Arguable anonymity from key-privacy: The deterministic crowds protocol

Anonymous communication is traditionally achieved by communication over a sequence of proxies so that the relation between the sender and receiver is obfuscated. Security of anonymization is usually understood as the inability to discover the initiator or receiver of a transmission. We introduce a different notion here, which defines anonymity as the inability to confirm a given guess about the initiator or receiver. We call this arguable anonymity, as it offers the suspect a way of plausible repudiation on grounds of the accusal being not independently verifiable. As a proof of concept, we introduce a deterministic version of Crowds that achieves this kind of anonymity. As a separate (and independent) contribution, the derandomizing of Crowds additionally achieves receiver anonymity to the protocol, based on key-privacy properties of an underlying encryption scheme.