Revisiting Leakage Abuse Attacks

Abstract

Encrypted search algorithms (ESA) are cryptographic algorithms that support search over encrypted data. ESAs can be designed with various primitives including searchable/structured symmetric encryption (SSE/STE) and oblivious RAM (ORAM). Leakage abuse attacks attempt to recover client queries using knowledge of the client's data. An important parameter for any leakage-abuse attack is its known-data rate; that is, the fraction of client data that must be known to the adversary. In this work, we revisit leakage abuse attacks in several ways. We first highlight some practical limitations and assumptions underlying the well-known IKK (Islam et al. NDSS '12) and Count (Cash et al., CCS '15) attacks. We then design four new leakage-abuse attacks that rely on much weaker assumptions. Three of these attacks are volumetric in the sense that they only exploit leakage related to document sizes. In particular, this means that they work not only on SSE/STE-based ESAs but also against ORAM-based solutions. We also introduce two volumetric injection attacks which use adversarial file additions to recover queries even from ORAM-based solutions. As far as we know, these are the first attacks of their kind. We evaluated all our attacks empirically and considered many experimental settings including different data collections, query selectivities, known-data rates, query space size and composition. From our experiments, we observed that the only setting that resulted in reasonable recovery rates under practical assumptions was the case of high-selectivity queries with a leakage profile that includes the response identity pattern (i.e., the identifiers of the matching documents) and the volume pattern (i.e., the size of the matching documents). All other attack scenarios either failed or relied on unrealistic assumptions (e.g., very high known-data rates). For this specific setting, we propose several suggestions and countermeasures including the use of schemes like PBS (Kamara et al, CRYPTO '18), VLH/AVLH (Kamara and Moataz, Eurocrypt '19), or the use of padding techniques like the ones recently proposed by Bost and Fouque (Bost and Fouque, IACR ePrint 2017/1060).

Eurus: Towards an Efficient Searchable Symmetric Encryption With Size Pattern Protection

“…Those attacks aim to improve plaintext recovery rate without pre-fixed query distribution. There are also recent attacks that purely exploit size pattern leakage [21], [22], [23], [24], [25]. In summary, forward and backward private SSE schemes are still vulnerable to many leakage-abuse attacks.…”

“…The situation has changed recently as several new leakage-abuse attacks were proposed. In particular, Blackstone et al [21] proposed attacks that rely on much weaker assumptions by only exploiting document size information, which can be applied not only to SSE with standard leakage but also to ORAM. Similarly, several attacks [22], [23], [24], [25] to encrypted database that only exploit size pattern leakage were also proposed.…”

Obfuscated Access and Search Patterns in Searchable Encryption

“…Building the search index following (6) ensures that the only root in common between polynomials generated for different document is (w -1 ||0||0), which is only used for padding and never queried. This means that a token can only trigger at most one match.…”

“…The function genPoly takes as input a document D[i] and its label i, generates a polynomial based on its keywords as detailed in (6), and returns the vector of polynomial coefficients v i (which is straightforward to compute from the roots). Since we have S max + 1 roots, the vector of polynomial coefficients will be of size S max + 2.…”

“…The explanation for this high protection despite low differential privacy guarantees is that differential privacy assumes a worst-case scenario where the adversary either knows every single entry in the dataset except for one, or knows all of the user queries but one. Assuming this strong adversary is unrealistic in most cases and, besides that, there exist practical attacks [6], [8], [20], [27], [31] that do not require an adversary this powerful.…”