Demo Data from EDBT 2026 / reviewers in the wild / expert
Mathew Hogan
dblp:352/6815
· DBLP profile ↗
1ranked-venue papers
1as first author
1since 2021 · last 2023
—ORCID · none
Domains — the database's venue-derived domains; a paper can count in several
Security and privacy · 1 · 1 first-author · 1 since 2021
Expertise — from the expertise taxonomy: the topics of the expert's papers under the CCF categories. A weight counts papers with recency: 1 for a paper about the topic, 0.3 when the topic is its context, halved every five years.
| Network and information security
1 paper |
Hardware security and side channels · 100% | |
| Computer architecture, parallel and distributed computing, and storage systems
1 paper |
Storage systems · 100% |
Topics — the 2 heaviest of 2, each with the papers that count most for it
| Topic | Weight | Papers | Last | Evidence papers |
|---|---|---|---|---|
Hardware security and side channels
side-channel attack |
0.7 | 1 | 2023 | DBREACH: Stealing from Databases Using Compression Side Channels · SP 2023 |
Storage systems › secure storage
encrypted database |
0.7 | 1 | 2023 | DBREACH: Stealing from Databases Using Compression Side Channels · SP 2023 |
Methods — techniques the papers use, named apart from their topics
attack heuristics · 1.3
| Year | Publication | Venue | Position |
|---|---|---|---|
| 2023 | DBREACH: Stealing from Databases Using Compression Side ChannelsabstractWe introduce new compression side-channel attacks against database storage engines that simultaneously support compression of database pages and encryption at rest. Given only limited, indirect access to an encrypted and compressed database table, our attacks extract arbitrary plaintext with high accuracy. We demonstrate accurate and performant attacks on the InnoDB storage engine variants found in MariaDB and MySQL as well as the WiredTiger storage engine for MongoDB.Our attacks overcome obstacles unique to the database setting that render previous techniques developed to attack TLS ineffective. Unlike the web setting, where the exact length of a compressed and encrypted message can be observed, we make use of only approximate ciphertext size information gleaned from file sizes on disk. We amplify this noisy signal and combine it with new attack heuristics tailored to the database setting to extract secret plaintext. Our attacks can detect whether a random string appears in a table with > 90% accuracy and extract 10-character random strings from encrypted tables with > 95% success. Mathew Hogan, Yan Michalevsky, Saba Eskandarian |
SP | 1 |