Structured Encryption (StE) enables a client to securely store and query data stored on an untrusted server. Recent constructions of StE have moved beyond basic queries, and now support large subsets of SQL. However, the security of these constructions is poorly understood, and no systematic analysis has been performed. We address this by providing the first leakage-abuse attacks against StE for SQL schemes. Our attacks can be run by a passive adversary on a server with access to some information about the distribution of underlying data, a common model in prior work. They achieve partial query recovery against select operations and partial plaintext recovery against join operations. We prove the optimality and near-optimality of two new attacks, in a Bayesian inference framework. We complement our theoretical results with an empirical investigation testing the performance of our attacks against real-world data and show they can successfully recover a substantial proportion of queries and plaintexts. In addition to our new attacks, we provide proofs showing that the conditional optimality of a previously proposed leakage-abuse attack and that inference against join operations is NP-hard in general.

The Structured Encryption (StE) framework can be used to capture the encryption and querying of complex data structures on an honest-but-curious server. In this work, we introduce a new type of StE called indirectly addressed multimap encryption (IA-MME). We propose two IA-MME schemes: the layered multimaps approach" which extends and generalizes the existing "multimap chaining" approach, and a novel technique called the single multimap approach which has comparable efficiency and strictly better security. We demonstrate that our formalisms simplify and modularize StE solutions for real-world use cases in searchable encryption and SQL databases, and provide simulations demonstrating that our IA-MME constructions lead to tangible efficiency and security gains on realistic data. As a part of our techniques, we identify and correct a technical error in prior constructions — providing greater insight into issues that can arise when composing StE schemes.

Cryptanalysis of block ciphers is an active and important research area with an extensive volume of literature. For this work, we focus on SBox-based ciphers, as they are widely used and cover a large class of block ciphers. While there have been prior works that have consolidated attacks on block ciphers, they usually focus on describing and listing the attacks. Moreover, the methods for evaluating a cipher’s security are often ad hoc, differing from cipher to cipher, as attacks and evaluation techniques are developed along the way. As such, we aim to organise the attack literature, as well as the work on security evaluation. In this work, we present a systematization of cryptanalysis of SBox-based block ciphers focusing on three main areas: (1) Evaluation of block ciphers against standard cryptanalytic attacks; (2) Organisation and relationships between various attacks; (3) Comparison of the evaluation and attacks on existing ciphers.

We draw attention to a gap between theory and usage of nonce-based symmetric encryption, under which the way the former treats nonces can result in violation of privacy in the latter. We bridge the gap with a new treatment of nonce-based symmetric encryption that modifies the syntax (decryption no longer takes a nonce), upgrades the security goal (asking that not just messages, but also nonces, be hidden) and gives simple, efficient schemes conforming to the new definitions. We investigate both basic security (holding when nonces are not reused) and advanced security (misuse resistance, providing best-possible guarantees when nonces are reused).

In this paper, we introduce and reconcile some of the work done on two error-correcting protocols, BINARY and CASCADE, rigorously, for a mathematically inclined audience. We also introduce our own variant of this protocol, which may be more efficient or computation-friendly, and thus a potential direction for future work. We revisit and clarify past work done in this area; in particular, we discuss proofs by Seet et al. in [5] as well as explain and critique a well-known proof by Brassard and Savail in [3]. This will be supplemented with calculations that substantiate Brassard’s assumptions, and simulations of our own, to compare the protocols’ efficiencies.

This is a non-technical summary of a paper [1] written for the University of Chicago REU 2013, available at http://math.uchicago.edu/∼may/REU2013/. This paper fully explains the protocols BINARY and CASCADE and shows the comparable efficiency of the latter with another variant that might seem like an optimization to it. In [1] we also present detailed workings of [2] from QCRYPT 2013 and [3], and propose extensions to both of these, with regards to Secret-Key Reconcilation protocols for Quantum-Key Distribution. The key contribution in this is that we were able to clarify the accuracy of the bound in [3], which we present below.

While block cipher design is relatively mature, advances in computational power mean that the keylength of block ciphers, upon which the security relies entirely, becomes less resistant to cryptanalysis over time. Therefore, the security for a block cipher with a particular keylength typically is seen to last for at most some decades. One common approach to strengthen a block cipher's security is based on increasing its keylength. In the literature, two strategies have emerged: multiple keyed multiple encryption and multiple keyed XOR sandwiching. Known attacks on these such as Meet-in-the-Middle(Merkle and Hellman, 1981; van Oorschot and Wiener, 1991; Lucks, 1998) and Related-Key (J. Kelsey and Wagner, 1996; Choi et al., 1996; Vaudenay, 2011; Phan, 2004) attacks, show that Triple Encryption is significantly weaker than a brute-force attack would suggest, especially for block ciphers with small keys, such as the Data Encryption Standard (DES). This paper provides a comprehensive analysis on the security of the XOR sandwiching paradigm against known attacks for the case of multiple keyed triple encryption, without loss of generality, using DES as the underlying block cipher. In particular, we focus on DES-XEXEXEX variants, based on 2-Key and 3-Key Triple-DES, which involve performing the XOR for key-whitening before and after each encryption with an additional 64-bit key. One of the conclusions to be drawn from this work is the increased strength obtained from the XOR sandwiching paradigm while requiring little in terms of additional computational resources.

This Paper is eligible for the student paper award. Information Reconciliation (IR) protocols, which achieve error correction of shared secrets by public discussion, is an important process in Quantum Key Distribution (QKD). We provide an analysis of Brassard’s BINARY and CASCADE IR protocols, two protocols commonly used in QKD. Using generating functions, we give an accurate result on BINARY. We derive the error probability distribution at each pass, which allows us to compute the decoding error probability and the number of “leaked” bits; two quantities crucial in the proof of security for QKD. We then corroborate the probability distribution computed by our formulas with actual simulation results. Finally we show that our formulas give better estimate for the decoding error probability of BINARY than the upper bound derived by Brassard for CASCADE. Because CASCADE should have better decoding performance than BINARY, this shows that Brassard’s estimate of CASCADE may be too loose and can be improved. Our accurate formulas for BINARY can also be used as a basis on which to derive more accurate formulas for CASCADE.