Benny Pinkas (Bar-Ilan University); Eyal Ronen (Tel Aviv University)

In recent months multiple proposals for contact tracing schemes for combating the spread of COVID-19 have been published. Many of those proposals try to implement this functionality in a decentralized and privacy-preserving manner using Bluetooth Low Energy (BLE).

In this paper, we present “Hashomer”, our proposal for a contact tracing scheme tailored for the Israeli Ministry of Health’s (MoH) “Hamagen” application. The design is fully decentralized, and has the following properties:

- Message Unlinkability — Different BLE messages sent by the same user cannot be linked to each other (except for messages sent by COVID-19 positive users who give consent to tracing their contacts, and only for messages sent within a short time period).

- Explainability — To convince users that they were exposed to a COVID-19 positive person, we let them learn the approximate time of contact. This also implies that users can potentially learn, using the phone’s GPS information, the location of the exposure.

- Partial Disclosure and Coercion Prevention — Users and the MoH are able to redact tracing information and exposure notifications for specific time intervals.

- Prevention of Relay Attacks – The design prevents attacks where a malicious receiver relays BLE transmissions from one location to other locations.

- Proof of exposure to a COVID-19 positive person — To prevent false reports about exposure, we allow users who are notified by the application about an exposure to a COVID-19 positive person, to prove this fact to the server.

- Identity Commitment — To prevent malicious changing or replacing keys, we bind the BLE messages to a unique ID in a privacy-preserving way.

- Performance — BLE payload size is limited to 16 bytes. The application uses only symmetric key cryptography (AES and HMAC). To reduce bandwidth, contact updates from the MoH are of limited size. Moreover, the local search for exposure is linear in the number of messages and number of COVID-19 positive persons

View More Papers

A First Look at Scams on YouTube

Elijah Bouma-Sims, Bradley Reaves (North Carolina State University)

Read More

Detecting Tor Bridge from Sampled Traffic in Backbone Networks

Hua Wu (School of Cyber Science & Engineering and Key Laboratory of Computer Network and Information Integration Southeast University, Ministry of Education, Jiangsu Nanjing, Purple Mountain Laboratories for Network and Communication Security (Nanjing, Jiangsu)), Shuyi Guo, Guang Cheng, Xiaoyan Hu (School of Cyber Science & Engineering and Key Laboratory of Computer Network and Information Integration…

Read More

More than a Fair Share: Network Data Remanence Attacks...

Leila Rashidi (University of Calgary), Daniel Kostecki (Northeastern University), Alexander James (University of Calgary), Anthony Peterson (Northeastern University), Majid Ghaderi (University of Calgary), Samuel Jero (MIT Lincoln Laboratory), Cristina Nita-Rotaru (Northeastern University), Hamed Okhravi (MIT Lincoln Laboratory), Reihaneh Safavi-Naini (University of Calgary)

Read More