Alice and Bob want to communicate securely in the presence of a very powerful active adversary
(Eve). Eve can monitor all the connections that Alice and Bob use at home, at work, through their
mobile phones, at coffee shops, etc. Eve can also compel companies such as Google or Microsoft to
disclose the information they have on Alice and Bob (e.g., the content of their Gmail or Outlook.com
accounts).
Present one set of steps that Alice and Bob can take to communicate securely and undetectably
in the presence of this adversary. In particular, Alice and Bob want to make sure that Eve does not
find out that they are communicating. Further, if Eve detects messages between Alice and Bob,
she must not be able to tell what the two parties said. Clearly describe each step, and explain why
it is necessary and what it accomplishes.
In defining the steps that Alice and Bob will take, consider the following:
1. Alice and Bob are not allowed to use Tor.
2. Alice is a security expert, but Bob only knows how to use a web browser and an email client.
Therefore, the must be as simple as possible to minimize the chances that Bob makes any mistake that will allow Eve to know about their exchanges.
3. Alice can secretly meet with Bob once, and she can instruct Bob on how to communicate during that meeting. After that, all messages must be exchanged online.
4. Alice and Bob want to minimize the metadata they are producing. They do not want to leave any trace that they communicated, and they don't mind erasing messages after they receive them.
5. Both parties have access to a computer they just purchased from a local shop, and that is therefore not compromised by Eve.
Discuss what mistakes Bob can make that will jeopardize the ability of the parties to communicate securely and undetectably.
Be creative, but keep the approach as simple as possible in order to minimize the chances of making mistakes. Any set of steps that can be easily remembered by Alice and Bob, who therefore do not need to write down any note, is preferred. However, this is not necessary.
Items to Submit
1. Academic integrity form
2. Two-page report as a PDF document
Items not to Submit
Anything not mentioned under items to submit. For example, do not submit:
• Code
• Program binaries
• Keys
• Word, RTF, or OpenOffice files