ANONIZE: A Large-Scale Anonymous Survey System

A secure ad-hoc survey scheme enables a survey authority to independently (with-out any interaction) select an ad-hoc group of registered users based only on their identities (e.g., their email addresses), and create a survey where only selected users can anonymously submit exactly one response. We present a formalization of secure ad-hoc surveys and present: • an abstract provably-secure implementation based on standard cryptographic building blocks (which in particular are implied by the existence of enhanced trapdoor permutations in the CRS model); • a practical instantiation of our abstract protocol, called anonize, which is provably-secure in the random oracle model based on cryptographic assumptions on groups with bilinear maps. As far as we know, anonize constitutes the first implementation of a large-scale secure computation protocol (of non-trivial functionalities) that can scale to millions of users.