searchable encryption

Searchable Encryption

Nagendra Posani

Georgia Institute of Technology

December 12, 2016

Nagendra Posani (GaTech) Searchable Encryption December 12, 2016 1 / 24

Data breaches

Become the norm rather than the exception!


Motivation

Data can be sensitive.

Server may be untrusted or subject to attacks.

Obvious solution is encryption


Goals

Search Functionality

Efficiency

Security


How to encrypt data?

Encrypting with ”good” encryption schemes solves privacy, butfunctionality?

Search query becomes problematic since good encryption schemesencrypt plaintext differently (randomize ciphertexts)

Figure: Searchable Database


Literature

Order Preserving Encryption (OPE) [1], [2]

Variants of OPE [3]

Partical Order Preserving Encryption (POPE) [4]

Order Revealing Encryption (ORE) [5], [6]


Order Preserving Encryption

A symmetric encryption scheme is order preserving if encryptionmaintains order relations


Range Queries in OPE


Security Notion for OPE

Provable security notions: IND-CPA?



Provable security notions: IND-CPA? No




IND-OrderedCPA?




IND-OrderedCPA? No


Alternative Security Notions for OPE


IND-OCPA? No

POPF Secure? PRF style definition

No, reveals half of the plaintext bits.

ROPF - (r,z) Window One-Wayness Secure?


Alternative Security Notions for OPE


IND-OCPA? No

POPF Secure? PRF style definition

No, reveals half of the plaintext bits.

ROPF - (r,z) Window One-Wayness Secure

Secure for small r, and insecure for large r (Corresponding lowerboundaries and upper boundaries are defined)

Similarly, (r, z) Distance Window One-Wayness Secure.


Order Revealing Encryption

Generalized form of OPE

Lets define for small domain messages {0,1,2,...,N}


How to encrypt in ORE?

Defined for small plaintext space, keys k1,K2, ...KN are derived fromPRF.


Encryption in ORE

Encrypt with the keys


Encryption in ORE

For comparison we give the key, but security?


Encryption in ORE

Solution: apply random permutation π (part of the secret key) to theslots


Encryption in ORE

Extending it to large domain plaintext space.


Partial Order Preserving Encryption (POPE)

Server stores a partially ordered B-tree

Every node contains an unordered buffer of key/value pairs

Non-leaf nodes also have a small ordered list of ciphertexts

Encryption uses any (randomized) symmetric cipher


Landscape comparision


References I

Y. Lee A. Boldyreva, N. Chenette and A. O’Neill.Order-preserving symmetric encryption.EUROCRYPT 2009, volume 5479, 2009.

N. Chenette A. Boldyreva and A. O’Neill.Order-preserving encryption revisited: Improved security analysis andalternative solutions.CRYPTO 2011.

David Cash F. Betl Durak, Thomas M. DuBuisson.What else is revealed by order-revealing encryption?ACM CCS, 2016.

Seung Geol Choi Daniel S. Roche, Daniel Apon.Pope: Partial order preserving encoding.ACM CCS, 2016.


References II

M. Raykova A. Sahai M. Zhandry D. Boneh, K. Lewi andJ. Zimmerman.Semantically secure order-revealing encryption: Multi-input functionalencryption without obfuscation.EUROCRYPT 2015.

Kevin Lewi and David J. Wu.Order-revealing encryption: New constructions, applications, andlower bounds.ACM CCS, 2016.


searchable encryption

Engineering