Security analysis on a public-key inverted-index keyword search scheme with designated tester

Gao et al. (IEEE Internet of Things Journal, 2024) proposed a public-key inverted-index keyword search scheme with a designated tester as an extension of public-key encryption with keyword search (PEKS). In their scheme, the server (acting as the tester) holds a secret key and uses it to execute the search algorithm under the designated tester setting. They proved that no information about the keyword is revealed from trapdoors under the decisional Diffie-Hellman (DDH) assumption. However, their construction employs a symmetric pairing, which can effectively serve as a DDH solver. Consequently, the underlying complexity assumption does not hold, and it is expected that keyword information can be extracted from trapdoors. In this paper, we present two keyword guessing attacks against the Gao et al. scheme that reveal keyword information from a trapdoor. The first attack succeeds using only the server’s secret key and the challenge trapdoor, without requiring any additional encryption or trapdoor queries. We note that, in their security model, an adversary is not allowed to obtain the server’s secret key; therefore, our attack lies outside their defined model. Nevertheless, we discuss the role of the server and argue that our attack scenario is reasonable. The second attack does not rely on the server’s secret key but instead exploits the linkability of two trapdoors. In both attacks, the computational complexity is limited to two pairing operations, making them practical in terms of computational cost.