,\tau)$ consisting of the index $\tau$ of a diagnostic round ${\tau y}$ and honest parties $P_{i}$ and $P_{j}$, let $Y_{i\rightarrow j}^{\tau}$ be one if party $P_{i}$ forms a checkpoint onion to be verified by party $P_{j}$ at the $\tau^{\textit{th}}$ diagnostic (and zero, otherwise).

Since $Y_{i\rightarrow j}^{\tau}=1\iff Y_{j\rightarrow i}^{\tau}=1$ (i.e., party $P_{i}$ creates an onion to be verified by party $P_{j}$ at the $\tau^{\textit{th}}$ epoch iff party $P_{j}$ creates a symmetric onion to be verified by party $P_{i}$ at the $\tau^{\textit{th}}$ epoch), it follows that the total (over all $i$’s, all $j$’s, and all $\tau$’s) number of checkpoint onions formed by party $P_{i}$ for party $P_{j}\not=P_{i}$ is $2\left(Y_{2}^{\prime}+\sum_{i\not=k}Y_{i\rightarrow k}^{e}\right)$.

Let $Y_{1}=Y_{1}^{\prime}+Y_{k\rightarrow k}^{e}$, and let $Y_{2}=Y_{2}^{\prime}+\sum_{i\not=k}Y_{i\rightarrow k}^{e}$. The total number $Y$ of commutable checkpoint onions is given by

[TABLE]

If $F$ is a truly random function, the onions in $\mathcal{Z}\cup\mathcal{Y}_{1}\cup\mathcal{Y}_{2}$, are i.i.d. Bernoulli random variables, each having probability $q=\frac{2x}{N(\mathsf{start}+h)}$ of success. It follows that

[TABLE]

Using Chernoff bound for Poisson trials, for any $0<{\delta^{\prime\prime}}\leq 1$:

[TABLE]

Thus, with overwhelming probability, (i) $Z=(1\pm{\delta^{\prime\prime}})\expect{Z}=(1-{\delta^{\prime\prime}})(1-\kappa)\frac{2x}{\mathsf{start}+h}$, (ii) $Y_{1}=(1\pm{\delta^{\prime\prime}})\expect{Y_{1}}$, and (iii) $Y_{2}=(1\pm{\delta^{\prime\prime}})\expect{Y_{2}}$.

Facts (ii) and (iii) imply

[TABLE]

where (18) follows (14) and (15)-(17), and (19) holds because

[TABLE]

and

[TABLE]

Following a similar argument as above, we have $X=(1+\delta^{\prime})\expect{X}$. This concludes are proof. ∎

Combining Lemmas 11 and 13 proves Lemma 10(ii). We now prove Lemma 10(i).

Proof of Lemma 10(i).

If $\zeta_{{e}}\geq\frac{1}{2}$, then with overwhelming probability, every honest party aborts the protocol before the $({e}+1)^{\textit{st}}$ epoch:

From Lemma 11, the adversary essentially drops a random sample of the remaining singletons. From Lemma 12, the actual fraction $\zeta_{e}$ of commutable checkpoint onions that have been dropped by the ${e}^{\textit{th}}$ epoch is close to the expected faction, $\expect{\zeta_{{e}}}\geq(1-\delta)\zeta$. From Lemma 13, each party will notice close to the expected number of missing checkpoints: $(1-\delta)\expect{\zeta_{{e}}}\frac{x}{\mathsf{start}+h}$ (for an arbitrarily small $\delta$). ∎

Appendix C Proof that $\Pi_{\triangle}$ is anonymous

The proof that $\Pi_{\triangle}$ is anonymous mirrors the proof of Theorem 3). $\Pi_{\triangle}$ is indifferent; see the boxed areas in Figure 5. So from Theorem 1, $\Pi_{\triangle}$ is anonymous if it mixes and equalizes.

For the analysis, we assume that replay attacks are not possible, and that the onion encryption is ideal (Simplifications 1 and 2 in the proof of Theorem 3). Given these simplifications, we show that for any two inputs $\sigma^{0}$ and $\sigma^{1}$ (from the same equivalence class), the adversarial view consisting of just the commutable onions on $\sigma^{0}$ is statistically-close to that on $\sigma^{1}$. (Recall that an onion is commutable if it was generated by an honest party and is not a checkpoint onions to be verified by an adversarial party.)

$\Pi_{\triangle}$ mixes for the same reason that $\Pi_{\triangle}$ mixes; $\Pi_{\triangle}$ mixes because either a polylogarithmic number of commutable checkpoint onions shuffle with the remaining commutable merging onions for a polylogarithmic number of rounds during the penultimate epoch, or because not enough commutable onions remain by the last epoch, and so the protocol is aborted. (For the full proof, see Lemma 3 in Appendix B.1.)

From Theorem 1, it remains to prove that $\Pi_{\triangle}$ equalizes from commutable onions.

Lemma 14**.**

If the adversary drops at most a logarithmic (in the security parameter) number onions during the first epoch, then w.o.p., a constant fraction of each honest sender’s merging onions remain undropped by the start of the second epoch. Otherwise, if the adversary drops too many onions, then w.o.p., each honest participant detects that the adversary dropped too many onions and aborts the run. (See Appendix C.1 for the proof.)

Lemma 15**.**

If a constant fraction of each honest sender’s merging onions remain at the start of the second epoch, then w.o.p., the numbers of merging onions will “even out” by the end of the execution phase. That is, for any two honest parties $P$ and $Q$, the quantity of $P$’s merging onions will become statistically-close to that of $Q$’s merging onions. (The proof is essentially the same as that of Lemma 4.)

If the adversary drops too many onions during the first epoch, then $\Pi_{\triangle}$ equalizes since every honest party stops participating (Lemma 5), and so no one receives their message. Otherwise, $\Pi_{\triangle}$ equalizes since enough of each sender’s merging onions make it to the second epoch (Lemma 5), and the numbers of merging onions are eventually evened out by the merging of onions (Lemma 4).

C.1 Proof of Lemma 14

Our proof of Lemma 14 essentially boils down to proving that the following undesirable events rarely happens: (1) For any honest party, the onions formed by the party do not travel together. (2) The first diagnostic fails to detect that the adversary dropped too many honest onions. Below, we show that events (1) and (2) can occur with only negligible probability.

Recall that a “commutable” onion is either an honest merging onion or an honest checkpoint onion with a checkpoint for verification by an honest party.

Recall that $x$ is the number of merging onions formed by each honest party, and let $h\mathrel{\stackrel{{\scriptstyle\makebox[0.0pt]{\mbox{\tiny def}}}}{{=}}}\log x+1$ denote the number of diagnostic rounds (or the number of epochs)777e.g., when $x=2$, there are two epochs, one corresponding to the leaf node and another to the root node of $G_{\triangle}$. in a full unaborted execution of $\Pi_{\triangle}$.

Lemma 16**.**

In interacting with $\Pi_{\triangle}$, suppose that the adversary drops $\zeta$ fraction of all commutable onions before the first diagnostic such that $\zeta\frac{x}{h}=\mathsf{polylog}(\lambda)$. Then, for all $0<\delta\leq 1$, w.o.p., each honest party $I$ will notice at least $(1-\delta)(1-\kappa)\zeta\frac{x}{h}$ missing checkpoints at the first diagnostic.

Proof.

We recast this problem as a three-colored-balls problem with green balls, white balls and red balls. The different categories of balls correspond to different categories of onions (explained below).

Fix an honest party $I$.

Let $\mathcal{Z}$ be the set of all commutable checkpoint onions for verification by party $I$ at the first diagnostic. (These correspond to the green onions/balls. All other commutable checkpoint onions belong to the set $\mathcal{Y}$ and are the white onions/balls.) Let $Z=|\mathcal{Z}|$.

If $F$ is a truly random function,

[TABLE]

Using Chernoff bound for Poisson trials, for any $0<\delta^{\prime}\leq 1$:

[TABLE]

Thus, with overwhelming probability, $Z$ falls between $(1-\delta^{\prime})\expect{Z}=(1-\delta^{\prime})(1-\kappa)\frac{x}{h}$ and $(1+\delta^{\prime})\expect{Z}=(1+\delta^{\prime})(1-\kappa)\frac{x}{h}$.

Let $\mathcal{X}$ be the set of all honest merging onions. (These correspond to the red onions/balls.)

Let $\mathcal{I}$ be the set of all commutable onions, i.e., the set of all green, white and red onions/balls.

Since the adversary cannot distinguish between any two onions in $\mathcal{I}$, the cumulative set $\mathcal{E}\subseteq\mathcal{I}$ of commutable onions that are eliminated (or dropped) by the adversary by the first diagnostic is a random subset of the set $\mathcal{I}$ of all honest onions.

Let $\zeta=\frac{|\mathcal{E}|}{|\mathcal{I}|}$ be the fraction of onions in $\mathcal{I}$ dropped by the adversary by the first diagnostic.

Using a known concentration bound for the hypergeometric distribution [HS05], when the expected number $\zeta Z$ of green balls in $\mathcal{E}$ is at least polylogarithmic in $\lambda$, i.e., $\zeta Z=\mathsf{polylog}(\lambda)$, the actual number $W$ of green balls in $\mathcal{E}$ is close to the expected value $\zeta Z$, i.e., for any $0<\delta^{\prime}\leq 1$, $(1-\delta^{\prime})\zeta Z\leq W\leq(1+\delta^{\prime})\zeta Z$. Combining this with (20) above, with overwhelming probability, the number of green balls in the random sample $\mathcal{E}$ falls between $(1-\delta^{\prime})^{2}(1-\kappa)\zeta\frac{x}{h}$ and $(1-\delta^{\prime})^{2}(1-\kappa)\zeta\frac{x}{h}$.

By choosing an appropriate $\delta$ such that $1-\delta\leq(1-\delta^{\prime})^{2}$ and $1+\delta\geq(1+\delta^{\prime})^{2}$, we obtain our desired bound. ∎

We now prove Lemma 14.

Proof.

[Proof of Lemma 14] Fix an input $\sigma$ and an honest party $P$.

Let $N$ be the number of parties, and let $\adv$ be the adversary who corrupts a random $\floor{\kappa N}$ parties and at rounds $1$ and $2$, drops every droppable (delivered to a corrupted node) onion that could have been formed by party $P$ (from the adversary’s perspective).

Let $X(r)$ be the number of commutable onions at round $r$ that that could have been formed by party $P$. In the first round, $P$ transmits $X(1)$ onions. For any arbitrarily small $0<{\delta}^{\prime}\leq 1$, with overwhelming probability, $X(1)\geq 2(1-{\delta}^{\prime})(1-\kappa)x$ because, with overwhelming probability, $P$ forms at least $(1-{\delta}^{\prime})(1-\kappa)x$ checkpoint onions with a checkpoint for an honest party (Chernoff bound) and $x$ merging onions.

Let the span at round $r$, denoted $S(r)$, be the number of honest parties that receive an commutable onion that could have been formed by party $P$ at round $r$. From Chernoff bound, at least $(1-{\delta}^{\prime})(1-\kappa)$ of these $X(1)$ onions go to honest parties. So, from Lemma 8 in Appendix B.3,

[TABLE]

Each of these $S(1)$ parties receives at least $2(1-{\delta}^{\prime})(1-\kappa)x$ commutable onions at round $1$ (Chernoff bound). Combining this with (21), there are at least $4(1-{\delta}^{\prime})^{3}(1-\kappa)^{3}\frac{x^{2}}{\log\lambda}$ commutable onions that could have originated from party $P$ at round 2; that is,

[TABLE]

At least $(1-{\delta}^{\prime})\kappa$ of these onions are routed to corrupted parties at round $2$ (Chernoff bound); that is, the number of commutable onions from $X(2)$ that go to corrupted parties is at least

[TABLE]

where $\chi\geq\sqrt{N\log^{1+\epsilon}\lambda}$, and $h=\log x+1$. If all of them are dropped, the fraction $\zeta$ of the commutable onions that $\adv$ drops is at least

[TABLE]

because there are fewer than $2(1+{\delta}^{\prime})x$ commutable onions in total (Chernoff bound).

Let $1-\delta=\frac{(1-{\delta}^{\prime})^{5}}{1+{\delta}^{\prime}}$. From Lemma 16, each honest party $Q$ will notice at least

[TABLE]

missing checkpoints and will, therefore, abort the protocol.

Any adversary that drops at least as many onions as $\adv$ will cause the honest parties to abort the protocol.

For the adversary $\adv^{\prime}$, let $V^{\tilde{\adv},P}$ denote the number of party $P$’s merging onions that remain at the end of the first epoch in a run of $\Pi_{\triangle}$ on input $\sigma$, interacting with adversary $\adv^{\prime}$. An adversary $\adv^{\prime}$ that drops at most as many onions as $\adv$ can only do worse than $\adv$; if $\adv^{\prime}$ deviates from $\adv$ either by dropping fewer onions or waiting to drop onions, then

[TABLE]

For any $0<\delta\leq 1$, at least $(1-\delta)(1-\kappa)^{2}$ of party $i$’s merging onions are randomly routed through only honest parties in rounds $1$ and $2$ (Chernoff bound); it follows that

[TABLE]

Combining (22) and (23), we obtain our desired result. ∎

Appendix D Proof that polylogarithmic onion cost is required

To prove the Theorem 4, we make use of the following observation (Lemma 17, below): If an onion routing protocol $\Pi$ is too efficient, then there exist many settings in which there exist parties $P_{i}$ and $P_{j}$ such that $P_{i}$ is neither a sender nor an intermediary node for recipient $P_{j}$.

In a run of onion routing protocol $\Pi$ interacting with adversary $\adv$ on input $\sigma$ and security parameter $1^{\lambda}$:

• •

For an honest party $P_{i}$, let $\#\mathsf{onions}^{\Pi,\adv}_{i\rightarrow j\rightarrow k}{(1^{\lambda},\sigma)}$ denote the number of onions created by party $P_{i}$ and received by party $P_{j}$ that will reach party $P_{k}$ (if allowed to continue to $P_{k}$).

• •

For honest parties $P_{i}$ and $P_{j}\not=P_{i}$, “$P_{i}$ cannot affect $P_{j}$’s recipient” if

[TABLE]

where $r(j)$ is the index of the recipient $P_{r(j)}$ for $P_{j}$.

Lemma 17**.**

Let $\mathsf{SimpleIO}$ denote the set of input vectors in the simple I/O setting.

If the onion cost $\mathsf{OC}^{\Pi,\adv}(1^{\lambda})$ of the onion routing protocol \Pi(1^{\lambda},\mathsf{pp},\mathsf{states},\,\sigma)$interacting with the adversary$\adv$is sublinear in the number$N$of parties, then there exists a set$\mathsf{Inputs}\subseteq\mathsf{SimpleIO}$,$|\mathsf{Inputs}|=\bigsmallO{|\mathsf{SimpleIO}|}$s.t. for every$\sigma\in\mathsf{Inputs}$, there exists a set$\mathsf{Senders}{\sigma}\subseteq\mathcal{P}$,$|\mathsf{Senders}{\sigma}|=\bigsmallO{N}$s.t. for every party$P_{i}\in\mathsf{Senders}_{\sigma}$,

1. i.

\mathbb{E}_{\}\left[\mathsf{out}^{\Pi,\adv}_{i}{(1^{\lambda},\sigma)}\right]=\bigsmallO{1}\cdot\mathsf{OC}^{\Pi,\adv}(1^{\lambda})$, and 2. ii.

there exists a party $P_{\sigma,i}$ such that $P_{i}$ cannot affect $P_{\sigma,i}$’s recipient (as defined in (24)).

Proof.

We can prove Lemma 17 by applying Markov’s inequality several times.

Let $\mathsf{OC}^{\Pi,\adv}$ denote the onion cost of $\Pi$ interacting with $\adv$.

From Markov’s inequality,

[TABLE]

Thus, there exists a set $\mathsf{Inputs}$, $|\mathsf{Inputs}|=\bigsmallO{|\mathsf{SimpleIO}|}$ s.t. for every $\sigma\in\mathsf{Inputs}$, \mathbb{E}_{i,\}\left[\mathsf{out}^{\Pi,\adv}_{i}{(1^{\lambda},\sigma)}\right]<2\mathsf{OC}^{\Pi,\adv},$Using Markov’s inequality again, we have, for all$\sigma\in\mathsf{Inputs}$,

[TABLE]

That is, there exists a set $\mathsf{Senders}_{\sigma}\subseteq[N]$, $|\mathsf{Senders}_{\sigma}|=\frac{N}{2}$ s.t. for sufficiently large $N$,

[TABLE]

This shows that (i) is satisfied.

For every $P_{i}\in\mathsf{Senders}_{\sigma}$, there are at most $N-1$ distinct party $P_{j}\not=P_{i}$, such that

[TABLE]

where $r(j)$ is the recipient of $P_{j}$ in $\sigma$. If this weren’t the case, then the expected number of onions that party $P_{i}$ transmits would be at least $\frac{N}{2}$, contradicting (25). Hence, we also satisfy (ii). ∎

For the proof of Theorem 4, below, we show that if the protocol is too efficient, then the adversary can “isolate” an honest party by blocking all network traffic originating from or passing through the party.

Proof of Theorem 4..

Fix the corruption rate $\kappa$. For a party ${P_{i}}\in\mathcal{P}$, let $\adv_{i}$ be the adversary who corrupts a uniformly random set of $\floor{\kappa N}$ parties and, additionally, drops every onion that party ${P_{i}}$ transmits directly to a corrupted party. Otherwise, $\adv_{i}$ follows the protocol.

Let $\adv$ be the adversary that chooses a random party ${P_{i}}\sample\mathcal{P}$ to target and then follows $\adv_{i}$’s code.

Assume that $\Pi$ is an onion routing protocol that is weakly robust and anonymous $\adv$, and the onion cost of $\Pi$ interacting with $\adv$ is $\bigO{f(\lambda)}$.

W.l.o.g., assume $\bigO{f(\lambda)}=\smallO{N}$. We assume this to be the case, since otherwise, there are known solutions with $\bigsmallO{N^{2}}$ communication complexity, e.g., using general purpose MPC.

From Lemma 17, there exists an input $\sigma^{0}\in\mathsf{SimpleIO}$, such that there exists a set $\mathsf{Senders}_{\sigma^{0}}\subseteq\mathcal{P}$, $|\mathsf{Senders}_{\sigma^{0}}|=\bigsmallO{N}$ s.t. for every party $P_{i}\in\mathsf{Senders}_{\sigma^{0}}$,

1. i.

\mathbb{E}_{\}\left[\mathsf{out}^{\Pi,\adv}_{i}{(1^{\lambda},\sigma^{0})}\right]=\bigO{f(\lambda)}$, and 2. ii.

there exists a party $P_{j}$ such that $P_{i}$ cannot affect the recipient of $P_{j}$.

We will now prove the following: In the event (with nonnegligible probability) that $\adv$ picks a party $P_{i}\in\mathsf{Senders}_{\sigma^{0}}$ to target, $\adv$ can distinguish the setting on input $\sigma^{0}$ from the setting on input $\sigma^{1}=\mathsf{swap}(\sigma^{0},P_{i},P_{j})$ which is the same as $\sigma^{0}$ except that the inputs for parties $P_{i}$ and $P_{j}$ are swapped.

Let $r$ be the recipient of $P_{j}$ in $\sigma^{0}$ (and also the recipient of $P_{i}$ in $\sigma^{1}$), and let $v_{r}^{b}$ denote the number of messages that $r$ receives in a protocol run of $\Pi$ interacting with adversary $\adv$ on input $\sigma^{b}$.

Let $\mathsf{isolated}$ denote the event that $\adv$ manages to drop every onion that $P_{i}$ transmits.

On input $\sigma^{1}$: Conditioned on $\mathsf{isolated}$, $r$ never receives his message, i.e.,

[TABLE]

On input $\sigma^{0}$: Let $\mathsf{unaffectable}$ denote the event that $\#\mathsf{onions}^{\Pi,\adv}_{j\rightarrow i\rightarrow r}{(\sigma^{0})}=0$. From (ii), $\prob{\mathsf{unaffectable}}\leq\frac{1}{2}.$ Combined with weak robustness, it follows that $r$ receives his message with nonnegligible probability, i.e.,

[TABLE]

If $\mathsf{isolated}$ occurs with nonnegligible probability on input $\sigma^{0}$: Then, from combining (26) and (27), $\Pi$ doesn’t equalize; and from Theorem 2, $\Pi$ is not anonymous.

To complete our proof, it suffices to prove that the probability of $\mathsf{isolated}$ is nonnegligible: From (i), \mathbb{E}_{\}[\mathsf{out}{i}^{\Pi,\adv}(1^{\lambda},\sigma^{0})]=\bigO{f(\lambda)}$. From Markov’s inequality, there exists a constant$\alpha>0$, such that$\mathsf{out}{i}^{\Pi,\adv}(1^{\lambda},\sigma^{0})\leq\alpha f(\lambda)$ with nonnegligible probability.

Let $\mathsf{droppable}$ denote the event that $\mathsf{out}_{i}^{\Pi,\adv}(1^{\lambda},\sigma^{0})\leq\alpha f(\lambda)$, and let $\mathsf{isolated}|_{\mathsf{droppable}}$ denote $\mathsf{isolated}$ conditioned on $\mathsf{droppable}$.

The probability of $\mathsf{isolated}|_{\mathsf{droppable}}$ is smallest when the location of each of the (at most) $\alpha f(\lambda)$ onions that $P_{i}$ transmits goes to a different location. This probability is bounded by the probability $p$ that a random $(\alpha f(\lambda))$-size sample from a set of $N$ balls, $\kappa N$ of them which are green, are all green. When $\alpha f(\lambda)\leq\beta\log\lambda\leq\sqrt{N}$ for some positive constant $\beta$,

[TABLE]

which is nonnegligible in $\lambda$. Thus, $\prob{\mathsf{isolated}\wedge\mathsf{droppable}}=\prob{\mathsf{droppable}}\cdot\prob{\mathsf{isolated}|_{\mathsf{droppable}}}$ is nonnegligible in $\lambda$. It follows that $\mathsf{isolated}$ occurs with nonnegligible probability. ∎

We can also prove the weaker result that if an onion routing protocol is robust (Definition 7) and anonymous, then its onion cost is superlogarithmic (in the security parameter). The proof is a simpler contradiction showing that an onion routing protocol with logarithmic (in the security parameter) onion cost cannot be robust (rather than anonymous).

To prove the lower bound, we used the fact that the adversary knows the number of messages received by each honest party in the protocol run. However, the bound holds even when we exclude these statistics from the adversarial view. We can prove the stronger result by using in place of Theorem 2: If an onion routing protocol is anonymous from adversaries who corrupt up to $\kappa N+1$ parties, then it essentially equalizes for adversaries who corrupt up to $\kappa N$ parties.