Seldom: An Anonymity Network with Selective Deanonymization

TL;DR

Seldom introduces a privacy-preserving anonymity network with selective deanonymization, enabling law enforcement to access misbehaving users' identities while maintaining transparency and minimal performance overhead.

Contribution

The paper presents Seldom, a novel anonymity network with integrated selective deanonymization, balancing privacy with law enforcement access and transparency.

Findings

Minimal latency and bandwidth overheads compared to Tor

Requires up to 636 TB storage for two years of flow records

Feasible implementation based on Tor's infrastructure

Abstract

While anonymity networks such as Tor provide invaluable privacy guarantees to society, they also enable all kinds of criminal activities. Consequently, many blameless citizens shy away from protecting their privacy using such technology for fear of being associated with criminals. To grasp the potential for alternative privacy protection for those users, we design Seldom, an anonymity network with integrated selective deanonymization that disincentivizes criminal activity. Seldom enables law enforcement agencies to selectively access otherwise anonymized identities of misbehaving users while providing technical guarantees preventing these access rights from being misused. Seldom further ensures translucency, as each access request is approved by a trustworthy consortium of impartial entities and eventually disclosed to the public (without interfering with ongoing investigations). To demonstrate Seldom's feasibility and applicability, we base our implementation on Tor, the most widely used anonymity network. Our evaluation indicates minimal latency, processing, and bandwidth overheads compared to Tor; Seldom's main costs stem from storing flow records and encrypted identities. With at most 636 TB of storage required in total to retain the encrypted identifiers of a Tor-sized network for two years, Seldom provides a practical and deployable technical solution to the inherent problem of criminal activities in anonymity networks. As such, Seldom sheds new light on the potentials and limitations when integrating selective deanonymization into anonymity networks.