Metadata (like who you communicate with and when) can be very revealing, and is especially sensitive for journalists and whistleblowers. Many communication systems protect the contents of messages using encryption, but message metadata is left unprotected and is often logged and shared with authorities. In 2018, the NSA compelled US phone companies to hand over 434 million call records of Americans .
My defense focuses on my latest system, Yodel , which is the first system that provides strong metadata security for voice calls. Yodel hides metadata from an attacker that compromises many of the system's servers and that monitors and tampers with the entire network. Protecting metadata against traffic analysis and active attacks (where the attacker drops or delays packets to uncover who is talking to whom) is a major challenge. Doing so with sufficiently high performance to support voice calls for many users is the crux of this work.
Yodel introduces the idea of `self-healing circuits`, reusable paths through a mix network that only use fast symmetric cryptography and are resilient to passive and active attacks. Creating and connecting to these circuits without leaking metadata is another challenge that Yodel addresses with the idea of `guarded circuit exchange`, where each user creates a backup circuit in case an attacker tampers with their traffic.
Yodel achieves acceptable voice quality with 970ms of latency for 4.8 million users. I've used it to chat with Nickolai, my advisor, on several occasions. I'm currently working to deploy Yodel (and the other systems I've built that solve related problems) at https://vuvuzela.io
 To appear at SOSP 2019