Cryptology ePrint Archive: Report 2016/786

What Else is Revealed by Order-Revealing Encryption?

F. Betül Durak and Thomas M. DuBuisson and David Cash

Abstract: The security of order-revealing encryption (ORE) has been unclear since its invention. Dataset characteristics for which ORE is especially insecure have been identified, such as small message spaces and low-entropy distributions. On the other hand, properties like one-wayness on uniformly-distributed datasets have been proved for ORE constructions.

This work shows that more plaintext information can be extracted from ORE ciphertexts than was previously thought. We identify two issues: First, we show that when multiple columns of correlated data are encrypted with ORE, attacks can use the encrypted columns together to reveal more information than prior attacks could extract from the columns individually. Second, we apply known attacks, and develop new attacks, to show that the \emph{leakage} of concrete ORE schemes on non-uniform data leads to more accurate plaintext recovery than is suggested by the security theorems which only dealt with uniform inputs.

Category / Keywords: secret-key cryptography / order-revealing encryption; order-preserving encryption; database encryption

Original Publication (in the same form): ACM CCS 2016

Date: received 17 Aug 2016, last revised 7 Sep 2016

Contact author: david cash at cs rutgers edu

Available format(s): PDF | BibTeX Citation

Note: Added a citation to concurrent and independent work by Grubbs et al.

Version: 20160907:120137 (All versions of this report)

Short URL:

[ Cryptology ePrint archive ]