# Binary-Tree-Fed Mixnet: An Efficient Symmetric Encryption Solution
## 2 Vulnerabilities of ESEBM
If all members of the last group (\(A2\) and \(A5\)) reveal their passwords (\(x_{2},x_{5}\)) to the last member (\(A6\)), the latter will have the password of its group (\(X_{A}\)) and also that of the rest of the groups (\(X_{B},X_{C}\)). That is, it has the complete key. It also knows which user it gave that key to; that is, it has the link with the user. Therefore, it is able to decrypt any message of this user delivered to the first member of the mixnet. In the example (Figure 1), it means a collusion of four nodes: C1, \(A2\), \(A5\), and \(A6\). 2. _Collusion of the delivery node with the remaining nodes in the mixnet_. The delivery node (\(A6\)) can associate its key and ID with the receiving user. This node, by passing the message through it, can therefore identify the user and transmit this knowledge to the following nodes. The last one reveals the message in plain text and it will know its author. This case corresponds with the collusion of four nodes in the example: \(A6,B7,C8\), and \(B9\). 3. _Collusion of the delivery node, the nodes of the groups that have performed a partial decryption, and nodes in between_. The delivery node knows the full key of the remaining groups (\(X_{B}\oplus X_{C}\)). When the message arrives within the mixnet (to \(A6\)), its key (\(x_{6}\)) is applied and the message is clean of the keys of the last group (\(X_{A}\)), but it may already have the keys of some nodes of the following groups applied (\(x_{1}\) from \(C1,x_{3}\) from \(B3\), and \(x_{4}\) from \(C4\)). These nodes can collude and share these keys with the delivery node, but it also needs to know where the message is within the batch. Namely, the permutations of previous nodes are also required. (If any of the following groups have already fully operated on the mixnet, then only collusion from the collector node of that group would be required.) For this example, it means a collusion of the following six nodes: C1, A2, B3, C4, A5, and \(A6\). 4. _Collusion of collection nodes_. The delivery node can relate the user to the message. If all collection nodes collaborate, they can know the aggregate key of each group for that message. From the added key, they can know their particular key. The last member of the mixnet, who is necessarily a group leader, will know the author when he has to use that key. In the example, only three nodes are required: \(A6\), C8, and \(B9\). ESEBM does not establish how many groups to define and how to scatter groups in the mixnet. Therefore, each vulnerability requires more or fewer adversaries depending on this distribution. Table 1 shows the list of vulnerabilities with the adversaries required in each one. The last two columns depict the maximum and minimum number of adversaries needed in each attack considering the best and worst distribution for each case. Notice that two vulnerabilities requires only one adversary in the worst case (delivery node at the end in type 2 and last group placed at the beginning in type 3). This problem is solved in the new scheme. \begin{table}
\begin{tabular}{l l l l} \hline \hline
**Vulnerability** & **Example** & **Max.** & **Min.** \\ \hline
1. Last group and first node & C1, A2, A5, A6. & \(m+1\) & \(m\) \\
2. Delivery node and following ones & A6, B7, C8, B9 & \((k-1)m+1\) & \(1\) \\
3. Delivery node and previous ones & C1...A6 & \(n-m+1\) & \(1\) \\
4. Collector nodes & A6, C8, B9 & \(k\) & \(k\) \\ \hline \hline \end{tabular}
\end{table} 
Table 1: Adversaries required in ESEBM for \(n\) nodes = \(k\) groups \(\times\)\(m\) members.