procd: A Privacy-preserving Robust Implementation to Discover Contacts in Social Networks

Abstract

Current instant messengers store the users’ phone book contacts typically unencrypted or hashed on a central server. In case of a server’s corruption, all contacts are either directly available in plaintext or can be unmasked using a simple dictionary attack. To solve this problem, we present procd [pʁoːst], a python implementation for privacy preserving contact discovery. procd is a trustless solution that requires neither plaintext numbers nor hashes of single phone numbers to retrieve contacts. Instead, we transfer hashed combinations of multiple phone numbers, which increases the effort for dictionary attacks to an unfeasible level using today’s hardware.