5
$\begingroup$

It's interesting to see critical thinking being applied to CryptDB in contrast to all the hoopla around it here. CryptDB is not a major theoretical breakthrough but potpourri of technologies to make it work. But then: I am curious whether there has been a formal security analysis done on CryptDB. All over the web it is just being praised without seemengly any thorough analysis.

On a side note: If there is none, I would like to take it up, but I am new to security analysis, so: Is there a good reference paper for carrying out security analysis on some crypto implementation?

Improve this question
$\endgroup$

2 Answers 2

Reset to default
3
$\begingroup$

There is an article about the provided security of the CryptDB.

The simple questions that challenge the security

  1. Where is the row integrity?
  2. Where is the completeness of the query results?
  3. Where is the freshness of the data?
  4. Where is the Authentication of the data?
  5. What is the cost of the proxy-server, which performs the most heavy processes?
  6. What is the cost of all of the above when applied?
  7. How to protect the authentication key?
  8. Where is the query integrity?
  9. How to prevent the inferences leaked due to onion layers ?

and finally

Concern from a practitioner is as below

“In general, we have 25 application servers with one database server. So, you want to put our key into 25 application servers instead of one DB server?”

There is another recent paper discussing the "inferential attacks" possible using CryptDB and an informal discussion of the same could be found here.

Yet another question tries to answer this here .

Improve this answer
$\endgroup$
2
  • $\begingroup$ You should include a summary of the article (in case the link breaks) $\endgroup$
    – poncho
    Commented Feb 13, 2015 at 18:57
  • 2
    $\begingroup$ The article looks interesting, but I think your answer is strongly lacking structure and information. Why is there a list in it? Are these positive points or negatives? What's the "word from an IT developer" supposed to mean? You may well have an answer here, but please try and place yourself in our position when reading it over. $\endgroup$
    – Maarten Bodewes ♦
    Commented Feb 15, 2015 at 14:48
4
$\begingroup$

A quick glance at their most recent paper shows some security analysis. Secton 2 talks about some different threats, what guarantees they can provide, etc. Section 8.3 also evaluates the security of the system. This may or may not be what you are looking for, you'd have to decide for your self.

Improve this answer
$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.