Subject: [ietf-privacy] Review comments from Ekr

From: "Tschofenig, Hannes (NSN - FI/Espoo)" <[email-masked]>
Date: Wed, 16 Mar 2011 12:19:56 +0200

Here are some review comments from Ekr on an earlier version of the
draft. 
Some of his comments deserve discussion for the context of the current
document. 
 
-------
 
 OVERALL
- It's not really clear to me what the purpose of this document is.
The exposition is really far too detailed and formal to
be useful for the production of IETF documents.  Who is
the target audience?

- You repeatedly seem to state restrictive defns and then generalize
them. I would just start with reasonable defns.

- FWIW, I don't find these figures very evocative.

SPECIFIC
2.  Terminology and Requirements Notation

   Privacy:  "Privacy is the claim of individuals, groups, or
      institutions to determine for themselves when, how, and to what
      extent information about them is communicated to others.  Viewed
      in terms of the relation of the individual to social
      participation, privacy is the voluntary and temporary withdrawal
      of a person from the general society through physical or
      psychological means, either in a state of solitude or small-group
      intimacy or, when among larger groups, in a condition of anonymity
      or reserve.", see page 7 of [West67]

This doesn't really seem like that useful a definition in this 
context. I mean, we're not offering privacy in the sense that
you have solitude... We're offering it in the technical sense
of minimation of information spread.

   If we make our setting more concrete, we may l it a system.  For our

"l it"? Typo?

   purposes, a system has the following relevant properties:

   1.  The system has a surrounding, i.e., parts of the world are
       "outside" the system.  Together, the system and its surrounding
       form the universe.

I'm not sure I would use the word "surrounding" here. If you want
to say that there is a universe and that the system is a (proper)
subset of that with the non-overlapping containing set being
"outside", that's OK, but surrounding seems like the stuff immediately
proximal.

   2.  The state of the system may change by actions within the system.

Well, and outside too, right? If I'm a system and you punch me, then
this changes my state.

   All statements are made from the perspective of an attacker , who may
   be interested in monitoring what communication is occurring, what
   patterns of communication exist, or even in manipulating the
   communication.  The perspective describes the set of all possible
   observations.  In the following, a property holds "from an attacker's
   perspective" iff it holds for all possible observations of that
   perspective.  The attacker's perspective depends on the information
   the attacker has available.  If we assume some limits on how much
   processing the attacker might be able to do, the information
   available to the attacker will not only depend on the attacker's
   perspective, but on the attacker's processing (abilities), too.  The
   attacker may be an outsider tapping communication lines or an insider
   able to participate in normal communications and controlling at least
   some stations, cf. Figure 2.  We assume that the attacker uses all
   information available to him to infer (probabilities of) his items of
   interest (IOIs), e.g., who did send or receive which messages.
   Related to the IOIs are attributes (and their values) because they
   may be items of interest themselves or their observation may give
   information on IOIs: An attribute is a quality or characteristic of

Pfitzmann, et al.        Expires January 6, 2011                [Page 6]
Internet-Draft             Privacy Terminology                 July 2010

   an entity or an action.  Some attributes may take several values.
   Then it makes sense to make a distinction between more abstract
   attributes and more concrete attribute values.  Mainly we are
   interested in attributes of subjects.  Examples for attributes in
   this setting are "sending a message" or "receiving a message".

I'm not sure that this is a fine enough set of discriminations. I.e.,
there are different attackers with different perspectives. Or is that
not what you are trying to say? I guess I would try to define different
classes of attackers here, perhaps with reference to 3552.

4.  Anonymity

   To enable anonymity of a subject, there always has to be an
   appropriate set of subjects with potentially the same attributes .
   Since sending and receiving of particular messages are special cases
   of "attributes" of senders and recipients, this is slightly more
   general than the setting in Section 3.  This generality is very
   fortunate to stay close to the everyday meaning of "anonymity" which
   is not only used w.r.t. subjects active in a particular context,
   e.g., senders and recipients of messages, but w.r.t. subjects passive
   in a particular context as well, e.g., subjects the records within a
   database relate to.  This leads to the following definition:

   Definition:  Anonymity of a subject means that the subject is not
      identifiable within a set of subjects, the anonymity set.

Hmm... I'd like to see this formalized more.

Consider the case where we have an anonymity set of size N >> 2 but 
we believe that the probability that a given message came from
user 0 is .9 and the probability that it came from 1..N-1 is 
.1/(N-1). I would say that that's a pretty substantial anonymity
violation even though we haven't identified user 0 with
certainty.

   The definition given above for anonymity basically defines anonymity
   as a binary property: Either a subject is anonymous or not.  To
   reflect the possibility to quantify anonymity in our definition and
   to underline that all statements are made from the perspective of an
   attacker (cf. Figure 4), it is appropriate to work with a slightly
   more complicated definition in the following:

   Definition:  Anonymity of a subject from an attacker's perspective
      means that the attacker cannot sufficiently identify the subject
      within a set of subjects, the anonymity set.

   In this revised definition, "sufficiently" underlines both that there
   is a possibility to quantify anonymity and that for some

   applications, there might be a need to define a threshold where
   anonymity begins.

I'm not sure why you introduced a weaker definition before and now
a stronger defn. 

   For a fixed anonymity set, global anonymity is maximal iff all
   subjects within the anonymity set are equally likely.  Since subjects
   may behave quite distinct from each other (and trying to persuade
   them to behave more equally may both fail and be not compatible with
   basic human rights), achieving maximal anonymity or even something
   close to it usually is impossible.  Strong or even maximal global
   anonymity does not imply strong anonymity or even maximal anonymity
   of each particular subject.  What maximal anonymity of one individual
   subject (maximal individual anonymity, for short) means is unclear.
   On the one hand, if her probability approaches zero, her Shannon
   entropy (as a measure for anonymity) gets larger and larger.  On the
   other hand, if her probability gets zero, she is outside the
   anonymity set.  Even if global anonymity is strong, one (or a few)
   individual subjects might be quite likely, so their anonymity is
   weak.  W.r.t. these "likely suspects", nothing is changed if the
   anonymity set is made larger and sending and receiving of the other
   subjects are, e.g., distributed evenly.  That way, arbitrarily strong
   global anonymity can be achieved without doing anything for the

Pfitzmann, et al.       Expires February 12, 2011              [Page 11]
Internet-Draft             Privacy Terminology               August 2010

   "likely suspects" [ClSc06].  So there is need to define anonymity
   measures not only for the system as a whole, but for individual
   subjects (individual anonymity) or small sets of subjects.

I'm not sure what the defn. of global anonymity is buying you here,
since it's not really sensible in any plausible environment. I think
we can generally assume that Charles Manson and people in comas are
fairly unlikely to be sending messages, so the set of possible
senders is always smaller than universal. I would just stick
to within a specific set.

   From the above discussion follows that anonymity in general as well
   as the anonymity of each particular subject is a concept which is
   very much context dependent (on, e.g., subjects population,
   attributes, time frame, etc).  In order to quantify anonymity within
   concrete situations, one would have to describe the system in
   sufficient detail, which is practically not (always) possible for

Does this mean it's almost never possible or that it's not alawys
possible in practice?

   particular setting, there is another aspect of anonymity: its
   robustness.  Robustness of anonymity characterizes how stable the
   quantity of anonymity is against changes in the particular setting,
   e.g., a stronger attacker or different probability distributions.  We
   might use quality of anonymity as a term comprising both quantity and
   robustness of anonymity.  To keep this text as simple as possible, we
   will mainly discuss the quantity of anonymity in the following, using
   the wording "strength of anonymity".

Wait, you've just finished saying you can't really measure it, so
how useful is it to talk about quantity?

   Definition:  An anonymity delta (regarding a subject's anonymity)
      from an attacker's perspective specifies the difference between
      the subject's anonymity taking into account the attacker's
      observations (i.e., the attacker's a-posteriori knowledge) and the
      subject's anonymity given the attacker's a-priori knowledge only.

   Note:

      In some publications, the a-priori knowledge of the attacker is
      called "background knowledge" and the a-posteriori knowledge of
      the attacker is called "new knowledge".

   As we can quantify anonymity in concrete situations, so we can
   quantify the anonymity delta.  This can be done by just defining:
   quantity(anonymity delta) := quantity(anonymity_a-posteriori) -
   quantity(anonymity_a-priori) If anonymity_a-posteriori and
   anonymity_a-priori are the same, their quantification is the same and
   therefore the difference of these quantifications is 0.  If anonymity
   can only decrease (which usually is quite a reasonable assumption),
   the maximum of quantity(anonymity delta) is 0.

Not clear to me why you want to define this as an always negative
quantity. Seems awkward.

   For example, in a scenario with at least two senders, two messages
   sent by subjects within the same anonymity set are unlinkable for an
   attacker if for him, the probability that these two messages are sent
   by the same sender is sufficiently close to 1/(number of senders).
   In case of unicast the same is true for recipients; in case of
   multicast it is slightly more complicated.

   Definition:  An unlinkability delta of two or more items of interest
      (IOIs, e.g., subjects, messages, actions, ...) from an attacker's
      perspective specifies the difference between the unlinkability of
      these IOIs taking into account the attacker's observations and the
      unlinkability of these IOIs given the attacker's a-priori
      knowledge only.

   Since we assume that the attacker does not forget anything,
   unlinkability cannot increase.  Normally, the attacker's knowledge
   cannot decrease (analogously to Shannon's definition of "perfect
   secrecy", see above).  An exception of this rule is the scenario
   where the use of misinformation (inaccurate or erroneous information,
   provided usually without conscious effort at misleading, deceiving,
   or persuading one way or another [Wils93]) or disinformation
   (deliberately false or distorted information given out in order to
   mislead or deceive [Wils93]) leads to a growing uncertainty of the
   attacker which information is correct.

I don't think this is very useful here. It's always the case that
I might somehow mislead the attacker, but that's a sort of different
scope kind of issue.

   The definitions of unlinkability, linkability and unlinkability delta
   do not mention any particular set of IOIs they are restricted to.
   Therefore, the definitions of unlinkability and unlinkability delta
   are very strong, since they cover the whole system.  We could weaken
   the definitions by restricting them to part of the system:
   "Unlinkability of two or more IOIs from an attacker's perspective
   means that within an unlinkability set of IOIs (comprising these and
   possibly other items), the attacker cannot sufficiently distinguish
   whether these IOIs are related or not."

It's worth noting that this also depends on the definition of IOIs.
E.g.,
multiple messages over the same TCP channel are linkable.

   Relationship anonymity of a pair of subjects, the potentially sending
   subject and the potentially receiving subject, means that to this
   potentially communicating pair of subjects, each message is
   unlinkable.  In other words, sender and recipient (or each recipient
   in case of multicast) are unlinkable.  As sender anonymity of a
   message cannot hold against the sender of this message himself nor
   can recipient anonymity hold against any of the recipients w.r.t.
   himself, relationship anonymity is considered w.r.t. outsiders only,
   i.e., attackers being neither the sender nor one of the recipients of
   the messages under consideration.

I'm not sure I understand the property you're defining here. Are you
arguing that this property is that an attacker cannot tell *both*
the sender and receiver of a given message? This seems like an odd
term to use for that.

7.  Undetectability and Unobservability

   In contrast to anonymity and unlinkability, where not the IOI, but
   only its relationship to subjects or other IOIs is protected, for
   undetectability, the IOIs are protected as such.  Undetectability can
   be regarded as a possible and desirable property of steganographic
   systems (see Section 9).  Therefore it matches the information hiding
   terminology [Pfit96], [ZFKP98].  In contrast, anonymity, dealing with
   the relationship of discernible IOIs to subjects, does not directly
   fit into that terminology, but independently represents a different
   dimension of properties.

I'm not sure this is very IETF-relevant. As a practical matter, we
almost never worry about this kind of issue.

9.  Known Mechanisms for Anonymity, Undetectability, and Unobservability

   Before it makes sense to speak about any particular mechanisms for
   anonymity, undetectability, and unobservability in communications,
   let us first remark that all of them assume that stations of users do
   not emit signals the attacker considered is able to use for

"attacker considered" is awkward "the relevant attacker" perhaps?

   identification of stations or their behavior or even for
   identification of users or their behavior.  So if you travel around
   taking with you a mobile phone sending more or less continuously
   signals to update its location information within a cellular radio
   network, don't be surprised if you are tracked using its signals.  If
   you use a computer emitting lots of radiation due to a lack of
   shielding, don't be surprised if observers using high-tech equipment
   know quite a bit about what's happening within your machine.  If you
   use a computer, PDA, or smartphone without sophisticated access
   control, don't be surprised if Trojan horses send your secrets to
   anybody interested whenever you are online - or via electromagnetic
   emanations even if you think you are completely offline.

But since this is the base case in the Internet, I don't see how you
can ignore it int he IETF setting.

   DC-net [Chau85], [Chau88], and MIX-net [Chau81] are mechanisms to
   achieve sender anonymity and relationship anonymity, respectively,
   both against strong attackers.  If we add dummy traffic, both provide
   for the corresponding unobservability [PfPW91].  If dummy traffic is
   used to pad sending and/or receiving on the sender's and/or
   recipient's line to a constant rate traffic, MIX-nets can even
   provide sender and/or recipient anonymity and unobservability.

   Broadcast [Chau85], [PfWa86], [Waid90] and private information
   retrieval [CoBi95] are mechanisms to achieve recipient anonymity
   against strong attackers.  If we add dummy traffic, both provide for
   recipient unobservability.

There doesn't seem to be anywhere near enough information for someone
who isn't familiar with the literature to make sense of this. Like,
what's
a MIX net? What's PIR? I know, but do IETFers in general?

   Definition:  The subject which the pseudonym refers to is the holder
      of the pseudonym.

Why does there need to be only one? Think "Publius" from the Federalist
Papers.

   In our usual setting, we assume that each pseudonym refers to exactly
   one specific holder, invariant over time.

   Specific kinds of pseudonyms may extend this setting: A group
   pseudonym refers to a set of holders, i.e., it may refer to multiple
   holders; a transferable pseudonym can be transferred from one holder
   to another subject becoming its holder.

OK, now you say that, but it's like pages down.. why?

11.2.  Accountability for digital pseudonyms

   To authenticate IOIs relative to pseudonyms usually is not enough to
   achieve accountability for IOIs.

So, now that it's clear to me what you mean by accountability, this
seems like a much too restrictive definition of pseudonym. When 
I post on /. as "johndoe" (not my real handle) that's a pseudonym
but it's not accountable in any meaningful way.

11.3.  Transferring authenticated attributes and authorizations between
       pseudonyms

   To transfer attributes including their authentication by third
   parties (called "credentials" by David Chaum [Chau85]) - all kinds of
   authorizations are special cases - between digital pseudonyms of one
   and the same holder, it is always possible to prove that these
   pseudonyms have the same holder.

   But as David Chaum pointed out, it is much more anonymity-preserving
   to maintain the unlinkability of the digital pseudonyms involved as
   much as possible by transferring the credential from one pseudonym to
   the other without proving the sameness of the holder.  How this can
   be done is described in [Chau90] [CaLy04].

   We will come back to the just described property "convertibility" of
   digital pseudonyms in Section 13.

This seems like it's starting to get very far afield from any plausible
IETF practice.

12.2.  Linkability due to the use of a pseudonym across different
       contexts

[...]

It's not clear to me that all these variants are going to be useful
in the context of the kind of protocols that people are designing
in IETF. As you probably know, practically no attention is paid
to privacy at all, let alone to this fine level of gradtaion.

14.2.  Identity and identifiability

   Identity can be explained as an exclusive perception of life,
   integration into a social group, and continuity, which is bound to a
   body and - at least to some degree - shaped by society.  This concept
   of identity distinguishes between "I" and "Me" [Mead34] : "I" is the
   instance that is accessible only by the individual self, perceived as
   an instance of liberty and initiative.  "Me" is supposed to stand for
   the social attributes, defining a human identity that is accessible
   by communications and that is an inner instance of control and
   consistency (see [ICPP03] for more information).  In this
   terminology, we are interested in identity as communicated to others
   and seen by them.  Therefore, we concentrate on the "Me".

This seems way to abstract and handwavy. There is a huge amount of work
on personal identity in network enviornments. I would advise not
discussing this kind of philosophy here but if you do, you need to be
a lot more thorough.

14.3.  Identity-related terms

   Role:  In sociology, a "role" or "social role" is a set of connected
      actions, as conceptualized by actors in a social situation (i.e.,
      situation-dependent identity attributes).  It is mostly defined as
      an expected behavior (i.e., sequences of actions) in a given
      social context.  So roles provide for some linkability of actions.

This is so far removed from the CS defn. of role (E.g., in access
control)
that I'm not sure how it's useful.

   Digital identity  Digital identity denotes attribution of attribute
      values to an individual person, which are immediately
      operationally accessible by technical means.  More to the point,
      the identifier of a digital partial identity can be a simple
      e-mail address in a news group or a mailing list.  A digital
      partial identity is the same as a partial digital identity.  In
      the following, we skip "partial" if the meaning is clear from the
      context.  Its owner will attain a certain reputation.  More
      generally we might consider the whole identity as a combination
      from "I" and "Me" where the "Me" can be divided into an implicit
      and an explicit part: Digital identity is the digital part from
      the explicated "Me".  Digital identity should denote all those
      personal data that can be stored and automatically interlinked by
      a computer-based application.

I don't understand what this means. It seems to me that email addresses
for instance, span a huge range of information flow. Consider the
difference between:

      [email-masked]
      [email-masked]

In one case there is a clear 1-1 correspondence between person and
email, as anyone who uses google can tell. In the other this
isn't true.

-Ekr