LAMA: Leakage-Abuse Attacks Against Microsoft Always Encrypted

Ryan Seah; Daren Khu; Alexander Hoover; Ruth Ng

Paper 2024/1308

LAMA: Leakage-Abuse Attacks Against Microsoft Always Encrypted

Ryan Seah, McGill University, DSO National Laboratories

Daren Khu, DSO National Laboratories

Alexander Hoover

, University of Chicago

Ruth Ng, DSO National Laboratories

Abstract

Always Encrypted (AE) is a Microsoft SQL Server feature that allows clients to encrypt sensitive data inside client applications and ensures that the sensitive data is hidden from untrusted servers and database administrators. AE offers two column-encryption options: deterministic encryption (DET) and randomized encryption (RND). In this paper, we explore the security implications of using AE with both DET and RND encryption modes by running Leakage Abuse Attacks (LAAs) against the system. We demonstrate how an adversary could extract the necessary data to run a frequency analysis LAA against DET-encrypted columns and an LAA for Order-Revealing Encryption against RND-encrypted columns. We run our attacks using real-world datasets encrypted in a full-scale AE instancer and demonstrate that a snooping server can recover over 95\% of the rows in 8 out of 15 DET-encrypted columns, and 10 out of 15 RND-encrypted columns.

Metadata

Available format(s): PDF
Category: Attacks and cryptanalysis
Publication info: Published elsewhere. Minor revision. SECRYPT 2024 Poster
Keywords: Microsoft SQL Leakage Abuse Attack Database Management Encrypted Search Attack Cryptography
Contact author(s): ryan seah @ mail mcgill ca
kboontat @ dso org sg
alexhoover @ uchicago edu
niiyung @ dso org sg
History: 2024-08-23: revised; 2024-08-21: received; See all versions
Short URL: https://ia.cr/2024/1308
License: CC BY

BibTeX

@misc{cryptoeprint:2024/1308,
      author = {Ryan Seah and Daren Khu and Alexander Hoover and Ruth Ng},
      title = {{LAMA}: Leakage-Abuse Attacks Against Microsoft Always Encrypted},
      howpublished = {Cryptology {ePrint} Archive, Paper 2024/1308},
      year = {2024},
      url = {https://eprint.iacr.org/2024/1308}
}