The leakage of a scheme is formally described using a leakage profile which itself can consists of several leakage patterns. SSE constructions attempt to minimize leakage while achieving the best possible search efficiency. SSE security can be analyzed in several adversarial models but the most common are: the persistent model, where an adversary is given the encrypted data collection and a transcript of all the operations executed on the collection; the snapshot model, where an adversary is only given the encrypted data collection (but possibly after each operation). Security in the Persistent Model In the persistent model, there are SSE schemes that achieve a wide variety of leakage profiles. The most common leakage profile for static schemes that achieve single keyword search in optimal time is which reveals the number of documents in the collection, the size of each document in the collection, if and when a query was repeated and which encrypted documents match the search query. It is known, however, how to construct schemes that leak considerably less at an additional cost in search time and storage. When considering dynamic SSE schemes, the state-of-the-art constructions with optimal time search have leakage profiles that guarantee forward privacy which means that inserts cannot be correlated with past search queries. Security in the Snapshot Model In the snapshot model, efficient dynamic SSE schemes with no leakage beyond the number of documents and the size of the collection can be constructed. When using an SSE construction that is secure in the snapshot model one has to carefully consider how the scheme will be deployed because some systems might cache previous search queries. Cryptanalysis A leakage profile only describes the leakage of an SSE scheme but it says nothing about whether that leakage can be exploited or not. Cryptanalysis is therefore used to better understand the real-world security of a leakage profile. There is a wide variety of attacks working in different adversarial models, based on a variety of assumptions and attacking different leakage profiles. See also Homomorphic encryption Oblivious RAM Structured encryption Deterministic encryption References Cryptographic primitives