Public Verification for Private Hash Matching

Sarah Scheffler; Anunay Kulshrestha; Jonathan Mayer

Paper 2023/029

Public Verification for Private Hash Matching

Sarah Scheffler

, Princeton University

Anunay Kulshrestha

, Princeton University

Jonathan Mayer

, Princeton University

Abstract

End-to-end encryption (E2EE) prevents online services from accessing user content. This important security property is also an obstacle for content moderation methods that involve content analysis. The tension between E2EE and efforts to combat child sexual abuse material (CSAM) has become a global flashpoint in encryption policy, because the predominant method of detecting harmful content---server-side perceptual hash matching on plaintext images---is unavailable. Recent applied cryptography advances enable private hash matching (PHM), where a service can match user content against a set of known CSAM images without revealing the hash set to users or nonmatching content to the service. These designs, especially a 2021 proposal for identifying CSAM in Apple's iCloud Photos service, have attracted widespread criticism for creating risks to security, privacy, and free expression. In this work, we aim to advance scholarship and dialogue about PHM by contributing new cryptographic methods for system verification by the general public. We begin with motivation, describing the rationale for PHM to detect CSAM and the serious societal and technical issues with its deployment. Verification could partially address shortcomings of PHM, and we systematize critiques into two areas for auditing: trust in the hash set and trust in the implementation. We explain how, while these two issues cannot be fully resolved by technology alone, there are possible cryptographic trust improvements. The central contributions of this paper are novel cryptographic protocols that enable three types of public verification for PHM systems: (1) certification that external groups approve the hash set, (2) proof that particular lawful content is not in the hash set, and (3) eventual notification to users of false positive matches. The protocols that we describe are practical, efficient, and compatible with existing PHM constructions.

Note: 3/7 revision adds publication info but makes no other changes

Metadata

Available format(s): PDF
Category: Cryptographic protocols
Publication info: Published elsewhere. IEEE Security & Privacy 2023
Keywords: end-to-end encryption public verification private hash matching content moderation transparency
Contact author(s): sscheff @ princeton edu
anunay @ princeton edu
jonathan mayer @ princeton edu
History: 2023-03-07: revised; 2023-01-09: received; See all versions
Short URL: https://ia.cr/2023/029
License: CC BY

BibTeX

@misc{cryptoeprint:2023/029,
      author = {Sarah Scheffler and Anunay Kulshrestha and Jonathan Mayer},
      title = {Public Verification for Private Hash Matching},
      howpublished = {Cryptology {ePrint} Archive, Paper 2023/029},
      year = {2023},
      url = {https://eprint.iacr.org/2023/029}
}