6

My understanding is that a strict definition of anonymity means that defeating the security mechanism is logically impossible or mathematically infeasible, and therefore so is deducing the identity. (An example would be blind signatures. Mechanisms might include NP-completeness or information-theoretic security).

Tor, and other onion routers, do not promise this kind of anonymity. With enough effort (and control of the network) an adversary could distinguish some users. Similarly, bitcoin does not promise this kind of anonymity. With enough effort, an adversary could follow even a tumbled purchase through the blockchain.

Is there a term that distinguishes "effort-based" anonymity from "infeasibility-based" anonymity?

(I am aware that a given system could transition from one to another, for example prime factors and Shor's algorithm.)

lofidevops
  • 3,550
  • 6
  • 23
  • 32
  • Blockchains do not provide anonymity. – forest Dec 15 '17 at 02:25
  • And I don't _believe_ there is a specific term for anonymity which is not inormation-theoretic secure. There are different classes of anonymity (location anonymity, preventing membership attribution, etc), though. – forest Dec 19 '17 at 04:31
  • @forest could it be that this is what is meant by pseudo-anonymity? – lofidevops Dec 19 '17 at 10:23
  • 1
    No. I don't think pseudo-anonymity is a term. Perhaps you're thinking of _pseudonymity_? Pseudonymity is the use of pseudonyms not connected to your real name. I am using Tor on StackExchange, but I am not technically anonymous here, rather I am pseudonymous because my username is forest. It's just common to say anonymity when you really mean pseudonymity, even if it's technically incorrect. – forest Dec 19 '17 at 10:38

2 Answers2

1

While strict anonymity can be seen as a preference to a user attempting to conceal all aspects of their identity, it is infeasible and impossible to say the least. Tor, Blockchain, and other anonymizing technologies designed for a specific purpose can never be made to be infallible. After all, people do make mistakes and those are the elements that lend to defeating the security of a given program. As has been focused on, quantum technology would, undoubtedly, eradicate most of our current encryption technologies and render them useless.

If we are looking to define the type of anonymity offered by technologies like onion routing and blockchaining, then one definition could be platform specific anonymity—where anonymity is not defined as strict, but as a component of that given platform that is either difficult to defeat or cannot be realistically defeated with today's technology.

Defining anonymity as undefeatable stretches the purpose of the term in my opinion. Here is the general definition of the word anonymity as per the American Heritage Dictionary (found on Free Dictionary)[1]:

  1. The quality or state of being unknown or unacknowledged.
  2. One that is unknown or unacknowledged.

Anonymity does not refer to the quality of being incapable of being unmasked, merely the quality of being masked. In Information Security the ultimate goal is to protect a user's information to the best of one's abilities utilizing anonymizing software that is known to be effective by today's standards. Any security mechanism can theoretically be defeated, especially by a determined adversary with enough resources at their disposal. Tor is not perfect nor is Blockchain, but they offer a level of protection that is currently not simple to defeat (though Tor has definitely seen its browser compromised in the past as well as its nodes poisoned).

[1] For the American Heritage Dictionary definition: American Heritage® Dictionary of the English Language, Fifth Edition. S.v. "anonymity." Retrieved April 20 2018 from https://www.thefreedictionary.com/anonymity

Paradox Inferno
  • 11
  • 2
0

Only Zero-Knowledge protocols provide perfect anonymity. Even NP-Hard problems can be solved with enough computing power, it is just infeasible to do so. Because of this, there is no distinct term for security, which would take billion years, which would take 2 years, which would take an hour of searching through block-chain or which would entail getting a CEO drunk so he gives you access. You just have to evaluate the risks for yourself.

Zero-Knowledge protocols provably provide no information beyond what is supposed to be provided. But there are only known algorithms for a few problems and all Zero-Knowledge protocols I know of also have a chance based reliability.

So for example an authentication Zero-Kowledge protocol will authenticate an user with certain probability. An attacker may be able to authenticate as the user, if they are lucky/try enough times. But he may never retrieve the users secret key and neither can the genuine server.

PS: As for routing data through for example Tor, there can never be perfectly anonymous system (beyond some quantum shenanigans maybe), because the system has to know, how to deliver responses from the server to the user.

Peter Harmann
  • 7,728
  • 5
  • 20
  • 28