Property Preserving Symmetric Encryption

Abstract

Processing on encrypted data is a subject of rich investigation. Several new and exotic encryption schemes, supporting a diverse set of features, have been developed for this purpose. We consider encryption schemes that are suitable for applications such as data clustering on encrypted data. In such applications, the processing algorithm needs to learn certain properties about the encrypted data to make decisions. Often these decisions depend upon multiple data items, which might have been encrypted individually and independently. Current encryption schemes do not capture this setting where computation must be done on multiple ciphertexts to make a decision. In this work, we seek encryption schemes which allow public computation of a pre-specified property P about the encrypted messages. That is, such schemes have an associated property P of fixed arity k, and a publicly computable algorithm Test, such that Test(ct1,. .. , ct k) = P (m1,. .. , m k), where cti is an encryption of mi for i = 1,. .. , k. Further, this requirement holds even if the ciphertexts ct1,. .. , ct k were generated individually and independently. We call such schemes property preserving encryption schemes. Property preserving encryption (PPEnc) makes most sense in the symmetric setting due to the requirement that Test is publicly computable. In this work, we present a thorough investigation of property preserving symmetric encryption. We start by formalizing several meaningful notions of security for PPEnc. Somewhat surprisingly, we show that there exists a hierarchy of security notions for PPEnc, indexed by integers η ∈ N, which does not collapse. We also present a symmetric PPEnc scheme for encrypting vectors in ZN of polynomial length. This construction supports the orthogonality property: for every two vectors (x, y) it is possible to publicly learn whether x • y = 0 mod p. Our scheme is based on bilinear groups of composite order.

Order-Preserving Encryption Secure Beyond One-Wayness

“…Clearly, Mg † and A † are a message generator and an adversary for the game of (X , θ, q)-indistinguishability and the advantage of (Mg † , A † ) in this game is equal to Adv.Game (1) (Mg, A). Hence, the theorem follows from (3.1).⊓ ⊔ 4 Unachievability of Security Notions 4.1 Unachievability of the Security Notions of [37] for OPE with Super-Polynomial…”

“…Property Preserving Encryption [37]: This notion, introduced by Pandey and Rouselakis, is a variant of the OPE whose encryption function preserve some given property. The security notions for this scheme can be considered as those for OPE.…”

“…The subject of this section is to show that all the security notions proposed by Pandey and Rouselakis [37] are unachievable for any OPE scheme with a super-polynomial size message space.…”

“…To this end, we review the study of Pandey and Rouselakis [37]. They introduced a generalized variant of the OPE, property preserving encryption (PPE), whose encryption function preserved some given property.…”

“…Then, from [37] it follows that no security notion defined by them is achievable for such OPE schemes.…”