On the average cost of order-preserving encryption based on hypergeometric distribution

Abstract

Order-preserving encryption (OPE) is a deterministic encryption scheme whose encryption function preserves numerical ordering of the plaintexts. The first provably-secure OPE scheme was constructed by Boldyreva, Chenette, Lee, and OʼNeill. The BCLO scheme is based on a sampling algorithm for the hypergeometric distribution and is known to call the sampling algorithm at most 5 log M + 12 times on average where M is the size of the plaintext-space. We show that the BCLO scheme actually calls the sampling algorithm less than log M + 3 times on average.