Panini — Anonymous Anycast and an Instantiation

Anycast messaging (i.e., sending a message to an unspecified receiver) has long been neglected by the anonymous communication community. An anonymous anycast prevents senders from learning who the receiver of their message is, allowing for greater privacy in areas such as political activism and whistleblowing. To design protocols with provable guarantees for anonymous anycast, a formal consideration of the problem is necessary, but missing in current work. We use a game-based approach to provide formal definitions of anycast functionality and privacy. Our work also introduces Panini, the first anonymous anycast protocol that requires only existing infrastructure. We show that Panini allows the actual receiver of the anycast message to remain anonymous, even in the presence of an honest but curious sender. In an empirical evaluation, we find that Panini adds only minimal overhead over regular unicast: Sending a message anonymously to one of eight possible receivers results in an end-to-end latency of 0.76 s.