0

We're trying to build a packet sniffer that can search and quarantine malware in encrypted transactions without decrypting said transactions.

At present, we're exploring whether homomorphic encryption schemes can help us look for patterns that match rules (which are also encrypted). We're thinking of creating an on-premise solution that acts as a proxy for an API gateway.

Since HTTPS transmission uses a padded RSA, we believe we need to use re-encryption to make the ciphertext feasible to compute on. However re-encryption requires us to have the secret key and I think sending the secret key to this proxy would be unwise. Is this a valid prognosis if we were to implement it this way? This seems like the only way to achieve what we want and I'm hoping someone here has a better idea.

See Can we proxy-re-encrypt using homomorphic encryption schemes? on Cryptography Stack Exchange.

We're also looking into the paper Practical Techniques for Searches on Encrypted Data.

Other methods have been released since the time that this paper has been published but I usually see something along the lines of homomorphic encryption or MPC. Since throughput is an important metric for us, we're less inclined to go for the MPC route but we're still open to ideas.

Is this possible? Are we headed in the right direction?

Improve this question
3
  • 1
    It seems trivial to prove this impossible: if it is possible to check if the plaintext contains any pattern A (i.e. "search"), breaking the encryption would always be possible in O(n) by extending A with random bits and checking again. This would make the encryption useless
    – Jenessa
    Commented Jun 24, 2020 at 17:08
  • Last time I looked at homomorphic encryption it was too slow by several orders of magnitude to search through traffic in real time.
    – user
    Commented Jun 24, 2020 at 17:16
  • Thank you! How is traffic brokered normally? Is there a secure box where the messages are decrypted and then searched?
    – Bill Quesy
    Commented Jun 24, 2020 at 18:20

1 Answer 1

Reset to default
1

HTTPS works over TLS/SSL. The TLS/SSL uses usually RSA + AES. For RSA as well as for AES it is impossible to restore the pre-image, simply said, based on the encrypted message it is impossible to get any information about the contents of the original message, of course except of rough message size.

The paper you refer suggests a new encryption scheme. You could consider using it, if you had plain / unencrypted messages. But the messages are already encrypted with RSA + AES and there is no way to know the original message.

The same with homomorphic encryption. You could consider using it, if the plain messages were encrypted by some homomorphic scheme. But the traffic is already encrypted with RSA + AES and there is no way to know the original message.

Improve this answer
1
  • Yeah I figured this would be an issue but I was hoping that re-encryption would allow me to circumvent this if I had the secret key and still keep everything encrypted, albeit with a different scheme this time
    – Bill Quesy
    Commented Jun 24, 2020 at 18:49

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .