1. Public Key Encryption with Keyword Search
Authors: D. Boneh, G. Di Crescenzo,
R. Ostrovsky, and G. Persiano
-Presented by Brijesh

2. Mobile People Architecture (Stanford)
MPA – focuses on people (and not devices) as endpoints of communication.
A personal proxy maintains a list of devices, a person is currently reachable on and routes based on urgency/ keywords etc..

3. MPA (simple example) Mail server Devices (A is currently reachable on)
pager M
To A, M,”urgent”
Proxy
manager
To A, M,”lunch”
(desktop) M
Server gets to read all messages and the keywords!
How to secure without violating User privacy?

4. Basic Problem $~?@$ (trapdoor for keyword w) Tw Email encrypted
Under Apub
Yes/no B A
Mail server
/ Gateway
(stores only encrypted s)
Now, server cant read the messages.
Problem : How does server check for keywords in the encrypted mail?

5. Basics
Mail server B
[EApub[msg], PEKS(Apub,W1),PEKS(Apub,W2), ….PEKS(Apub,Wk)]
Encrypted mail for A
PEKS for each keyword

6. Goals
Given a searchable encryption of the keyword w’ by B and a trapdoor for w by A, the server should be able to find out all messages having keyword w’ (if w’ = w) and learn nothing more about the keywords.
Also, the server shouldn’t learn anything about the encrypted itself.

7. PEKS Definitions Polynomial time randomised algorithms
KeyGen(s)  Apub, Apriv
PEKS(Apub,W)  searchble enc of W
Trapdoor(Apriv,W)  trapdoor Tw
Test(Apub,S,Tw)  Yes if W=W’
No, otherwise

8. Sample Application Mail server – stores all incoming mails M1
[Search mail with keyword “urgent”]enc M2
M2, M5, M13 Mn
Server doesn’t learn anything about the messages!

9. Construction using Bilinear Maps
e(gx, gy) = [e(g,g)]xy
If g is generator in G1, e(g,g) is generator in G2
e is a polynomial time algorithm.

10. Construction using Bilinear Maps
KeyGen: random α
Apub = [g, gα]
Apriv = α
PEKS(Apub,w):
Sender picks a random r
t = e(H1(w), hr) H1:{0,1}*G1
Output S=[A,B] = [gr, H2(t)]

11. Construction using Bilinear Maps
Trapdoor(Apriv, w):
Output Tw = H1(w)α Є G1
Test if H2(e(Tw,A)) = B
Or H2(e(Tw,A)) = H2(t)
Or e(Tw,A) = t
Or e(Tw,gr) = t
Receiver
sender

12. Construction using Bilinear Maps - Testing
e(Tw,gr) = e(H1(w)α,gr)
= e(gm1.α,gr)
= e(g,g)m1.αr
t = e(H1(w),hr)
= e(gm2, gαr)
= e(g,g)m2.αr
H1 : {0,1}*  G1
We can write H1(w) as gm
We have managed to check for keywords in encrypted messages, without allowing the server to learn anything about the messages or the keywords
If the Tw and PEKS correspond to same w, there is a match
(as m1 = m2)

13. Construction using Bilinear Maps
We need H1 as it maps keywords onto G1
Sender chooses a random r each time for each keyword. Choice of r is independent of receiver.
Does H2 provide any benefit? It wasn’t included in the original construction.

14. Construction using any trapdoor permutation
Assumptions
Number of keywords is bounded by some polynomial function in the security parameter
We need a public key system that is source indistinguishable.
It should be computationally hard to say which public key a ciphertext is associated with.

15. Construction using any trapdoor permutation
For each keyword w
Generate PKw and Privw
PEKS : output(M,E[PKw,M]) , M is random for keyword w.
Trapdoor : for keyword w, Tw = Privw
If Decryption gives M again, output yes else No
Hence, the number of keywords
have to be limited
It relies on source indistinguishability of the encryptions

16. PEKS security Game
Semantically secure against adaptive chosen keyword attack.
W0, W1
Attacker
PEKS(Apub,Wb)
Random b Є {0,1}
Guess b’
If b’=b,
Attacker wins
Can have many rounds
AdvA(s) = | Pr[b’=b] – 1/2 | is very small

17. Issues
The sender of the mail needs to explicitly mention what the keywords are.
Also keywords may not be relevant to the message at all.
Ideally, we need a system, in which we can query the encrypted mail itself for keywords! i.e without wanting to append PEKS for each keyword, along with the mail. Can we do away with PEKS values!

18. Issues
The same trapdoor can be used many times in the future as well by the mail server ?
Can an attacker reuse the trapdoor to get some information about the message or the keyword?

19. Open problem
I m not sure if this has been done before or if it is possible.
We want to be able to search the encrypted message itself for any word, given some trapdoor information.

20. Questions