Take the 2-minute tour ×
Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It's 100% free, no registration required.

It's interesting to see critical thinking being applied to CryptDB in contrast to all the hoopla around it here. CryptDB is not a major theoretical breakthrough but potpourri of technologies to make it work. But then: I am curious whether there has been a formal security analysis done on CryptDB. All over the web it is just being praised without seemengly any thorough analysis.

On a side note: If there is none, I would like to take it up, but I am new to security analysis, so: Is there a good reference paper for carrying out security analysis on some crypto implementation?

share|improve this question

2 Answers 2

up vote 3 down vote accepted

A quick glance at their most recent paper shows some security analysis. Secton 2 talks about some different threats, what guarantees they can provide, etc. Section 8.3 also evaluates the security of the system. This may or may not be what you are looking for, you'd have to decide for your self.

share|improve this answer

There is an article about the provided security of the CryptDB.

The simple questions

  1. Where is the row integrity?
  2. Where is the completeness of the query results?
  3. Where is the freshness of the data?
  4. Where is the Authentication of the data?
  5. What is the cost of the proxy-server, which performs the most heavy processes?
  6. What is the cost of all of the above when applied?
  7. How to protect the authentication key?
  8. Where is the query integrity?

and finally

A word from an IT developer;

“In general, we have 25 application servers with one database server. So, you want to put our key into 25 application servers instead of one DB server?”

share|improve this answer
You should include a summary of the article (in case the link breaks) –  poncho Feb 13 at 18:57
The article looks interesting, but I think your answer is strongly lacking structure and information. Why is there a list in it? Are these positive points or negatives? What's the "word from an IT developer" supposed to mean? You may well have an answer here, but please try and place yourself in our position when reading it over. –  Maarten Bodewes Feb 15 at 14:48

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.