Lower Bounds for Encrypted Multi-Maps and Searchable Encryption in - - PowerPoint PPT Presentation

▶
lower bounds for encrypted multi maps and searchable
SMART_READER_LITE
LIVE PREVIEW

Lower Bounds for Encrypted Multi-Maps and Searchable Encryption in - - PowerPoint PPT Presentation

Mar 27, 2023 298 likes •1.11k views

Lower Bounds for Encrypted Multi-Maps and Searchable Encryption in the Leakage Cell Probe Model Sarvar Patel*, Giuseppe Persiano** and Kevin Yeo* *Google **University of Salerno Key k i was queried. Privacy-Preserving Storage Protocols Key k i

slide-1
SLIDE 1

Lower Bounds for Encrypted Multi-Maps and Searchable Encryption in the Leakage Cell Probe Model

Sarvar Patel*, Giuseppe Persiano** and Kevin Yeo* *Google **University of Salerno

slide-2
SLIDE 2

Privacy-Preserving Storage Protocols

V1 V2 Vn ... Key ki Vi Key ki was queried. k1 k2 ... kn

slide-3
SLIDE 3

Privacy-Preserving Storage Protocols

V1 V2 Vn ... k1 k2 ... kn Key k2 was never queried. Key k15 was most frequently queried.

slide-4
SLIDE 4

Privacy-Preserving Storage Protocols

Key ki ... Vi V1 V2 Vn ... k1 k2 ... kn What was the requested key?

slide-5
SLIDE 5

Privacy Spectrum for Maps

Plaintext Maps

slide-6
SLIDE 6

Plaintext Maps

  • Classic dictionary problem with many solutions!

○ Perfect Hashing: Static [FKS’84], Dynamic [DKM+’94] ○ Cuckoo Hashing [PR’01] ○ … and many more

slide-7
SLIDE 7

Plaintext Maps

  • Classic dictionary problem with many solutions!

○ Perfect Hashing: Static [FKS’84], Dynamic [DKM+’94] ○ Cuckoo Hashing [PR’01] ○ … and many more

  • Efficiency: O(1) overhead, O(n) storage
  • Privacy: None -- Leaks all keys and values.
slide-8
SLIDE 8

Privacy Spectrum for Maps

Plaintext Maps Structured Encryption Efficiency: O(1) Leakage: Everything

slide-9
SLIDE 9

Structured Encryption

  • Idea: Encrypt a data structure while maintaining operations

○ Example: Searchable encryption = Encrypt a search index

  • Many works in the past two decades:

○ Static [SWP’00], [BDOP’04], [CGKO’11], ... ○ Dynamic [CJJ+’14], [SPS’14], ... ○ Forward and Backward Privacy [Bost’16], [BMO’17], ...

slide-10
SLIDE 10

Structured Encryption

  • Idea: Encrypt a data structure while maintaining operations

○ Example: Searchable encryption = Encrypt a search index

  • Many works in the past two decades:

○ Static [SWP’00], [BDOP’04], [CGKO’11], ... ○ Dynamic [CJJ+’14], [SPS’14], ... ○ Forward and Backward Privacy [Bost’16], [BMO’17], …

  • Efficiency: Typically O(1) but can be higher depending on leakage
  • Privacy: Some well-defined leakage function

○ Number of values associated with keys, Key-equality between operations, Number of operations, etc.

slide-11
SLIDE 11

Privacy Spectrum for Maps

Plaintext Maps Structured Encryption Oblivious RAM Efficiency: O(1) Leakage: Everything Efficiency: O(1) Leakage: Non-trivial Leakage Function

slide-12
SLIDE 12

Oblivious RAM

  • Introduced by Goldreich and Ostrovsky [GO’96]

○ Also, many works in the past decade [PR’10], [SSS’11], [MMOT’12], [SvDS’13], [PPRY’18], .... ○ … leading to optimal O(log n) overhead construction [AKL+’20]

slide-13
SLIDE 13

Oblivious RAM

  • Introduced by Goldreich and Ostrovsky [GO’96]

○ Also, many works in the past decade [PR’10], [SSS’11], [MMOT’12], [SvDS’13], [PPRY’18], .... ○ … leading to optimal O(log n) overhead construction [AKL+’20]

  • Efficiency: O(log n), which is tight due to [GO’96, LN’18]
  • Privacy: Adversary cannot distinguish two sequences of same length

○ Leakage function is (upper bound on) length of operational sequence

slide-14
SLIDE 14

Privacy Spectrum for Maps

Plaintext Maps Structured Encryption Oblivious RAM Efficiency: O(1) Leakage: Everything Efficiency: O(1) Leakage: Non-trivial Leakage Function Efficiency: O(log n) Leakage: Length of

  • perational sequence
slide-15
SLIDE 15

Privacy Spectrum for Maps

Plaintext Maps Structured Encryption Oblivious RAM Efficiency: O(1) Leakage: Everything Efficiency: O(1) Leakage: Non-trivial Leakage Function Efficiency: O(log n) Leakage: Length of

  • perational sequence

What leakage functions inherently cost Ω(log n) like ORAM?

slide-16
SLIDE 16

Privacy Spectrum for Maps

Plaintext Maps Structured Encryption Oblivious RAM Efficiency: O(1) Leakage: Everything Efficiency: O(1) Leakage: Non-trivial Leakage Function Efficiency: O(log n) Leakage: Length of

  • perational sequence
slide-17
SLIDE 17

Hash-and-Encrypt Compiler

  • Consider any plaintext map with operations:

○ Insert(k, v) ○ Get(k) ○ Delete(k)

slide-18
SLIDE 18

Hash-and-Encrypt Compiler

V1 V2 Vn ... k1 k2 ... kn

K

slide-19
SLIDE 19

Hash-and-Encrypt Compiler

V1 V2 Vn ... H(K, k1)

K

H(K, k2) ... H(K, kn)

slide-20
SLIDE 20

Hash-and-Encrypt Compiler

Enc(K, V1) Enc(K, V2) Enc(K, Vn) ... H(K, k1)

K

H(K, k2) ... H(K, kn)

slide-21
SLIDE 21

Hash-and-Encrypt Compiler (Query)

Enc(K, V1) Enc(K, V2) Enc(K, Vn) ... H(K, k1)

K

H(K, k2) ... H(K, kn) Key ki H(K, ki) Get(H(K, ki)) Enc(K, Vi)

slide-22
SLIDE 22

Hash-and-Encrypt Compiler (Insert)

Enc(K, V1) Enc(K, V2) Enc(K, Vn) ... H(K, k1)

K

H(K, k2) ... H(K, kn) Key ki Value Vi Insert(H(K, ki), Enc(K, Vi)) H(K, ki), Enc(K, Vi)

slide-23
SLIDE 23

Hash-and-Encrypt Compiler (Insert)

Enc(K, V1) Enc(K, V2) Enc(K, Vn) Enc(K, Vi) H(K, k1)

K

H(K, k2) H(K, ki) H(K, kn) Key ki Value Vi H(K, ki), Enc(K, Vi) Insert(H(K, ki), Enc(K, Vi))

slide-24
SLIDE 24

Leakage of Hash-and-Encrypt

Insert H(K, “cat”) Enc(K, “01”)

slide-25
SLIDE 25

Leakage of Hash-and-Encrypt

Insert H(K, “cat”) Enc(K, “01”) Insert H(K, “dog”) Enc(K, “00”)

slide-26
SLIDE 26

Leakage of Hash-and-Encrypt

Insert H(K, “cat”) Enc(K, “01”) Insert H(K, “dog”) Enc(K, “00”) Insert H(K, “cat”) Enc(K, “11”) Query H(K, “dog”) Enc(K, “00”) Query H(K, “cat”) Enc(K, “01”) Enc(K, “11”) ...

slide-27
SLIDE 27

Leakage of Hash-and-Encrypt

  • Type of operation performed
slide-28
SLIDE 28

Leakage of Hash-and-Encrypt

Insert H(K, “cat”) Enc(K, “01”) Insert H(K, “dog”) Enc(K, “00”) Insert H(K, “cat”) Enc(K, “11”) Query H(K, “dog”) Enc(K, “00”) Query H(K, “cat”) Enc(K, “01”) Enc(K, “11”) ...

slide-29
SLIDE 29

Leakage of Hash-and-Encrypt

  • Type of operation performed
  • Length of Query response
slide-30
SLIDE 30

Leakage of Hash-and-Encrypt

Insert H(K, “cat”) Enc(K, “01”) Insert H(K, “dog”) Enc(K, “00”) Insert H(K, “cat”) Enc(K, “11”) Query H(K, “dog”) Enc(K, “00”) Query H(K, “cat”) Enc(K, “01”) Enc(K, “11”) ...

slide-31
SLIDE 31

Leakage of Hash-and-Encrypt

  • Type of operation performed
  • Length of Query response
  • Key-Equality Pattern
slide-32
SLIDE 32

Leakage of Hash-and-Encrypt

Insert H(K, “cat”) Enc(K, “01”) Insert H(K, “dog”) Enc(K, “00”) Insert H(K, “cat”) Enc(K, “11”) Query H(K, “dog”) Enc(K, “00”) Query H(K, “cat”) Enc(K, “01”) Enc(K, “11”) ...

slide-33
SLIDE 33

Leakage of Hash-and-Encrypt

Insert H(K, “cat”) Enc(K, “01”) Insert H(K, “dog”) Enc(K, “00”) Insert H(K, “cat”) Enc(K, “11”) Query H(K, “dog”) Enc(K, “00”) Query H(K, “cat”) Enc(K, “01”) Enc(K, “11”) ...

slide-34
SLIDE 34

Leakage of Hash-and-Encrypt

Insert H(K, “cat”) Enc(K, “01”) Insert H(K, “dog”) Enc(K, “00”) Insert H(K, “cat”) Enc(K, “11”) Query H(K, “dog”) Enc(K, “00”) Query H(K, “cat”) Enc(K, “01”) Enc(K, “11”) ...

slide-35
SLIDE 35

Leakage of Hash-and-Encrypt

  • Type of operation performed
  • Length of Query response
  • Key-Equality Pattern
slide-36
SLIDE 36

Leakage of Hash-and-Encrypt

  • Type of operation performed
  • Length of Query response
  • Key-Equality Pattern

Surprisingly, this matches leakage of best STE O(1) schemes!!!

slide-37
SLIDE 37

Privacy Spectrum for Maps

Plaintext Maps Structured Encryption Oblivious RAM Efficiency: O(1) Leakage: Everything Efficiency: O(1) Leakage: Non-trivial Leakage Function Efficiency: O(log n) Leakage: Length of

  • perational sequence
slide-38
SLIDE 38

Can we do better?

  • Type of operation performed
  • Length of Query response
  • Key-Equality Pattern
slide-39
SLIDE 39

Can we do better?

  • Type of operation performed (Perform all possible operation types)
  • Length of Query response
  • Key-Equality Pattern
slide-40
SLIDE 40

Can we do better?

  • Type of operation performed (Perform all possible operation types)
  • Length of Query response??? (Hard to do without increasing cost significantly)

○ Padding Volume-Hiding STE schemes: [KM’19], [PPYY’19]

  • Key-Equality Pattern
slide-41
SLIDE 41

Can we do better?

  • Type of operation performed (Perform all possible operation types)
  • Length of Query response??? (Hard to do without increasing cost significantly)

○ Padding Volume-Hiding STE schemes: [KM’19], [PPYY’19]

  • Key-Equality Pattern
slide-42
SLIDE 42

Decoupled Key-Equality

Insert H(K, “cat”) Enc(K, “01”) Insert H(K, “dog”) Enc(K, “00”) Insert H(K, “cat”) Enc(K, “11”) Query H(K, “dog”) Enc(K, “00”) Query H(K, “cat”) Enc(K, “01”) Enc(K, “11”) ...

slide-43
SLIDE 43

Decoupled Key-Equality

Insert H(K, “cat”) Enc(K, “01”) Insert H(K, “dog”) Enc(K, “00”) Insert H(K, “cat”) Enc(K, “11”) Query H(K, “dog”) Enc(K, “00”) Query H(K, “cat”) Enc(K, “01”) Enc(K, “11”) ...

slide-44
SLIDE 44

Decoupled Key-Equality

Insert H(K, “cat”) Enc(K, “01”) Insert H(K, “dog”) Enc(K, “00”) Insert H(K, “cat”) Enc(K, “11”) Query H(K, “dog”) Enc(K, “00”) Query H(K, “cat”) Enc(K, “01”) Enc(K, “11”) ...

slide-45
SLIDE 45

Decoupled Key-Equality

Insert H(K, “cat”) Enc(K, “01”) Insert H(K, “dog”) Enc(K, “00”) Insert H(K, “cat”) Enc(K, “11”) Query H(K, “dog”) Enc(K, “00”) Query H(K, “cat”) Enc(K, “01”) Enc(K, “11”) ...

slide-46
SLIDE 46

Main Result

  • Theorem. Any encrypted multi-map with

leakage at most the decoupled key-equality pattern must have Ω(log n) overhead.

slide-47
SLIDE 47

Main Result

  • Theorem. Any encrypted multi-map with

leakage at most the decoupled key-equality pattern must have Ω(log n) overhead.

  • Corollary. This lower bound is tight as there

exists O(log n) ORAM-based encrypted multi-maps leaking much less than the decoupled key-equality pattern.

slide-48
SLIDE 48

Privacy Spectrum for Maps

Plaintext Maps Structured Encryption Oblivious RAM Efficiency: O(1) Leakage: Everything Efficiency: O(1) Leakage: Non-trivial Leakage Function Efficiency: O(log n) Leakage: Length of

  • perational sequence

Everything here requires Ω(log n)

  • verhead.
slide-49
SLIDE 49

Cell Probe Model

slide-50
SLIDE 50

Cell Probe Model

slide-51
SLIDE 51

Cell Probe Model

slide-52
SLIDE 52

Cell Probe Model

  • Only cost is probing (read/write) a cell of w bits
  • Computation is free
  • Random oracle is free
  • Accessing client storage is free
  • Very weak cost model → Very strong lower bounds
slide-53
SLIDE 53

Lower Bound

  • Uses Information Transfer technique [PD’06]
slide-54
SLIDE 54

Lower Bound

... ... ... ... ... ...

slide-55
SLIDE 55

Lower Bound

... ... ... ... ... ...

  • p1
  • p2
  • pn

...

slide-56
SLIDE 56

Lower Bound

...

  • p1
  • p2
  • pn

...

slide-57
SLIDE 57

Lower Bound

...

  • p1 → cread(15), cwrite(72), cwrite(220), ...
  • p2 → cwrite(650), cwrite(327), cread(296), ...
  • pn → cwrite(297), cread(372), cread(580), ...

...

slide-58
SLIDE 58

Lower Bound

  • p1
  • p2

...

  • p3
slide-59
SLIDE 59

Lower Bound

  • p1
  • p2

...

  • p3 → …, cread(15), ...
slide-60
SLIDE 60

Lower Bound

  • p1 → …, cwrite(15), ...
  • p2

...

  • p3 → …, cread(15), ...
slide-61
SLIDE 61

Lower Bound

15

  • p1 → …, cwrite(15), ...
  • p2

...

  • p3 → …, cread(15), ...
slide-62
SLIDE 62

Lower Bound

... ... ... ... ... ...

  • p1
  • p2
  • pn

...

slide-63
SLIDE 63

Lower Bound

... ... ... ... ... ...

  • p1
  • p2
  • pn

...

slide-64
SLIDE 64

Lower Bound

... ... ... ... ... ...

  • p1
  • p2
  • pn

...

slide-65
SLIDE 65

Lower Bound

insert(..., …) insert(..., …)

slide-66
SLIDE 66

Lower Bound

insert(..., …) insert(..., …) query(...) query(...)

slide-67
SLIDE 67

Lower Bound

insert(“1”, V) insert(“2”, V) query(“2”) query(“1”)

slide-68
SLIDE 68

Lower Bound

  • Hard Sequence: insert(“1”, V), read(“1”), insert(“2”, V), read(“2”), insert(“3”, V), read(“3”), ...

○ V contains a large amount of entropy

slide-69
SLIDE 69

Lower Bound

  • Hard Sequence: insert(“1”, V), read(“1”), insert(“2”, V), read(“2”), insert(“3”, V), read(“3”), ...

○ V contains a large amount of entropy

  • Isn’t this operation easy to handle?
slide-70
SLIDE 70

Lower Bound

  • Hard Sequence: insert(“1”, V), read(“1”), insert(“2”, V), read(“2”), insert(“3”, V), read(“3”), ...

○ V contains a large amount of entropy

  • Isn’t this operation easy to handle?
  • Key: Sequence must be indistinguishable from other sequences with identical leakage
slide-71
SLIDE 71

Lower Bound

insert(“1”, V) query(“1”) query(“2”) insert(“2”, V) insert(“3”, V) query(“3”) query(“4”) insert(“4”, V)

slide-72
SLIDE 72

Lower Bound

insert(“1”, V) query(“1”) query(“2”) insert(“2”, V) insert(“3”, V) query(“3”) query(“4”) insert(“4”, V)

slide-73
SLIDE 73

Lower Bound

insert(“1”, V) query(“1”) query(“2”) insert(“2”, V) insert(“3”, V) query(“3”) query(“4”) insert(“4”, V)

slide-74
SLIDE 74

Lower Bound

insert(“1”, V) query(dummy1) query(dummy2) insert(“2”, V) insert(“3”, V) query(“1”) query(“2”) insert(“4”, V)

slide-75
SLIDE 75

Lower Bound

insert(“1”, V) query(dummy1) query(dummy2) insert(“2”, V) insert(“3”, V) query(“1”) query(“2”) insert(“4”, V) insert(dummy1, V) insert(dummy2, V) ...

slide-76
SLIDE 76

Lower Bound

insert(“1”, V) query(dummy1) query(dummy2) insert(“2”, V) insert(“3”, V) query(“1”) query(“2”) insert(“4”, V) insert(dummy1, V) insert(dummy2, V) ...

slide-77
SLIDE 77

Lower Bound

  • Use these ideas to show that many probes must be assigned to half the internal nodes for this

“easy” hard distribution.

  • Summing up the probes assigned over all nodes provides the lower bound
slide-78
SLIDE 78

Stronger Lower Bounds

  • The lower bounds hold even when one of:

○ Insert operations are performed in plaintext ○ Query operations are performed in plaintext

slide-79
SLIDE 79

Dynamic Searchable Encryption

  • Theorem. Dynamic searchable encryption schemes that are response-hiding require overhead Ω(log n)
  • verhead.
  • Corollary. This lower bound is tight as there exist ORAM-based dynamic searchable encryption schemes

that are response-hiding with O(log n) overhead.

slide-80
SLIDE 80

Other Cryptographic Cell Probe Lower Bounds

  • Ω(log n) Oblivious RAMs [LN’18]
  • Ω(log n) Oblivious Data Structures [JLN’19]
  • Ω(log n) Differentially Private RAMs [PY’19]
  • Ω(log2 n) Oblivious Near-Neighbor Search [LMWY’19]
  • Ω(log n) Multi-Server Oblivious RAMs [LSY’19]
slide-81
SLIDE 81

Thank you!