Hiding the Access Pattern is Not Enough: Exploiting Search Pattern Leakage in Searchable Encryption — mentioned by mahmoudimus

Tue, 07 Jun 2022 17:08:48 GMT

You're on the right track. I work in the data security space and while this is a cool release, it's not novel[0] and has been around for a while[1]. As a general rule of thumb, the first thing to check is if the provider is asking you to pass in your query in plain text AND without a local client (very important, because if you're sending data in plaintext, the threat model is now transitioning to a honest-but-curious model). This is obviously not that. They're encrypting locally. However, Simon Oya & Dr. Kerschbaum's paper, https://arxiv.org/abs/2010.03465, demonstrate a fantastic efficient…

Paper and discussion history. A mention is not an endorsement.

Hiding the Access Pattern is Not Enough: Exploiting Search Pattern Leakage in Searchable Encryption · HackerPapers discussions

Hiding the Access Pattern is Not Enough: Exploiting Search Pattern Leakage in Searchable Encryption — mentioned by mahmoudimus