Towards a Formal Analysis of a Mix Network

We present a formal model of Chaum’s Mix concept and apply known analysis techniques to a new type of security property, namely anonymity, in a network composed of senders, receivers and Mix stations. The network and its components are formalized as CSP processes, and combined with a (passive) attacker. Based on the model-checker FDR, formal analyses of networks and their security properties are performed. The approach serves as a feasibility study for the analysis of anonymity and unobservability with a particular analysis technique. Moreover, it will result in the implementation of a particular analysis-testbed for the investigation of other security properties such as unobservability or more advanced protocols that might pave the way to secure Mix implementations with dynamically controlled dummy traffic.