Metadata-private Messaging without Coordination

TL;DR

PingPong tackles the usability bottleneck of metadata-private messaging by replacing the traditional dial-before-converse coordination with a notify-before-retrieval workflow that decouples notifications from retrieval. It combines a metadata-private notification system (Ping) with an oblivious, scalable message store (Pong) built on hardware enclaves and customized oblivious primitives to achieve traffic-uniform, unlinkable communication at scale. The architecture supports many-to-one notifications, asynchronous reads/writes, and horizontal scaling, delivering end-to-end latency improvements and higher goodput compared to prior dialing-intensive systems. Empirical results on SGX-enabled deployments show sub-second 99th percentile latency for tens of thousands of users and robust throughput, suggesting practical viability for real-world metadata-private messaging with strong protection against traffic-analysis attacks.

Abstract

For those seeking end-to-end private communication free from pervasive metadata tracking and censorship, the Tor network has been the de-facto choice in practice, despite its susceptibility to traffic analysis attacks. Recently, numerous metadata-private messaging proposals have emerged with the aim to surpass Tor in the messaging context by obscuring the relationships between any two messaging buddies, even against global and active attackers. However, most of these systems face an undesirable usability constraint: they require a metadata-private "dialing" phase to establish mutual agreement and timing or round coordination before initiating any regular chats among users. This phase is not only resource-intensive but also inflexible, limiting users' ability to manage multiple concurrent conversations seamlessly. For stringent privacy requirement, the often-enforced traffic uniformity further exacerbated the limitations of this roadblock. In this paper, we introduce PingPong, a new end-to-end system for metadata-private messaging designed to overcome these limitations. Under the same traffic uniformity requirement, PingPong replaces the rigid "dial-before-converse" paradigm with a more flexible "notify-before-retrieval" workflow. This workflow incorporates a metadata-private notification subsystem, Ping, and a metadata-private message store, Pong. Both Ping and Pong leverage hardware-assisted secure enclaves for performance and operates through a series of customized oblivious algorithms, while meeting the uniformity requirements for metadata protection. By allowing users to switch between conversations on demand, PingPong achieves a level of usability akin to modern instant messaging systems, while also offering improved performance and bandwidth utilization for goodput. We have built a prototype of PingPong with 32 8-core servers equipped with enclaves to validate our claims.

Figures (15)

• Figure 1: Comparison between the traditional dial-before-converse framework, Groove's brute-force approach and PingPong's notify-before-retrieval framework.
• Figure 2: Overview of PingPong. Users A and C simultaneously send messages to user B.
• Figure 3: Client local functions. For simplicity, we omit the definitions of standard functions such as Encrypt, PRF, etc.
• Figure 4: Ping server operations.
• Figure 5: Storage structure of Pong.

Theorems & Definitions (6)

• Definition 2.1: Communication Trace
• Definition 2.2: Communication Trace Indistinguishability
• Theorem 7.1
• Theorem 1
• Theorem 2
• Theorem 3