Tight Tradeoffs in Searchable Symmetric Encryption

Gilad Asharov, Gil Segev, Ido Shahaf*

*Corresponding author for this work

Research output: Contribution to journalArticlepeer-review

13 Scopus citations


A searchable symmetric encryption (SSE) scheme enables a client to store data on an untrusted server while supporting keyword searches in a secure manner. Recent experiments have indicated that the practical relevance of such schemes heavily relies on the tradeoff between their space overhead, locality (the number of non-contiguous memory locations that the server accesses with each query), and read efficiency (the ratio between the number of bits the server reads with each query and the actual size of the answer). These experiments motivated Cash and Tessaro (EUROCRYPT ’14) and Asharov et al. (STOC ’16) to construct SSE schemes offering various such tradeoffs and to prove lower bounds for natural SSE frameworks. Unfortunately, the best-possible tradeoff has not been identified, and there are substantial gaps between the existing schemes and lower bounds, indicating that a better understanding of SSE is needed. We establish tight bounds on the tradeoff between the space overhead, locality and read efficiency of SSE schemes within two general frameworks that capture the memory access pattern underlying all existing schemes. First, we introduce the “pad-and-split” framework, refining that of Cash and Tessaro while still capturing the same existing schemes. Within our framework we significantly strengthen their lower bound, proving that any scheme with locality L must use space Ω (Nlog N/ log L) for databases of size N. This is a tight lower bound, matching the tradeoff provided by the scheme of Demertzis and Papamanthou (SIGMOD ’17) which is captured by our pad-and-split framework. Then, within the “statistical-independence” framework of Asharov et al. we show that their lower bound is essentially tight: We construct a scheme whose tradeoff matches their lower bound within an additive O(log log log N) factor in its read efficiency, once again improving upon the existing schemes. Our scheme offers optimal space and locality, and nearly optimal read efficiency that depends on the frequency of the queried keywords: For a keyword that is associated with n= N1-ϵ(n) document identifiers, the read efficiency is ω(1) · ϵ(n) - 1+ O(log log log N) when retrieving its identifiers (where the ω(1) term may be arbitrarily small, and ω(1) · ϵ(n) - 1 is the lower bound proved by Asharov et al.). In particular, for any keyword that is associated with at most N1-1/o(logloglogN) document identifiers (i.e., for any keyword that is not exceptionally common), we provide read efficiency O(log log log N) when retrieving its identifiers.

Original languageAmerican English
Article number9
Pages (from-to)1-37
Number of pages37
JournalJournal of Cryptology
Issue number2
StatePublished - Apr 2021

Bibliographical note

Funding Information:
Gilad Asharov: Most of the work was done while at Cornell Tech, supported by a Junior Fellow award from the Simons Foundation

Funding Information:
Gil Segev: Supported by the European Union’s Horizon 2020 Framework Program (H2020) via an ERC Grant (Grant No. 714253), by the Israel Science Foundation (Grant No. 483/13), by the Israeli Centers of Research Excellence (I-CORE) Program (Center No. 4/11), and by the US-Israel Binational Science Foundation (Grant No. 2014632)

Funding Information:
Ido Shahaf: Supported by the Clore Israel Foundation via the Clore Scholars Programme.

Publisher Copyright:
© 2021, International Association for Cryptologic Research.


  • Balls and bins
  • Locality
  • Searchable symmetric encryption


Dive into the research topics of 'Tight Tradeoffs in Searchable Symmetric Encryption'. Together they form a unique fingerprint.

Cite this