Paper 2023/029

Public Verification for Private Hash Matching

Sarah Scheffler, Princeton University
Anunay Kulshrestha, Princeton University
Jonathan Mayer, Princeton University

End-to-end encryption (E2EE) prevents online services from accessing user content. This important security property is also an obstacle for content moderation methods that involve content analysis. The tension between E2EE and efforts to combat child sexual abuse material (CSAM) has become a global flashpoint in encryption policy, because the predominant method of detecting harmful content---server-side perceptual hash matching on plaintext images---is unavailable. Recent applied cryptography advances enable private hash matching (PHM), where a service can match user content against a set of known CSAM images without revealing the hash set to users or nonmatching content to the service. These designs, especially a 2021 proposal for identifying CSAM in Apple's iCloud Photos service, have attracted widespread criticism for creating risks to security, privacy, and free expression. In this work, we aim to advance scholarship and dialogue about PHM by contributing new cryptographic methods for system verification by the general public. We begin with motivation, describing the rationale for PHM to detect CSAM and the serious societal and technical issues with its deployment. Verification could partially address shortcomings of PHM, and we systematize critiques into two areas for auditing: trust in the hash set and trust in the implementation. We explain how, while these two issues cannot be fully resolved by technology alone, there are possible cryptographic trust improvements. The central contributions of this paper are novel cryptographic protocols that enable three types of public verification for PHM systems: (1) certification that external groups approve the hash set, (2) proof that particular lawful content is not in the hash set, and (3) eventual notification to users of false positive matches. The protocols that we describe are practical, efficient, and compatible with existing PHM constructions.

Note: 3/7 revision adds publication info but makes no other changes

Available format(s)
Cryptographic protocols
Publication info
Published elsewhere. IEEE Security & Privacy 2023
end-to-end encryptionpublic verificationprivate hash matchingcontent moderationtransparency
Contact author(s)
sscheff @ princeton edu
anunay @ princeton edu
jonathan mayer @ princeton edu
2023-03-07: revised
2023-01-09: received
See all versions
Short URL
Creative Commons Attribution


      author = {Sarah Scheffler and Anunay Kulshrestha and Jonathan Mayer},
      title = {Public Verification for Private Hash Matching},
      howpublished = {Cryptology ePrint Archive, Paper 2023/029},
      year = {2023},
      note = {\url{}},
      url = {}
Note: In order to protect the privacy of readers, does not use cookies or embedded third party content.