Benny Pinkas (Bar-Ilan University); Eyal Ronen (Tel Aviv University)

In recent months multiple proposals for contact tracing schemes for combating the spread of COVID-19 have been published. Many of those proposals try to implement this functionality in a decentralized and privacy-preserving manner using Bluetooth Low Energy (BLE).

In this paper, we present “Hashomer”, our proposal for a contact tracing scheme tailored for the Israeli Ministry of Health’s (MoH) “Hamagen” application. The design is fully decentralized, and has the following properties:

- Message Unlinkability — Different BLE messages sent by the same user cannot be linked to each other (except for messages sent by COVID-19 positive users who give consent to tracing their contacts, and only for messages sent within a short time period).

- Explainability — To convince users that they were exposed to a COVID-19 positive person, we let them learn the approximate time of contact. This also implies that users can potentially learn, using the phone’s GPS information, the location of the exposure.

- Partial Disclosure and Coercion Prevention — Users and the MoH are able to redact tracing information and exposure notifications for specific time intervals.

- Prevention of Relay Attacks – The design prevents attacks where a malicious receiver relays BLE transmissions from one location to other locations.

- Proof of exposure to a COVID-19 positive person — To prevent false reports about exposure, we allow users who are notified by the application about an exposure to a COVID-19 positive person, to prove this fact to the server.

- Identity Commitment — To prevent malicious changing or replacing keys, we bind the BLE messages to a unique ID in a privacy-preserving way.

- Performance — BLE payload size is limited to 16 bytes. The application uses only symmetric key cryptography (AES and HMAC). To reduce bandwidth, contact updates from the MoH are of limited size. Moreover, the local search for exposure is linear in the number of messages and number of COVID-19 positive persons

View More Papers

A Devil of a Time: How Vulnerable is NTP...

Yarin Perry (The Hebrew University of Jerusalem), Neta Rozen-Schiff (The Hebrew University of Jerusalem), Michael Schapira (The Hebrew University of Jerusalem)

Read More

Panel – Experiment Artifact Sharing: Challenges and Solutions

Moderator: Laura Tinnel (SRI International) Panelists: Clémentine Maurice (CNRS, IRIS); Martin Rosso (Eindhoven University of Technology); Eric Eide (U. Utah)

Read More

Forward and Backward Private Conjunctive Searchable Symmetric Encryption

Sikhar Patranabis (ETH Zurich), Debdeep Mukhopadhyay (IIT Kharagpur)

Read More

More than a Fair Share: Network Data Remanence Attacks...

Leila Rashidi (University of Calgary), Daniel Kostecki (Northeastern University), Alexander James (University of Calgary), Anthony Peterson (Northeastern University), Majid Ghaderi (University of Calgary), Samuel Jero (MIT Lincoln Laboratory), Cristina Nita-Rotaru (Northeastern University), Hamed Okhravi (MIT Lincoln Laboratory), Reihaneh Safavi-Naini (University of Calgary)

Read More