Ring of Gyges: Accountable Anonymous Broadcast via Secret-Shared Shuffle

Anonymous broadcast systems, which allow users to post messages on a public bulletin board without revealing their identities, have been of persistent interest over the years.Recent designs utilizing multi-party computation (MPC) techniques have shown competitive computational efficiency (CCS' 20, NDSS' 22, PETS' 23).However, these systems still fall short in communication overhead, which also dominates the overall performance.Besides, they fail to adequately address threats from misbehaving users, such as repeatedly spamming the system with inappropriate, illegal content.These tangible issues usually undermine the practical adoption of anonymous systems.This work introduces Gyges, an MPC-based anonymous broadcast system that minimizes its inter-server communication while reconciling critical anonymity and accountability guarantees.At the crux of Gyges lies an honest-majority four-party secret-shared relay.These relay parties jointly execute two key protocols: 1) a "silent shuffling" protocol that requires no online communication but relies solely on non-interactive, local computations to unlink users from their messages, thereby ensuring sender anonymity; 2) a companion fast and lean tracing protocol capable of relinking a specific shuffled message back to its originator when the content severely violates moderation policy, without jeopardizing others' anonymity guarantees.Additionally, Gyges adheres to the private robustness to resist potential malicious disruptions, guaranteeing the output delivery while preserving sender anonymity.To better support a large user base, the system also supports both vertical and horizontal scaling.Our evaluation results show that Gyges's communication-efficient shuffle designs outperform state-of-theart MPC-based anonymous broadcast solutions, such as Clarion (NDSS' 22) and RPM (PETS' 23), while its shared trace technique can swiftly track down the misbehaving users (when necessary), giving orders of magnitude cost reductions compared to traceable mixnets (PETS' 24) that offers similar capabilities.