I am a professor of Computer Science at the Dipartimento di Scienze Aziendali -- Management of Innovation Systems of the
Università di Salerno, Salerno, Italy.
My main research area is Theoretical Computer Science with a special focus on Cryptography.
-
Dynamic Volume-Hiding Encrypted Multi-Maps with Applications to Searchable Encryption.
PETS 23,
with Ghous Amjad, Sarvar Patel, Kevin Yeo, and Moti Yung.
[Show/Hide abstract]
We study encrypted storage schemes where a client outsources data to an untrusted third-party server (such as a cloud storage provider) while maintaining the ability to privately query and dynamically update the data. We focus on encrypted multi-maps (EMMs), a structured encryption (STE) scheme that stores pairs of label and value tuples. EMMs allow queries on labels and return the associated value tuple. As responses are variable-length, EMMs are subject to volume leakage attacks introduced by Kellaris et al. [CCS'16]. To prevent these attacks, volume-hiding EMMs were introduced by Kamara and Moataz [Eurocrypt'19] that hide the label volumes (i.e., the value tuple lengths). As our main contribution, we present the first fully dynamic volume-hiding EMMs that are both asymptotically and concretely efficient. Furthermore, they are simultaneously forward and backward private which are the de-facto standard security notions for dynamic STE schemes. Additionally, we implement our schemes to showcase their concrete efficiency. Our experimental evaluations show that our constructions are able to add dynamicity with minimal to no additional cost compared to the prior best static volume-hiding schemes of Patel et al. [CCS'19].
-
Lower Bound Framework for Differentially Private and Oblivious Data Structures.
Eurocrypt 2023, with Kevin Yeo.
[Show/Hide abstract]
In recent years, there has been significant work in studying data structures that provide privacy for the operations that are executed. These primitives aim to guarantee that observable access patterns to physical memory do not reveal substantial information about the queries and updates executed on the data structure. Multiple recent works, including Larsen and Nielsen [Crypto'18], Persiano and Yeo [Eurocrypt'19], Hubáček et al. [TCC'19] and Komargodski and Lin [Crypto'21], have shown that logarithmic overhead is required to support even basic RAM (array) operations for various privacy notions including obliviousness and differential privacy as well as different choices of sizes for RAM blocks and memory cells .
We continue along this line of work and present the first logarithmic lower bounds for differentially private RAMs (DPRAMs) that apply regardless of the sizes of blocks and cells . This is the first logarithmic lower bounds for DPRAMs when blocks are significantly smaller than cells, that is . Furthermore, we present new logarithmic lower bounds for differentially private variants of classical data structure problems including sets, predecessor (successor) and disjoint sets (union-find) for which sub-logarithmic plaintext constructions are known. All our lower bounds extend to the multiple non-colluding servers setting.
We also address an unfortunate issue with this rich line of work where the lower bound techniques are difficult to use and require customization for each new result. To make the techniques more accessible, we generalize our proofs into a framework that reduces proving logarithmic lower bounds to showing that a specific problem satisfies two simple, minimal conditions. We show our framework is easy-to-use as all the lower bounds in our paper utilize the framework and hope our framework will spur more usage of these lower bound techniques.
-
Secure Selections on Encrypted Multi-writer Streams.
ACM Transactions on Privacy and Security, v. 25, no. 1,
with Angelo Massimo Perillo and Alberto Trombetta.
[Show/Hide abstract]
Performing searches over encrypted data is a very current and active area. Several efficient solutions have been provided for the single-writer scenario in which all sensitive data originate with one party (the Data Owner) that encrypts and uploads the data to a public repository. Subsequently, the Data Owner accesses the encrypted data through a Query Processor, which has direct access to the public encrypted repository. Motivated by the recent trend in pervasive data collection, we depart from this model and consider a multi-writer scenario in which the data originate with several and mutually untrusted parties, the Data Sources. In this new scenario, the Data Owner provides public parameters so that each Data Source can add encrypted items to the public encrypted stream; moreover, the Data Owner keeps some related secret information needed to generate tokens so that different Query Sources can decrypt different subsets of the encrypted stream, as specified by corresponding access policies.
We propose security model for this problem that we call Secure Selective Stream (SSS) and give a secure construction for it based on hard problems in Pairing-Based Cryptography. The cryptographic core of our construction is a new primitive, Amortized Orthogonality Encryption, that is crucial for the efficiency of the proposed implementation for SSS.
-
Anamorphic Encryption: Private Communication against a Dictator..
Eurocrypt 2022,
with Duong Hieu Phan and Moti Yung.
[Show/Hide abstract]
Cryptosystems have been developed over the years under the typical prevalent setting which assumes that the receiver’s key is kept secure from the adversary, and that the choice of the message to be sent is freely performed by the sender and is kept secure from the adversary as well. Under these fundamental and basic operational assumptions, modern Cryptography has flourished over the last half a century or so, with amazing achievements: New systems (including public-key Cryptography), beautiful and useful models (including security definitions such as semantic security), and new primitives (such as zero-knowledge proofs) have been developed. Furthermore, these fundamental achievements have been translated into actual working systems, and span many of the daily human activities over the Internet.
However, in recent years, there is an overgrowing pressure from many governments to allow the government itself access to keys and messages of encryption systems (under various names: escrow encryption, emergency access, communication decency acts, etc.). Numerous non-direct arguments against such policies have been raised, such as "the bad guys can utilize other encryption system" so all other cryptosystems have to be declared illegal, or that "allowing the government access is an ill-advised policy since it creates a natural weak systems security point, which may attract others (to masquerade as the government)." It has remained a fundamental open issue, though, to show directly that the above mentioned efforts by a government (called here “a dictator” for brevity) which mandate breaking of the basic operational assumption (and disallowing other cryptosystems), is, in fact, a futile exercise. This is a direct technical point which needs to be made and has not been made to date.
In this work, as a technical demonstration of the futility of the dictator’s demands, we invent the notion of “Anamorphic Encryption” which shows that even if the dictator gets the keys and the messages used in the system (before anything is sent) and no other system is allowed, there is a covert way within the context of well established public-key cryptosystems for an entity to immediately (with no latency) send piggybacked secure messages which are, in spite of the stringent dictator conditions, hidden from the dictator itself! We feel that this may be an important direct technical argument against the nature of governments’ attempts to police the use of strong cryptographic systems, and we hope to stimulate further works in this direction.
-
Limits of Preprocessing for Single-Server PIR.
SODA 22, with Kevin Yeo.
[Show/Hide abstract]
We present a lower bound for the static cryptographic data structure problem of single-server private
information retrieval (PIR). PIR considers the setting where a server holds a database of n entries and
a client wishes to privately retrieve the i-th entry without revealing the index i to the server. In our
work, we focus on PIR with preprocessing where an r-bit hint may be computed in a preprocessing stage
and stored by the server to be used to perform private queries in expected time t. We consider the
public preprocessing setting of Beimel et al. [JoC, 2004] where the hint is publicly available to everyone
including the adversary.
We prove that for any single-server computationally secure PIR with preprocessing it must be that
tr = Ω(n log n) when r = Ω(log n). If r=O(log n), we show that t = Ω(n). Our lower bound holds even
when the scheme errs with probability 1/n^2
and the adversary’s distinguishing advantage is 1/n.
Our work improves upon the tr = Ω(n) lower bound of Beimel et al. [JoC, 2004].
We prove our lower bound in a variant of the cell probe model where only accesses to the memory
are charged cost and computation and accesses to the hint are free. Our main technical contribution
is a novel use of the cell sampling technique (also known as the incompressibility technique) used to
obtain lower bounds on data structures. In previous works, this technique only leveraged the correctness
guarantees to prove lower bounds even when used for cryptographic primitives. Our work combines the
cell sampling technique with the privacy guarantees of PIR to construct a powerful, polynomial-time
adversary that is critical to proving our higher lower bounds.
-
Efficient Boolean Search over Encrypted Data with Reduced Leakage.
ASIACRYPT 21,
with Sarvar Patel, Joon Young Seo, and Kevin Yeo.
[Show/Hide abstract]
We study encrypted storage schemes where a client outsources data to an untrusted third-party server (such as a cloud storage provider) while maintaining the ability to privately query and dynamically update the stored data. We focus on encrypted multi-maps, a structured encryption (STE) scheme that stores pairs of label and value tuples that have several important applications (most notably, to searchable encryption and encrypted SQL databases). Encrypted multi-maps support queries for specific labels that return the associated value tuple. As responses are variable-length, encrypted multi-maps are subject to volume leakage attacks introduced by Kellaris et al. [CCS’16] with several follow-up works (including Grubbs et al. [CCS’18] and Lacharite et al. [SP’18]). To prevent these attacks, volume-hiding encrypted multi-maps were introduced by Kamara and Moataz [Eurocrypt’19] that hide the volume of labels (i.e., the size of the associated value tuple).
As our main contribution, we present the first fully dynamic constructions of volume-hiding encrypted multi-maps that are both asymptotically and concretely efficient. Furthermore, our constructions simultaneously provide forward and backward privacy that are the de-facto standard security notions for dynamic STE schemes (Stefanov et al. [NDSS’14] and Bost [CCS’16]). Additionally, we implement our schemes to showcase their concrete efficiency. Our experimental evaluations show that our constructions are able to add dynamicity with minimal to no additional cost compared to the prior best static volume-hiding schemes of Patel et al. [CCS’20].
-
Lower Bounds for Encrypted Multi-Maps and Searchable Encryption in the Leakage Cell Probe Mode.
CRYPTO 20,
with Sarvar Patel and Kevin Yeo.
[Show/Hide abstract]
We present strong evidence that the leakage of the global key-equality pattern is inherent for any dynamic EMM construction with O(1) efficiency.
In particular, we consider the slightly smaller leakage
where leakage of key-equality between update and query operations is
decoupled and the adversary only learns whether two operations of the
same type are performed on the same key or not.
We show that any EMM with at most decoupled key-equality pattern leakage incurs
Ω(log n) overhead in the leakage cell probe model.
This is tight as there exist ORAM-based constructions of EMMs with logarithmic slowdown that leak no more than the decoupled key-equality pattern (and actually, much less).
