Searchable Encryption

Searchable Encryption
Nagendra Posani
Georgia Institute of Technology
December 12, 2016
Nagendra Posani (GaTech) Searchable Encryption December 12, 2016 1 / 24

Data breaches
Become the norm rather than the exception!

Motivation
Data can be sensitive.
Server may be untrusted or subject to attacks.
Obvious solution is encryption

Goals
Search Functionality
Eﬃciency
Security

How to encrypt data?
Encrypting with ”good” encryption schemes solves privacy, but
functionality?
Search query becomes problematic since good encryption schemes
encrypt plaintext diﬀerently (randomize ciphertexts)
Figure: Searchable Database

Literature
Order Preserving Encryption (OPE) [1], [2]
Variants of OPE [3]
Partical Order Preserving Encryption (POPE) [4]
Order Revealing Encryption (ORE) [5], [6]

Order Preserving Encryption
A symmetric encryption scheme is order preserving if encryption
maintains order relations

Range Queries in OPE

Security Notion for OPE
Provable security notions: IND-CPA?

Provable security notions: IND-CPA? No

IND-OrderedCPA?

IND-OrderedCPA? No

Alternative Security Notions for OPE
IND-OCPA? No
POPF Secure? PRF style deﬁnition
No, reveals half of the plaintext bits.
ROPF - (r,z) Window One-Wayness Secure?

Alternative Security Notions for OPE
IND-OCPA? No
POPF Secure? PRF style deﬁnition
No, reveals half of the plaintext bits.
ROPF - (r,z) Window One-Wayness Secure
Secure for small r, and insecure for large r (Corresponding lower
boundaries and upper boundaries are deﬁned)
Similarly, (r, z) Distance Window One-Wayness Secure.

Order Revealing Encryption
Generalized form of OPE
Lets deﬁne for small domain messages {0,1,2,...,N}

How to encrypt in ORE?
Deﬁned for small plaintext space, keys k1, K2, ...KN are derived from
PRF.

Encryption in ORE
Encrypt with the keys

Encryption in ORE
For comparison we give the key, but security?

Encryption in ORE
Solution: apply random permutation π (part of the secret key) to the
slots

Encryption in ORE
Extending it to large domain plaintext space.

Partial Order Preserving Encryption (POPE)
Server stores a partially ordered B-tree
Every node contains an unordered buﬀer of key/value pairs
Non-leaf nodes also have a small ordered list of ciphertexts
Encryption uses any (randomized) symmetric cipher

Landscape comparision

References I
Y. Lee A. Boldyreva, N. Chenette and A. O’Neill.
Order-preserving symmetric encryption.
EUROCRYPT 2009, volume 5479, 2009.
N. Chenette A. Boldyreva and A. O’Neill.
Order-preserving encryption revisited: Improved security analysis and
alternative solutions.
CRYPTO 2011.
David Cash F. Betl Durak, Thomas M. DuBuisson.
What else is revealed by order-revealing encryption?
ACM CCS, 2016.
Seung Geol Choi Daniel S. Roche, Daniel Apon.
Pope: Partial order preserving encoding.
ACM CCS, 2016.

References II
M. Raykova A. Sahai M. Zhandry D. Boneh, K. Lewi and
J. Zimmerman.
Semantically secure order-revealing encryption: Multi-input functional
encryption without obfuscation.
EUROCRYPT 2015.
Kevin Lewi and David J. Wu.
Order-revealing encryption: New constructions, applications, and
lower bounds.
ACM CCS, 2016.

Searchable Encryption

More Related Content

What's hot (20)

Viewers also liked (14)

Similar to Searchable Encryption (20)

Recently uploaded (20)

Searchable Encryption