  We study linking attacks on communication protocols. We show that an active
attacker is strictly more powerful in this setting than previously-considered
passive attackers. We introduce a formal model to reason about active
linkability attacks, formally define security against these attacks and give
very general conditions for both security and insecurity of protocols. In
addition, we introduce a composition-like technique that allows to obtain
security proofs by only studying small components of a protocol.
