Skip to content
Open access

Privacy Pass is Anamorphic: Practical Consequences and Attacks in the Black-box Model

Oct 2026 · Proceedings on Privacy Enhancing Technologies · Vol 2026, pp. 561-586 · 0 citations · 50 references

TL;DR

It is proved that the three most prominent variants of Privacy Pass are anamorphic, which makes it insecure in a model where user's device or client application is working against them and can also be used to achieve a private metadata-like functionality.

Abstract

Privacy Pass is a cryptographic scheme for issuing one-time anonymous authorization tokens, first designed as an anti-DDoS tool and an alternative to CAPTCHAs. It has attracted a lot of attention from the industry and is currently used and supported by the technological giants such as Cloudflare, Google and Apple. At the same time, Privacy Enhancing Technologies became the focus of European and non-European lawmakers (for example in the eIDAS 2.0 regulation and GDPR). Security and privacy by-design is now quite frequently a formal requirement. Privacy Pass could be used in that context as well as a lightweight solution for many application areas, e.g., for age verification. It is therefore imperative that Privacy Pass is analyzed in all possible aspects and adversarial models that are realistic, yet have not been considered during the design process. In this work, we first prove that the three most prominent variants of Privacy Pass are anamorphic. Then, we show that anamorphism of Privacy Pass makes it insecure in a model where user's device or client application is working against them (as it can be supplied by a malicious third party, the OS might be subverted or the device could be subverted). Due to anamorphism, the attacks on unlinkability remain undetectable even if an auditor is given all private keys used in the protocol, including the signer/issuer's private key. On the positive side, anamorphism can also be used to achieve a private metadata-like functionality and utilized, for example, for lawful deanonymization of malicious users, without reshaping Privacy Pass.

Read PDF

Similar papers

Open access Aug 2026

Migrating to Hybrid Cryptography in Practice: The TutaCrypt Protocol and Its Security

This work presents the hybrid key establishment protocol TutaCrypt in a form that enables rigorous cryptographic analysis and defines two Bellare–Rogaway-style security models that precisely characterize the provided security guarantees.

Christian Holler, Tibor Jager, Tom Neuschulten · 0 citations

LLMs AND DATA PRIVACY

Anja Ðurđevac, Antonio Cicchetti, Riccardo Rubei · 0 citations
Conference Open access Jul 2026

MOSAIC-FL, a Micro-Service Based Privacy-Preserving Framework with Application to Genomics

The FL framework integrates an efficient gRPC communication layer and a Finite State Machine to ensure robust component synchronization and threat detection, while relying on a fault-tolerant secure aggregation protocol using a Threshold variant of the CKKS homomorphic cryptosystem.

P. Largillier, Karl Paygambar, Cédric Gouy-Pailler et al. · 0 citations
Conference Jul 2026

Experimental Evaluation of Fully Homomorphic Encryption for Privacy-Preserving V2X Communication

Vehicle-to-Everything (V2X) communication requires continuous exchange of mobility data, but this information is highly sensitive and must be protected. Fully Homomorphic Encryption (FHE) enables computation directly on encrypted data and has recently been explored for Intelligent Transportation Systems (ITS), yet its practical feasibility for specific V2X tasks remains unclear. This paper experimentally evaluates three lattice-based schemes (BFV, BGV, CKKS) using OpenFHE on SUMO-generated mobility data. Three representative traffic-related tasks are considered: collision-risk detection, average speed estimation, and traffic density. For each scheme, we measure encryption time, homomorphic computation time, decryption time, ciphertext size, and correctness relative to plaintext baselines. The results show that all schemes achieve near-perfect correctness, and that aggregated analytics (average speed, density) complete well within non-safety-critical time budgets. However, all schemes consume a significant portion of the 100 ms safety message threshold. These findings quantify the current performance–privacy trade-offs of FHE in V2X scenarios and indicate that hardware acceleration or lighter cryptographic configurations are needed for real-time safety applications.

Louise Wegrelius, Theodor Johansson, Elias Gustafsson et al. · 0 citations
Conference Open access 2026

Privacy-Preserving Counterfactual Explanations for Federated AI

: As the usage of Artificial Intelligence (AI) for sensitive purposes increases, there is a growing need for privacy-aware explainable AI (XAI) tools. In this paper, we present a privacy-preserving counterfactual explanation algorithm . Our starting point is a decision-support model that is able to operate on vertically partitioned datasets, meaning that each party holds a different subset of datapoint attributes. The goal of a counterfactual algorithm is to find, given an observation , a datapoint from the (virtual) dataset that is closest to the observation but has a different label. Our algorithm fully preserves the privacy of the n datapoints belonging to the different parties by combining the strengths of homomorphic encryption and secret sharing . Through a number of experiments, we demonstrate the added value of combining multiple datasets in a realistic scenario and show that the privacy-preserving solution does not affect the accuracy. We fully implement our solution and demonstrate that it scales as to thousands of datapoints.

Sjoerd Berning, Vincent Dunning, T. Veugen et al. · 0 citations