Challenges to PHY anonymity for wi-fi

Prior work has shown that unique non-idealities in each wireless device give rise to radiometric fingerprints in the transmitted signal. However, even a device with no such uniqueness would betray channel state information (CSI) at the wireless physical layer. A passive listener can use this CSI to de-anonymize the sender. To bound the information gained by a powerful de-anonymizer, we develop an array-processing technique, REST, that extracts slowly-varying channel fingerprints from a Wi-Fi signal. We argue that REST is universal: for every other channel fingerprinting or angle-of-arrival scheme, either that scheme is too paranoid, leaving information unused; too trusting, relying on degrees of freedom under the transmitter's control; or else it is equivalent to REST. In response to REST, on the anonymizer's side, we propose a countermeasure to radio-layer tracking based on switchable antennas: a kind of \"exponential ventriloquism\". In response to exponential ventriloquism, on the de-anonymizer's side, we derive a theoretical upper bound on the effectiveness of a wide class of antenna- or MIMO-based techniques intended to conceal channel fingerprints.