Hermes: I/O-Efficient Forward-Secure Searchable Symmetric Encryption

Abstract

Dynamic Symmetric Searchable Encryption (SSE) enables a user to outsource the storage of an encrypted database to an untrusted server, while retaining the ability to privately search and update the outsourced database. The performance bottleneck of SSE schemes typically comes from their I/O efficiency. Over the last decade, a line of work has substantially improved that bottleneck. However, all existing I/O-efficient SSE schemes have a common limitation: they are not forward-secure. Since the seminal work of Bost at CCS 2016, forward security has become a de facto standard in SSE. In the same article, Bost conjectures that forward security and I/O efficiency are incompatible. This explains the current status quo, where users are forced to make a difficult choice between security and efficiency.

The central contribution of this paper it to show that, contrary to what the status quo suggests, forward security and I/O efficiency can be realized simultaneously. This result is enabled by two new key techniques. First, we make use of a controlled amount of client buffering, combined with a deterministic update schedule. Second, we introduce the notion of SSE supporting dummy updates. In combination, those two techniques offer a new path to realizing forward security, which is compatible with I/O efficiency. Our new SSE scheme, $\textsf{Hermes}$, achieves sublogarithmic I/O efficiency $\widetilde{\mathcal {O}}\left( {\log \log \frac{N}{p}}\right)$, storage efficiency $\mathcal {O}\left( 1\right)$, with standard leakage, as well as backward and forward security. Practical experiments confirm that $\textsf{Hermes}$ achieves excellent performance.

M. Reichle—This work was carried out while the second author was employed by Inria, Paris.