Encrypt-to-Self: Securely Outsourcing Storage

Abstract

We put forward a symmetric encryption primitive tailored towards a specific application: outsourced storage. The setting assumes a memory-bounded computing device that inflates the amount of volatile or permanent memory available to it by letting other (untrusted) devices hold encryptions of information that they return on request. For instance, web servers typically hold for each of the client connections they manage a multitude of data, ranging from user preferences to technical information like database credentials. If the amount of data per session is considerable, busy servers sooner or later run out of memory. One admissible solution to this is to let the server encrypt the session data to itself and to let the client store the ciphertext, with the agreement that the client reproduce the ciphertext in each subsequent request (e.g., via a cookie) so that the session data can be recovered when required. In this article we develop the cryptographic mechanism that should be used to achieve confidential and authentic data storage in the encrypt-to-self setting, i.e., where encryptor and decryptor coincide and constitute the only entity holding keys. We argue that standard authenticated encryption represents only a suboptimal solution for preserving confidentiality, as much as message authentication codes are suboptimal for preserving authenticity. The crucial observation is that such schemes instantaneously give up on all security promises in the moment the key is compromised. In contrast, data protected with our new primitive remains fully integrity protected and unmalleable. In the course of this paper we develop a formal model for encrypt-to-self systems, show that it solves the outsourced storage problem, propose surprisingly efficient provably secure constructions, and report on our implementations. 9 We use the terms 'key leakage', 'user corruption', and 'state corruption' synonymously. 10 The above encrypt-then-hash (EtH) solution is secure in our models but requires two passes over the data. Our solutions are more efficient, getting along with just one pass.

Efficiency Improvements for Encrypt-to-Self

“…The Encrypt-to-Self primitive emerged only very recently and little directly related work seems to exist. We already pointed to [11,12] as our main sources of inspiration, and to the work of Dodis et al [4] for a quite similar solution for a different problem. In [11], PP identify the topics of memory encryption, password managers, and encryptment (a notion related to instant messaging) as related to EtS, although there doesn't really seem to be a considerable overlap.…”

“…We already pointed to [11,12] as our main sources of inspiration, and to the work of Dodis et al [4] for a quite similar solution for a different problem. In [11], PP identify the topics of memory encryption, password managers, and encryptment (a notion related to instant messaging) as related to EtS, although there doesn't really seem to be a considerable overlap. Finally, we note that EtS-like tools have been proposed for the state management of TLS 1.3 variants [2].…”

“…The security analyses in our article are conducted with respect to the security model formalized in [11], we replicate the security model for completeness. Security games are parameterized by an adversary, and consist of a main game body plus zero or more oracle specifications.…”

“…This results in a substantial saving of computational work. Figure 1 provides an overview of (a simplified version of) the EtS scheme from [11]. 1 Function represents the compression function of a Merkle-Damgård (MD) hash function, that is, it takes bits of data input and bits of chain input, and (deterministically) transforms these inputs to bits of chain output.…”

“…We note that implementing this will require shifting every message byte in computer memory by one position. It turns out that due to the word-wise organization of computer memory, a shift-by-one operation is considerably more expensive that one might assume Figure 1: Principle of the EtS construction from [11]. (Less important details were removed for clarity.)…”