Introduction to the application of other symmetric cipher types

---

The mainstream symmetric encryption types are: DES, AES...., some other types are introduced below.

Searchable encryption

Requirement background:
Nowadays, the issue of privacy leakage has attracted much attention. Everyone hopes that their information will be uploaded to the cloud in the form of cipher text instead of in the form of clear text.
But there will be a problem,What if you need to search encrypted data?You can't download all the encrypted data on the cloud, decrypt it one by one, and then search it. If this is the case, the efficiency will obviously be very low. Therefore, searchable encryption technology came into being.

What is searchable encryption technology?
Searchable encryption technology is a combination of search technology and encryption technology. Searchable encryption can realize special encryption of user data and then upload it to the cloud server, and can realize the function of retrieval based on keywords. Some searchable encryption schemes can even realize advanced retrieval functions such as range queries or Boolean queries. In the process of making it convenient for users to use, it also protects the privacy and security of files.

Classification:
Searchable encryption technologies are generally divided into:

• Searchable Symmetric Encryption (SSE)

• Asymmetric Searchable Encryption (ASE), Asymmetric Searchable Encryption is currently also generally called Public Key Encryption With Searching (PEKS). (Brief mention, no introduction below)

The two have different application scenarios and construction methods. Symmetric searchable encryption generally considers single-user use, which is equivalent to establishing a personal encrypted cloud disk and relying on symmetric encryption algorithms to construct the solution.

Public key searchable encryption generally considers multi-user scenarios such as email systems or multi-person file sharing systems, and mainly relies on public key encryption algorithms for construction.

step:
The symmetric searchable encryption process is simplified into the following 4 steps:

• Step 1. Establishment and key generation process: The user performs some special encryption on the file collection and uploads it to the server and generates the key and encryption database;
• Step 2. Trapdoor generation process: The user generates a specific trapdoor based on the key and the content to be retrieved, which is divided into generating a retrieval trapdoor and generating an update trapdoor, and both are uploaded to the server;
• Step 3. Retrieval process: The user submits a trapdoor, and the server performs a secure search on the encrypted database based on the trapdoor and returns the results. The user receives the ciphertext and decrypts it to obtain the final result;
• Step 4. Update process: For searchable encryption that supports dynamic updates, file addition or deletion operations can be performed by uploading encrypted files and update trapdoors to the server. Note that addition operations and deletion operations are distinguished.

Actual case:
Assume you are using an encrypted cloud storage service:

1. Upload files：

   • Document 1 contains the keyword "contract".
   • File 2 contains the keywords "contract" and "invoice".
   • You generate the encrypted index:
     \( \begin{cases} H(K, \text{"Contract"}) = \text{a1b2c3d4} \rightarrow [\text{File 1}, \text{File 2}] \\ H(K, \text{"Invoice"}) = \text{e5f6g7h8} \rightarrow [\text{File 2}] \end{cases} \)
   • Upload encrypted files and encrypted indexes to the server.

2. Search files：

   • You want to search for files containing "contract" and generate a trapdoor $ \T = H(K, \text{"contract"}) = \text{a1b2c3d4} $.
   • The server matches the encrypted index with $\T$ and findsa1b2c3d4Corresponding file list[File 1, File 2]。
   • The server returns an encryptedFile 1andFile 2。

3. Decrypt files：

   • You download an encrypted file (File 1andFile 2), use the key $\K\$ to decrypt and view the content.

format preserving encryption

definition:
Format-preserving encryption is an encryption technique that ensures that the encrypted ciphertext is identical to the original plaintextThe format is exactly the same(such as length, character type). For example, after encrypting a credit card number, the ciphertext is still a 16-digit number.

benefit:
You can ensure that encrypted data is secure while still being usable and compatible with the systems that handle it. Therefore, it is useful in scenarios where the format and length of the raw data are critical, such as databases, applications, or systems with specific data input requirements.

Core principles

• format constraints: The encryption algorithm dynamically adjusts the encryption process according to the plaintext format (such as numbers, letters, dates).
• Block encryption: After dividing the data into blocks, encrypt it in a specific mode (such as FF1, FF3 mode) to ensure that the output format is consistent.
• Key derivation: Generate intermediate keys through key and format rules to control the encryption results.

Common standards

• NIST standards: FF1 (AES-based), FF3-1 (improved version FF3), supports numbers, letters and other formats.
  example：
  • Plain text:4111 1111 1111 1111(credit card number)
  • Cipher text:3569 2354 8234 5678(Same format, but randomized values).

Application scenarios

• Payment card data encryption (PCI-DSS compliance requirement).
• Database field encryption (such as encrypting ID number and maintaining digital format).
• Log desensitization (encrypting sensitive information in logs without affecting log analysis tools).

limitation

• Security is weaker than traditional encryption (key space may be reduced due to format limitations).
• The implementation complexity is high and standards must be strictly followed (such as FF1/FF3).

Reference

/shirleyya/p/
Searchable Encryption Technology - Study Notes (1)