https://github.com/vuvuzela/vuvuzela

Private messaging system that hides metadata
https://github.com/vuvuzela/vuvuzela

chat cryptography golang messaging metadata privacy research vuvuzela

Last synced: 3 months ago
JSON representation

Private messaging system that hides metadata

• Host: GitHub
• URL: https://github.com/vuvuzela/vuvuzela
• Owner: vuvuzela
• License: other
• Created: 2015-09-07T13:12:29.000Z (over 9 years ago)
• Default Branch: master
• Last Pushed: 2019-09-12T15:41:22.000Z (over 5 years ago)
• Last Synced: 2024-05-20T22:47:57.045Z (8 months ago)
• Topics: chat, cryptography, golang, messaging, metadata, privacy, research, vuvuzela
• Language: Go
• Homepage: https://vuvuzela.io
• Size: 754 KB
• Stars: 2,464
• Watchers: 150
• Forks: 189
• Open Issues: 21
• Metadata Files:
  • Readme: README.md
  • License: LICENSE

Awesome Lists containing this project

• awesome-anti-censorship - vuvuzela - Vuvuzela is a messaging system that protects the privacy of message contents and message metadata. Users communicating through Vuvuzela do not reveal who they are talking to, even in the presence of powerful nation-state adversaries. (Categories / Privacy and anonymity)

README

        
> *Metadata absolutely tells you everything about somebody's life*

>

> — [Stewart Baker](http://www.nybooks.com/articles/archives/2013/nov/21/snowden-leaks-and-public/), former General Counsel of the NSA

###

> *We kill people based on metadata*

>

> — [Michael Hayden](https://www.youtube.com/watch?v=kV2HDM86XgI&t=17m53s), former Director of the NSA

# Vuvuzela

Vuvuzela is a messaging system that protects the privacy of message contents

and message metadata.  Users communicating through Vuvuzela do not reveal who

they are talking to, even in the presence of powerful nation-state adversaries.

Our [SOSP 2015 paper](https://davidlazar.org/papers/vuvuzela.pdf) explains

the system, its threat model, performance, limitations, and more.  Our

[SOSP 2015 slides](https://davidlazar.org/slides/vuvuzela-sosp2015.pdf) give

a more graphical overview of the system.

Vuvuzela is the first system that provides strong metadata privacy while

scaling to millions of users.  Previous systems that hide metadata using

Tor (such as [Pond](https://pond.imperialviolet.org/)) are prone to traffic

analysis attacks.  Systems that encrypt metadata using techniques like

DC-nets and PIR don't scale beyond thousands of users.

Vuvuzela uses efficient cryptography ([NaCl](http://nacl.cr.yp.to)) to hide as

much metadata as possible and adds noise to metadata that can't be encrypted

efficiently.  This approach provides less privacy than encrypting all of the

metadata, but it enables Vuvuzela to support millions of users.  Nonetheless,

Vuvuzela adds enough noise to thwart adversaries like the NSA and guarantees

[differential privacy](https://en.wikipedia.org/wiki/Differential_privacy) for

users' metadata.

## Screenshots

**A conversation in the Vuvuzela client**

![client](https://github.com/vuvuzela/vuvuzela/blob/master/screenshots/client.gif)

In practice, the message latency would be around 20s to 40s, depending

on security parameters and the number of users connected to the system.

**Noise generated by the Vuvuzela servers**

![server](https://github.com/vuvuzela/vuvuzela/blob/master/screenshots/server.gif)

Vuvuzela is unable to encrypt two kinds of metadata: the number of idle users

(connected users without a conversation partner) and the number of active users

(users engaged in a conversation).  Without noise, a sophisticated adversary

could use this metadata to learn who is talking to who.  However, the Vuvuzela

servers generate noise that perturbs this metadata so that it is difficult to

exploit.

## Acknowledgements

This code is written by David Lazar with contributions from

Jelle van den Hooff, Nickolai Zeldovich, and Matei Zaharia.

## See also

[Alpenhorn](https://github.com/vuvuzela/alpenhorn)

[Vuvuzela web client](https://github.com/jlmart88/vuvuzela-web-client)