Faculty of Science, Technology and Medicine
Faculty of Law, Economics and Finance
Faculty of Humanities, Education and Social Sciences
Interdisciplinary Centre for Security, Reliability and Trust
Luxembourg Centre for Systems Biomedicine
Luxembourg Centre for Contemporary and Digital History
Luxembourg Centre for European Law
Luxembourg Centre for Socio-Environmental Systems
The Doctoral School in Science and Engineering is happy to invite you to RAKEEI Amin’s defence entitled
Securing Communication Under Coercion or Surveillance: Coercion-Resistance and Covert Channels
Supervisor: Assoc. Prof Gabriele LENZINI
Electronic examinations (e-exams) promise scale and flexibility, but they change the trust assumptions of assessment. Beyond authentication, integrity, privacy, and verifiability, this thesis focuses on a human-centered threat: coercion. In high-stakes settings, a coercer may
supervise a session, demand keys or transcripts, and later verify compliance. Under such pressure, anonymity tools and audit logs can turn into evidence rather than protection. The central question is how to address coercion while maintaining established security goals
for e-exams. I first study coercion in e-exams and define two properties, Anonymous Submission and Single-Blindness, that capture privacy under pressure. I show that a state-of-the-art protocol fails to meet these notions, and I design CREX, the first e-exam protocol to satisfy
them alongside core privacy and authentication goals. The scheme employs a new shuffling mechanism to mitigate collusion and coercion. The analysis also exposes and fixes a linkability issue in the exponentiation mixnet used by prior work. All claims are modelled and checked in ProVerif. I then strengthen the threat model to allow leakage of all participant secrets. Under this stronger model, I identify new attacks on CREX and introduce SCREX, which employs a new pre-assignment protocol as its main coercion-resistance strategy.
SCREX includes a concrete mixnet model and a full formal analysis in ProVerif that proves coercion-resistance as well as individual and universal verifiability. However, this new design relies on an untappable channel, which is a strong assumption and difficult to realize at scale on today’s internet. This leads to a broader question: can secure and undetectable communication be achieved over ordinary networks, without special links, using the building blocks of deployed systems? From this perspective, surveillance is the adjacent threat to study.
It operates at scale and is especially relevant in e-voting and secure messaging. Therefore, I examine two mature settings—e-voting and the Signal Double Ratchet—to design covert channels that remain compatible with deployed protocols and maintain indistinguishability under surveillance. In e-voting, I introduce anamorphic voting and the notion of ballot freedom: a voter can covertly convey the true choice to an auditor while casting a normal-looking ballot, even against dishonest authorities. I realize this by composing primitives already present in deployed systems (IVXV, CHVote, Helios, and Belenios). This yields the first ElGamalbased and Schnorr-style anamorphic constructions designed for deployment. In secure messaging, I integrate anamorphism into the Signal Double Ratchet to realize a covert channel that lets users communicate undetectably even when authorities can decrypt messages. I show that, even when end-to-end encryption is effectively compromised by lawful access or similar controls, parties can still communicate securely and indistinguishably through this channel.
I propose three practical constructions: two embed hidden data in ephemeral Diffie–Hellman public keys and one in MAC tags. The resulting messages are indistinguishable from normal Signal traffic. I implement the designs in the official Signal library and measure their performance, demonstrating practical feasibility and efficiency across a range of anamorphic bit-rate settings. Overall, the thesis advances the security of communication under coercion and surveillance at two levels: (i) new models and formally verified e-exam protocols that remain secure under weak and strong coercion, and (ii) deployable anamorphic constructions in voting and messaging that create hidden, undetectable channels without special infrastructure. Although I do not present an anamorphic e-exam construction in this thesis, I lay the groundwork and outline concrete next steps for future work in e-exams and beyond.