# Binary-Tree-Fed Mixnet: An Efficient Symmetric Encryption Solution
## 2 Vulnerabilities of ESEBM  
ESEBM is an evolution of SEBM [29] and is explained in detail in [30]. To date, no weaknesses in its security have been published. This is precisely the objective of this section. In this mixnet, nodes form groups to generate concealing patterns that are delivered to users. Figure 1 shows an example of an ESEBM mixnet with nine nodes. They form three groups labeled as \(A,B,\) and \(C\). Notice that members of these groups are scattered in the mixnet. The only rule is that priority in the group must be respected on the mixnet. Concealing patterns are random numbers intended to hide user messages. These concealing patterns are built by XORing binary strings generated by each node. Users encrypt their messages by an XOR operation with the patterns and send the result to the first node of the mixnet. Then, each node of the mixnet must remove its binary string. For each node to know which string to apply to which message, it needs a separate identifier. These identifiers could be used to trace senders and therefore must be hidden too. This is the purpose of vector \(q\) in Figure 1.  
In ESEBM, each node generates a binary string (\(x_{2}\) in node \(A2\)), a vector (\(q_{2}\)), and an identifier (\(ID_{2}\)). These values are stored in a table. Then, inside each group, this tuple is passed to the next node, which performs an XOR operation and sends the result to the next one, and so on until reaching the last node of the group (\(A6\)). This one, the collector node, obtains two values: the aggregated keys (\(X_{A}\)) and the concealed identifiers (vector \(Q_{A}\)). Each collector node (\(A6\), \(B9\), and \(C8\)) shuffles many pairs obtained this way. Then, the batch is passed from collector node to collector node, creating an XOR operation. The last node, (\(A6\)), the delivery node, delivers the result to users, which is  
\[X=X_{A}\oplus X_{B}\oplus X_{C}=x_{1}\oplus x_{2}\oplus...\oplus x_{9} \tag{1}\]  
\[Q=ID_{1},ID_{2}\oplus q_{12},ID_{3}\oplus q_{13}\oplus q_{23},...,ID9\oplus q_ {19}...q_{89} \tag{2}\]  
When a user sends a message \(m\) to the mixnet, it follows the format \(m\oplus X,Q\). The first node of the mixnet, \(C1\), recognizes the identifier \(ID_{1}\), which is disclosed in the first position of \(Q\). It must be in its table, in the same row as \(x_{1}\) and \(q_{1}\). Then, \(C1\) creates an XOR operation with these values. The result is an encrypted message without the string \(x_{1}\) and a vector \(Q\) without the concealing values of \(q_{1}\). The next node \(A2\) will find its identifier \(ID_{2}\) unveiled and will create the same process. At the end, all the strings \(x_{i}\) will be removed and the message shown in plain text. The only node that knows the complete key \(X\) and the user is the delivery node (\(A6\)). In order to prevent that, the user sends blinding factors to each member of this last group. Figure 1: Example of ESEBM. Mixnet of 9 servers distributed in three groups. Each node builds its concealing patterns \(x_{i}\) and \(q_{i}\), which are stored in a table with an identifier \(ID_{i}\). Then, they are combined by groups (like \((X_{A},Q_{A})\) for group \(A\)), and then by mixnet \((X,Q)\), which are sent to users. These factors (\(b_{i}\)) are combined with the strings by each node (\(x_{i}\) for \(i=2,5,6\) in the example). Therefore, the user receives the pair \((X\oplus B,Q)\), where \(B\) is an XOR of blinding factors \(b_{i}\) to be removed by the user before sending \(m\). The delivery node can store in its internal table the aggregated key of the remaining groups (\(X_{B}\oplus X_{C},Q_{B}\oplus Q_{C}\)) and the user but cannot know its group key (\(X_{A}\)). Collector nodes can store its keys (pair \(X_{B},Q_{B}\) for node \(B9\); pair \(X_{C},Q_{C}\) for node C8). With this scheme, there are feasible attacks such as the following:  
1. _Collusion of last group with the first node of the mixnet_.