Introduction to Practical Cryptography Lecture 9 Searchable Encryption

1 What Area of Cryptography? Privacy-Preserving Computation (PPC) –Function (including inputs and outputs) does not reveal private information

2 MPC vs. PPC MPC is general – it captures all applications. Regarding privacy, MPC aims for the following: –A secure protocol must reveal no more information than the output of the function itself –That is, the process of protocol computation reveals nothing. MPC does not deal with the question of whether or not the function reveals much information – that’s the focus of Privacy- Preserving Computation ( PPC)

3 Privacy-Preserving Computation Search query Data repository  Client wants to preserve search privacy: Private Information Retrieval  Data repository is huge! Privacy-preserving data mining  Data are encrypted: Search over encrypted data

4 Untrusted Remote Storage Remote storage is ubiquitous: – , backups, CVS – Department servers, Yahoo Mail, Gmail

5 Untrusted Remote Storage Google’s Search Across Computers feature –“In order to share your indexed files between your computers, we first copy this content to Google Desktop servers located at Google. This is necessary, for example, if one of your computers is turned off or otherwise offline when new or updated items are indexed on another of your machines. We store this data temporarily on Google Desktop servers and automatically delete older flies, and your data is never accessible by anyone doing a Google search.” Do you trust this?

6 Searchable Encryption Store data externally –encrypted –want to search data easily –avoid downloading everything then decrypt –allow others to search data without having access to plaintext

7 Searchable Encryption - Factors When searching, what must be protected? –retrieved data –search query –search query outcome (was anything found?) Scenario –single query vs multiple queries –non-adaptive: series of queries, each independent of the others –adaptive: form next query based on previous results # of participants –single user (owner of data) can query data –multiple users can query the data, possibly with access rights defined by the owner

8 SSE Security Non-AdaptiveAdaptive

9 Search Over Encrypted Data Applications: Storage outsourcing, mail gateways, Google Desktop (“search across computers”), … Untrusted servers  Data has to be encrypted Encryption hides all information about the data  Server cannot search! Client must download entire document collection:

10 Search Over Encrypted Data (cont’d) Searchable Symmetric Key Encryption where client performs encryption before storing data –Recall that public key algorithms are too slow for encrypting large data Secure index (SI): Auxiliary data structure that allows the remote server to perform searches efficiently, while keeping queries and data confidential Documents are encrypted; SI is encrypted — “two-layer;” searches performed using trapdoors.

11 Searchable Encryption Song, Wagner, Perrig Proposal Alice wants to encrypt a document containing a sequence of n bit words, w 1, w 2 … w q Compute bitwise XOR of plaintext with sequence of “pseudorandom” bits with some structure –n-m bit strings: s 1, s 2,.. s q generated (such as from a stream cipher using a key k’) –use keyed function F on n-m bits that outputs m bits t i = s i || F ki (s i ) c i = w i  t i

12 Basic Idea To search for some w j, tell server –k i for each location i want to search –w j Server computes c i  w j –checks if it is of the form s || F ki (s) –s = first n-m bits, insert into F ki and see if result matches last m bits of c i  w But this requires that Alice reveals –all k i ’s in subset of data she wants to search –and w j

13 Don’t Reveal All k i ’s Instead, only reveal key for the w j Can use one secret key k and a function G to create k i ’s : k i = G k (w i ) Reveal w j and G k (w j ) when searching for w j If w j is in location i, does not reveal other keys, k i for i ≠ j Still reveals w j

14 Don’t Reveal Plaintext plaintext wiwi E sk (w i ) LiLi RiRi sisi G ki (s i ) stream cipher ciphertext

15 Don’t Reveal Plaintext Instead of applying process to plaintext (w 1, w 2, … w q ), encrypt w i ’s first as individual blocks –x i = E sk (w i ) Also split x i into L i || R i –where L i is n-m bits (same length as s i ) –to allow decryption – see on next slide Use L i to create k i, t i, xor with x i –k i = G k (L i ) –t i = s i || F ki (s i ) –c i = x i  t i To search for w j, Give server (x j, k j ) Server computes –t i = c i  x j for each i –checks if t i is of the form s i || F kj (s i ) –if yes, found a match

16 Don’t Reveal Plaintext x i broken into L i, R i to allows decryption by someone with the fixed keys –k’ (stream cipher) –sk (E – encryption of w i ’s) –k (G – function for creating k i ’s) Use k’ to compute s i Recover L i : L i = s i  (first n-m bits of c i ) Use L i to compute k i : k i = G k (L i ) Use k i to recover R i : F ki (s i )  (last m bits of c i ) Now have all of x i : x i = L i || R i Then can recover w i : w i = E -1 sk (x i )

17 Security Information leakage –Didn’t cover how to securely index documents After one query, does server know if two documents contain the same w i ? Over many queries can determine if document are similar –How to hide length of w i ? Overhead – typical w not a full block for a block cipher –Is each w i padded?

18 Searchable Encryption Curtmola, Garay, Kamara, Ostrovsky Proposal (Will cover a non-adaptive case) D = set of documents W = of words in D, w is a word in W D(w) = set of documents in D containing w T = lookup table containing information to locate and decrypt elements of A L i = linked list containing identities of documents in D(w i ) –Each node encrypted under separate key –j th node of L i contains pointer to (j+1) st node its key to (need to decrypt j th node to get information for (j+1) st node ) A = array containing all nodes from all L I ’s in random order –Can’t determine order of L I ’s within A –Can’t determine length of an L i without traversing it

19 Build Lists Austin Baltimore Washington Determine words in each D to create D(w)’s Build linked lists

20 Create Lists Austin Baltimore Washington Encrypt linked lists: establish keys, pointers, encrypt

21 Build Index Table Austin Baltimore Washington f( ) g( ) Build lookup table T

22 Create Array Merge, scramble linked lists to form A

23 Query Baltimore

24 Performance While traversing lists is linear in length of list but linear by what factor? In practice, is a block cipher used to encrypt each word? Padding? Need to run key schedule and decryption function per node

25 Extensions Can I share my document collection? Malicious servers Updates

26 Multi-User SSE

27 Multi-User SSE (cont’d) Similar security notions to single-user SSE’s – Secure indexes and trapdoors Revocation: owner can revoke searching privileges – Robust against user collusions Anonymity: server should not know who initiated search

28 Related Work Public Key Searchable Encryption (PEKS) – [BdCOP04, PKL04, GZZ05, ABC+05, BNS05, OS05] – gateways, streaming data

29 Work on SSE “Oblivious RAMs” [Ost90,GO96] – Optimal security (even hides access pattern) – Poly-logarithmic number of rounds “Practical techniques for searches on encrypted data” [SWP00] – First specific construction (PRGs, PRFs, PRPs) – Limitations: leaks information; inadequate security definition (IND-CPA) “Secure Indexes” [Goh03] – IND2-CKA: semantic security against chosen-keyword attacks – Efficient and IND2-CKA construction (PRFs, Bloom filters) “Privacy Preserving Keyword Searches on Remote Encrypted Data” [CM05] – Simulation-based security definition – Two constructions (PRFs,PRPs) “Searchable Symmetric Encryption: Improved Definitions and Efficient Constructions,” [CGKO06] – Proposed four new security definitions – Two new efficient constructions for SSE IND2-CKA: Indistinguishability against Chosen-Keyword Attacks