Eluding Carnivores: File Sharing with Strong Anonymity
📜 Abstract
Anonymity is increasingly important for networked applications amidst concerns over censorship and privacy. This paper outlines the design of HerbivoreFS, a scalable and efficient file sharing system that provides strong anonymity. HerbivoreFS provides computational guarantees that even adversaries able to monitor all network traffic cannot deduce the identity of a sender or receiver beyond an anonymizing clique of k peers. HerbivoreFS achieves scalability by partitioning the global network into smaller anonymizing cliques. Measurements on PlanetLab indicate that the system achieves high anonymous bandwidth when deployed on the Internet.
✨ Summary
Summary
The paper presents HerbivoreFS, a peer-to-peer file-sharing system built on the Herbivore anonymous communication protocol. Its central contribution is the application of dining-cryptographers networks (DC-nets) to a scalable Internet setting by partitioning participants into smaller anonymizing cliques. Within each clique, all members contribute to every transmission, preventing a global passive observer from identifying a sender or receiver more precisely than the clique, subject to the stated cryptographic assumptions.
The design combines a Pastry-based overlay, computational puzzles to limit Sybil attacks, clique membership management, anonymous reservation and transmission rounds, and replication-based defenses against intersection attacks. The prototype was implemented in Java and C and evaluated on PlanetLab; the paper reports that parallel protocol instances enabled comparatively high anonymous bandwidth, although performance depended on clique size and the slowest participant link.
Subsequent anonymity research cites Herbivore as an early practical attempt to scale DC-net-style communication. In particular, the Dissent research line discusses Herbivore and contrasts its clique-based DC-net approach with later systems designed to improve scalability, accountability, and resistance to disruption. (dedis.cs.yale.edu) Cornell’s project documentation also records a related Herbivore technical report and identifies the paper as part of the system’s research lineage. (cs.cornell.edu) The available sources establish influence on later academic work and teaching materials, but do not provide reliable evidence of significant industry deployment. Bibliographic metadata confirms the paper’s 2004 ACM SIGOPS European Workshop publication. (researchgate.net)