CISPA
Browse
2023-1805.pdf (837.6 kB)

On the Security of Rate-limited Privacy Pass

Download (837.6 kB)
conference contribution
posted on 2024-03-19, 10:46 authored by Hien Chu, Khue Do, Lucjan Hanzlik
The privacy pass protocol allows users to redeem anonymously issued cryptographic tokens instead of solving annoying CAPTCHAs. The issuing authority verifies the credibility of the user, who can later use the pass while browsing the web using an anonymous or virtual private network. Hendrickson et al. proposed an IETF draft (privacypass-rate-limit-tokens-00) for a rate-limiting version of the privacy pass protocol, also called rate-limited Privacy Pass (RlP). Introducing a new actor called a mediator makes both versions inherently different. The mediator applies access policies to rate-limit users’ access to the service while, at the same time, should be oblivious to the website/origin the user is trying to access. In this paper, we formally define the rate-limited Privacy Pass protocol and propose a game-based security model to capture the informal security notions introduced by Hendrickson et al.. We show a construction from simple building blocks that fulfills our security definitions and even allows for a post-quantum secure instantiation. Interestingly, the instantiation proposed in the IETF draft is a specific case of our construction. Thus, we can reuse the security arguments for the generic construction and show that the version used in practice is secure.

History

Editor

Meng W ; Jensen CD ; Cremers C ; Kirda E

Primary Research Area

  • Algorithmic Foundations and Cryptography

Name of Conference

ACM Conference on Computer and Communications Security (CCS)

Journal

CCS

Page Range

2871-2885

Publisher

Association for Computing Machinery (ACM)

Open Access Type

  • Not Open Access

BibTeX

@conference{Chu:Do:Hanzlik:2023, title = "On the Security of Rate-limited Privacy Pass", author = "Chu, Hien" AND "Do, Khue" AND "Hanzlik, Lucjan", editor = "Meng, Weizhi" AND "Jensen, Christian Damsgaard" AND "Cremers, Cas" AND "Kirda, Engin", year = 2023, month = 11, journal = "CCS", pages = "2871--2885", publisher = "Association for Computing Machinery (ACM)", doi = "10.1145/3576915.3616619" }

Usage metrics

    Categories

    No categories selected

    Licence

    Exports

    RefWorks
    BibTeX
    Ref. manager
    Endnote
    DataCite
    NLM
    DC