Multi-Key Searchable Encryption, Revisited

Hamlin, Ariel; Shelat, Abhi; Weiss, Mor; Wichs, Daniel

doi:10.1007/978-3-319-76578-5_4

Cited by 33 publications

(43 citation statements)

References 32 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…STE was introduced by Chase and Kamara in [18] as a generalization of SSE. Many works have explored various aspects of SSE including dynamism [30], [42], [41], [70], [10], [17], [11], [23], locality [17], [15], [4], [55], [21], expressiveness [18], [14], [59], [24], [54], [40], [43], multiple clients [19], [39], [60], [35], and leakage [27], [45], [44], [3].…”

Section: Sse/ste Sse Was Introduced By Song Wagner Andmentioning

confidence: 99%

Revisiting Leakage Abuse Attacks

Blackstone¹,

Kamara

Moataz

2020

Proceedings 2020 Network and Distributed System Security Symposium

View full text Add to dashboard Cite

Encrypted search algorithms (ESA) are cryptographic algorithms that support search over encrypted data. ESAs can be designed with various primitives including searchable/structured symmetric encryption (SSE/STE) and oblivious RAM (ORAM). Leakage abuse attacks attempt to recover client queries using knowledge of the client's data. An important parameter for any leakage-abuse attack is its known-data rate; that is, the fraction of client data that must be known to the adversary. In this work, we revisit leakage abuse attacks in several ways. We first highlight some practical limitations and assumptions underlying the well-known IKK (Islam et al. NDSS '12) and Count (Cash et al., CCS '15) attacks. We then design four new leakage-abuse attacks that rely on much weaker assumptions. Three of these attacks are volumetric in the sense that they only exploit leakage related to document sizes. In particular, this means that they work not only on SSE/STE-based ESAs but also against ORAM-based solutions. We also introduce two volumetric injection attacks which use adversarial file additions to recover queries even from ORAM-based solutions. As far as we know, these are the first attacks of their kind. We evaluated all our attacks empirically and considered many experimental settings including different data collections, query selectivities, known-data rates, query space size and composition. From our experiments, we observed that the only setting that resulted in reasonable recovery rates under practical assumptions was the case of high-selectivity queries with a leakage profile that includes the response identity pattern (i.e., the identifiers of the matching documents) and the volume pattern (i.e., the size of the matching documents). All other attack scenarios either failed or relied on unrealistic assumptions (e.g., very high known-data rates). For this specific setting, we propose several suggestions and countermeasures including the use of schemes like PBS (Kamara et al, CRYPTO '18), VLH/AVLH (Kamara and Moataz, Eurocrypt '19), or the use of padding techniques like the ones recently proposed by Bost and Fouque (Bost and Fouque, IACR ePrint 2017/1060).

show abstract

Section: Sse/ste Sse Was Introduced By Song Wagner Andmentioning

confidence: 99%

Revisiting Leakage Abuse Attacks

Blackstone¹,

Kamara

Moataz

2020

Proceedings 2020 Network and Distributed System Security Symposium

View full text Add to dashboard Cite

show abstract

“…These features can make the operations of a cloud storage service efficient because the keys and encrypted data become easier to manage for both a data owner and users. We note that these features are not implied in previous systems, namely, multiuser searchable encryption [5]- [8] and multi-key searchable encryption [2], [4], which do not include efficient management described above in their scope. Therefore, achieving the features described above is a non-trivial problem.…”

Section: A Backgroundmentioning

confidence: 98%

“…In a framework of conventional searchable encryption, the multi-user setting [5]- [8], [22], [23] and the multi-key setting [2], [4], [24] have been known to control the searchability for each document. However, an efficient control of the searchability, such as issuance of aggregate keys which is one of the main problems in KASE, is out of the scope of such settings.…”

Section: Related Workmentioning

confidence: 99%

Key-Aggregate Searchable Encryption, Revisited: Formal Foundations for Cloud Applications, and Their Implementation

et al. 2020

View full text Add to dashboard Cite

In the use of a cloud storage, sharing of data with efficient access control is an important requirement in addition to data security and privacy. Cui et al. (IEEE Trans. on Comp. 2016) proposed key-aggregate searchable encryption (KASE), which allows a data owner to issue an aggregate key that enables a user to search in an authorized subset of encrypted files by generating an encrypted keyword called trapdoor. While the idea of KASE is elegant, to the best of our knowledge, its security has never been discussed formally. In this paper, we discuss the security of KASE formally and propose provably secure schemes. The construction of a secure KASE scheme is non-trivial, and we will show that the KASE scheme of Cui et al. is insecure under our definitions. We first introduce our provably secure scheme, named first construction, with respect to encrypted files and aggregate keys in a single-server setting. In comparison with the scheme of Cui et al., the first construction is secure without increased computational costs. Then, we introduce another provably secure scheme, named main construction, with respect to trapdoors in a twoserver setting. The main construction guarantees the privacy of a search, encrypted files, and aggregate keys. Considering 5,000 encrypted files, the first construction can finish search within three seconds and the main construction can finish search within six seconds.INDEX TERMS Key-Aggregate Searchable Encryption, Searchable Encryption, Data Sharing and Provable Security.

show abstract

“…Curtmola et al [19] proposed the most widely used security definition and the first scheme with non-trivial search time. It has since been improved in several ways, e.g., support for multiple users [49], [50], [33], more expressive queries including relational databases, conjunctive keywords, and graph queries [13], [34], [17], [41], [35], [22], [40], or efficient ondisk storage [14], [43], [7], [23], [20].…”

Section: B Related Workmentioning

confidence: 99%

Dynamic Searchable Encryption with Small Client Storage

Demertzis

Chamani

Papadopoulos

et al. 2020

Proceedings 2020 Network and Distributed System Security Symposium

View full text Add to dashboard Cite

We study the problem of dynamic searchable encryption (DSE) with forward-and-backward privacy. Many DSE schemes have been proposed recently but the most efficient ones have one limitation: they require maintaining one operation counter for each unique keyword, either stored locally at the client or stored encrypted at the server and accessed obliviously (e.g., with an oblivious map) during every operation. We propose three new schemes that overcome the above limitation and achieve constant permanent client storage with improved performance, both asymptotically and experimentally, compared to prior stateof-the-art works. In particular, our first two schemes adopt a "static-to-dynamic" transformation which eliminates the need for oblivious accesses during searches. Due to this, they are the first practical schemes with minimal client storage and non-interactive search. Our third scheme is the first quasi-optimal forward-andbackward DSE scheme with only a logarithmic overhead for retrieving the query result (independently of previous deletions). While it does require an oblivious access during search in order to keep permanent client storage minimal, its practical performance is up to four orders of magnitude better than the best existing scheme with quasi-optimal search.

show abstract

Multi-Key Searchable Encryption, Revisited

Cited by 33 publications

References 32 publications

Revisiting Leakage Abuse Attacks

Revisiting Leakage Abuse Attacks

Key-Aggregate Searchable Encryption, Revisited: Formal Foundations for Cloud Applications, and Their Implementation

Dynamic Searchable Encryption with Small Client Storage

Contact Info

Product

Resources

About