Coercion Resistance Communication Through Anamorphic Encryption and Integration into Signal Protocol
Singh, Sachin; Pham, Thanh (2026)
2026
Master's Programme in Computing Sciences and Electrical Engineering
Informaatioteknologian ja viestinnän tiedekunta - Faculty of Information Technology and Communication Sciences
Hyväksymispäivämäärä
2026-07-27
Julkaisun pysyvä osoite on
https://urn.fi/URN:NBN:fi:tuni-202607268491
https://urn.fi/URN:NBN:fi:tuni-202607268491
Tiivistelmä
While end-to-end encrypted messaging systems such as Signal provide strong guarantees for confidentiality against passive adversaries, they do not protect the system in case of coercers demanding to obtain the secret key. This has led to increased regulation demanding this exact functionality. This thesis provides the first integration of receiver-anamorphic encryption in the Signal Double Ratchet.
In our construction, each message produces a single anamorphic ciphertext that contains two decryption paths, a normal path and a hidden path. Normal decryption using the receiver’s secret key aSK recovers a cover message, while double decryption using a separate dual key dkey recovers a hidden message. A coercer demanding the secret key aSK will see only cover messages and has no indication of the existence of any hidden message. Thus, a coercer holding aSK can only see the cover message and there is no cryptographic evidence that a secret message even exists.
Our primary innovation is ratchet-bound randomness. Instead of sampling the randomness used by the anamorphic encryption scheme independently, we derive it deterministically from Signal’s per-message ratchet IV via an HMAC-based Key Derivation Function (HKDF). Thus, the forward secrecy of our anamorphic encryption is inherited directly from Signal’s forward secrecy properties. As a result, no separate mechanism is required.
In this thesis, we present two constructions. Construction A relies on ElGamal encryption and achieves our anamorphic security and coercion resistance properties under the Decisional Diffie-Hellman (DDH) assumption. Construction B relies on Dual-Regev encryption with Learning With Errors (LWE), thus ensuring post-quantum resilience that Construction A lacks. Both constructions rely on a two-tiered scheme where the first tier employs public-key encryption only for the session AES keys, while AES-256-GCM encrypts messages of arbitrary length.
Both schemes have been implemented as a functional command-line prototype running on a forked Signal session library, and benchmark performance has been measured across security parameters λ ∈ {16, 32, 64, 128} for Dual-Regev and modulus sizes λ ∈ {256, 512, 1024, 2048, 3072, 4096} for ElGamal. Finally, we characterise the residual gaps, where our prototype does not yet achieve wire-format indistinguishability with standard Signal traffic, and where the zero-knowledge proof mechanism remains an open placeholder.
In our construction, each message produces a single anamorphic ciphertext that contains two decryption paths, a normal path and a hidden path. Normal decryption using the receiver’s secret key aSK recovers a cover message, while double decryption using a separate dual key dkey recovers a hidden message. A coercer demanding the secret key aSK will see only cover messages and has no indication of the existence of any hidden message. Thus, a coercer holding aSK can only see the cover message and there is no cryptographic evidence that a secret message even exists.
Our primary innovation is ratchet-bound randomness. Instead of sampling the randomness used by the anamorphic encryption scheme independently, we derive it deterministically from Signal’s per-message ratchet IV via an HMAC-based Key Derivation Function (HKDF). Thus, the forward secrecy of our anamorphic encryption is inherited directly from Signal’s forward secrecy properties. As a result, no separate mechanism is required.
In this thesis, we present two constructions. Construction A relies on ElGamal encryption and achieves our anamorphic security and coercion resistance properties under the Decisional Diffie-Hellman (DDH) assumption. Construction B relies on Dual-Regev encryption with Learning With Errors (LWE), thus ensuring post-quantum resilience that Construction A lacks. Both constructions rely on a two-tiered scheme where the first tier employs public-key encryption only for the session AES keys, while AES-256-GCM encrypts messages of arbitrary length.
Both schemes have been implemented as a functional command-line prototype running on a forked Signal session library, and benchmark performance has been measured across security parameters λ ∈ {16, 32, 64, 128} for Dual-Regev and modulus sizes λ ∈ {256, 512, 1024, 2048, 3072, 4096} for ElGamal. Finally, we characterise the residual gaps, where our prototype does not yet achieve wire-format indistinguishability with standard Signal traffic, and where the zero-knowledge proof mechanism remains an open placeholder.