Cryptographic Treatment of CryptDB's Adjustable Join

In this document, we provide a cryptographic treatment of the adjustable join protocol from CryptDB [5]. We also discuss how our scheme could be used outside of CryptDB because it provides a simple functionality that may be needed in other settings. Intuitively, it is a pseudorandom permutation where an external party not knowing the secret key can nonetheless adjust a ciphertext under one key to a ciphertext under a different key, given an adjustment token from a party that knows the secret key. We assume the reader is familiar with basic cryptographic and elliptic curve notions (e.g., computational indistinguishability, elliptic curve groups, pseudorandom permutation ensembles). These notions are explained in [2], [3] and [4].