{"id":"4ef24520-1ed5-4c71-a190-c62073617d7a","arxiv_id":"2603.18836","paper_version":3,"verdict":"ACCEPT","confidence":"HIGH","novelty_score":7.0,"correctness_risk":"low","formal_verification":"none","parameter_count":3,"one_line_summary":"Crypto-free FID-to-plaintext mappings inside TEEs remove synchronous en/decryption from modern confidential-database query paths, yielding large TPC-H/TPC-C gains over HEDB.","lead":"FEDB redesigns confidential databases so the untrusted DBMS stores cheap data-independent field IDs instead of ciphertexts, mapping those IDs to plaintext only inside a TEE. That removes per-field crypto from the query hot path and cuts TPC-H latency by up to ~78× versus a state-of-the-art modern CDB while keeping DBA maintainability.","discovery_kind":"new_method","skeptic_critique":{"model":"grok-4.5","headline":"No significant objection identified","rationale":"The load-bearing conditions for the strongest claim are: (1) FIDs are plaintext-independent and collision-resistant under TEE isolation, (2) Get/Put replace en/decrypt on the critical path without breaking ACID or DBA maintainability, and (3) measured gains are not artifacts of a single platform or baseline. All three are supported by the design (§3–§5), leakage argument (§8), and multi-workload evaluation (§7). The reader correctly flags long-lived plaintext residency as the residual security assumption; I agree it is the weakest point, but it does not overturn the systems claim as scoped. No stronger internal inconsistency or missing control was found that would move the verdict from ACCEPT. The concrete TDX re-run is the highest-value remaining check given the abstract’s x86 numbers.","tokens_in":18794,"tokens_out":466,"duration_ms":4471,"concrete_test":"Re-run the TPC-H suite (SF=3, batching on/off) on an Intel TDX host with the same dual-zone layout and report end-to-end query slowdowns vs HEDB and plaintext; if the max speedup remains within ~2× of the ARM 78× figure and no new correctness failures appear, the platform-transfer claim is empirically settled.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The central claim holds under the paper’s stated threat model and evaluation. Crypto-free FID mappings correctly decouple indirection from protection (§3–§4), the dual-zone commit/WAL protocol preserves external synchrony (§5), and the TPC-C/TPC-H/microbenchmark results plus storage and recovery measurements support the reported speedups versus HEDB on ARM Secure-EL2 (§7). The reader’s side-channel residency concern is real but is the same class of residual risk already accepted for long-lived keys in modern CDBs; §8 scopes it explicitly rather than hiding it. Naming/number mismatches between abstract (ZENO, 53.1×/94.7×) and body (FEDB, 78.0×) are presentation issues, not soundness failures of the architecture.","agreement_with_reader":"agree"},"referee_report":{"model":"grok-4.5","summary":"The manuscript presents FEDB (named ZENO in the front-matter abstract), a split-architecture confidential database that replaces ciphertext-based cross-domain references with crypto-free field identifiers (FIDs). FIDs are stored in the untrusted DBMS and resolved via a TEE-resident mapping store (Put/Get) to plaintext secrets, so en/decryption leave the query critical path; encryption is deferred to asynchronous block-level protection at rest. The design inherits a dual-zone (integrity/privacy) architecture in the style of HEDB, adds temporary vs. permanent mapping partitions, locality-aligned partitioning and prefetch, and a prepare/FlushLog/commit protocol that enforces external synchrony for cross-domain ACID. Evaluation on ARM Secure-EL2 against plaintext PostgreSQL and HEDB reports up to ~1.8× TPC-C throughput, up to 78.0× lower TPC-H latency (body), large storage savings, microbenchmark sensitivity results, recovery timing, and a security argument (active integrity, FID plaintext-independence, L-security leakage profile, side-channel discussion).","tokens_in":18988,"tokens_out":913,"duration_ms":30370,"significance":"If the results hold under the stated threat model, this is a practically important systems contribution: modern maintainable CDBs are already shipping, and synchronous field-level crypto plus ciphertext expansion are the dominant adoption barriers the paper profiles. The core insight—decoupling indirection from protection, in the spirit of capabilities/handles—is clean and transferable. Strengths include a profiled motivation against HEDB, a concrete API that existing operator proxies can adopt with small changes, end-to-end TPC-C/TPC-H plus storage/recovery/ablation evidence on ARM, an explicit external-synchrony correctness criterion, and a claimed production path (open-source integration into GaussDB). These are the right artifacts for a systems security venue.","major_comments":[{"comment":"Front-matter abstract vs. body are inconsistent on load-bearing result claims. The abstract names the system ZENO and reports TPC-H speedups of up to 53.1× (ARM S-EL2) and 94.7× (x86 TDX) vs. HEDB, plus a “real-world industrial workload.” The body names FEDB, reports up to 78.0× TPC-H and 1.8× TPC-C on ARM Secure-EL2 (§7.1, Fig. 6, Fig. 5), and does not present end-to-end TPC-H/TPC-C or industrial-workload numbers on TDX—only micro-operation cycle counts in Table 4. Before acceptance, the abstract, title branding, and §7 must describe the same system and only claim platforms/workloads that are actually evaluated (or the missing experiments must be added).","section":null},{"comment":"§8 “Side-channel considerations” is the main security residual behind the performance win: the privacy zone now holds long-lived plaintext fields, not only keys. The argument that this is comparable to permanent key residency in modern CDBs, and that ARM Secure-EL2 page-table isolation (or equivalent) plus existing key-isolation mitigations suffice, is plausible but largely qualitative. For the central claim that security is preserved rather than traded, the paper should more sharply state what is and is not in scope (e.g., which digital side channels are assumed mitigated by the TEE configuration used in §7), and avoid implying multi-TEE generality beyond what isolation properties are actually required.","section":null},{"comment":"§5’s external-synchrony commit protocol (prepare → privacy-zone FlushLog as commit #1 → DBMS WAL as commit #2) is the correctness linchpin for durable FID→secret mappings. The abort path (logical delete + offline physical reclaim) and crash/GC discussion are directionally right, but the paper should state more precisely the failure model for partial FlushLog, concurrent multi-connection commits, and how orphan GC is driven without violating the invariant that every user-visible FID still maps to a valid secret. A short correctness argument or invariant list tied to Figure 4 would make this load-bearing mechanism reviewable rather than narrative-only.","section":null}],"minor_comments":[],"recommendation":"major_revision","confidential_remarks":null},"author_rebuttal":null,"desk_editor":{"model":"grok-4.5","letter":"The punchline is simple: modern split CDBs are slow because they treat ciphertexts as both pointers and protection. This paper decouples those roles with data-independent FIDs mapped to plaintext inside the privacy zone, plus partitioned mapping store, locality-aligned prefetch, and a dual-zone external-synchrony commit. That is the actual contribution, and the measurements back it.\n\nWhat is new is not the systems principle—capabilities and file descriptors already did indirection without crypto—but the concrete CDB design and the engineering that makes it work under ACID and DBA maintainability. Profiling of HEDB is honest: crypto, expansion, and I/O show up as real fractions of latency. TPC-C (~1.8×), TPC-H (up to ~78× vs HEDB with batching), storage cuts, microbenchmarks (mode/skew/memory), technique ablations, and recovery timing form a coherent empirical story on ARM Secure-EL2. The dual-zone commit (FlushLog before DBMS WAL) is the right consistency model for external synchrony. GaussDB integration is not vapor.\n\nSoft spots, in proportion: abstract vs body naming and numbers (ZENO / 53.1×–94.7× TDX vs FEDB / 78× ARM) need cleanup; full end-to-end x86 TDX is asserted more strongly in the abstract than shown in the evaluation section (cycle table only). Side-channel residency of long-lived plaintext maps is real, but the paper scopes it as comparable to long-lived keys and relies on page-table isolation—standard TEE residual risk, not a hidden flaw. Baseline is narrow (mainly HEDB), which is fair for the maintainable-CDB line but leaves full-enclave and pure-crypto systems as orthogonal. Free parameters (batch size, FID layout, partition policy) are tunable, not free-floating fudge.\n\nMath and security arguments are systems-grade, not crypto-proof-grade: FID indistinguishability from plaintext-independent allocation is fine; leakage profile is explicit. Citations cover the modern CDB line and the classic indirection literature without circularity.\n\nThis is for people building or evaluating maintainable TEE databases. Worth a serious referee. I would engage with it and expect it to survive review after fixing the abstract/body mismatch.","headline":"Solid systems fix for a real CDB bottleneck: crypto-free FID mappings beat HEDB hard on the measured path, with production GaussDB integration and only presentation/side-channel caveats.","tokens_in":19635,"tokens_out":589,"would_cite":true,"duration_ms":10127,"reading_group":"yes","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"grok-4.5","headline":"Confidential databases can replace per-field encryption on the query path with simple trusted-domain index lookups and still keep secrets out of the cloud.","keywords":["confidential databases","trusted execution environments","crypto-free mappings","field identifiers","split architecture","TPC-H","TPC-C","cross-domain consistency"],"falsifier":"Re-run the same TPC-H suite and microbenchmarks on an equivalent dual-TEE split, replace the mapping-store Get/Put path with the baseline’s field-level AES-GCM path while holding batch size, memory, and locality fixed, and check whether the reported speedups (up to ~78× on TPC-H, ~1.8× on TPC-C) and storage reductions disappear or reverse.","tokens_in":19625,"feed_emoji":"🔐","tokens_out":754,"duration_ms":6668,"temperature":0.7,"pith_summary":"Modern confidential databases keep most of the engine outside the trusted hardware and only put expression operators inside it. That split forces a decrypt-compute-encrypt round trip on every cross-domain call, plus ciphertext expansion that inflates I/O and memory. This paper argues the real work of those ciphertexts is only indirection—pointing from the untrusted database into plaintext held inside the trusted domain—and that indirection need not be cryptographic. FEDB therefore stores data-independent field identifiers in the database and resolves them with ordinary put/get operations against a mapping store of plaintext secrets that lives only inside the trusted privacy zone. Encryption is deferred to asynchronous block-level eviction for data at rest. The result, measured against a state-of-the-art baseline on TPC-C and TPC-H, is large reductions in query latency and storage while still supporting standard SQL, ACID, DBA maintainability, and the paper’s confidentiality and integrity claims. Techniques from the design have been integrated into a production cloud database.","feed_headline":"Drop crypto from the CDB critical path, keep the secrets","feed_subtitle":"Data-independent IDs replace per-field encryption, cutting TPC-H latency by up to 78× versus HEDB","key_machinery":"Crypto-free mappings: a trusted-domain mapping store that binds data-independent field identifiers (FIDs) to plaintext secrets, so the untrusted DBMS manipulates only opaque FIDs and the privacy zone replaces decrypt/encrypt with constant-time Get/Put, with temporary versus permanent partitions, locality-aligned layout, and a two-phase commit protocol that enforces external synchrony.","core_discovery":"The performance crisis of modern split-architecture confidential databases is not inherent to their security goals. By decoupling indirection from protection—using lightweight, data-independent field identifiers for cross-domain references and reserving encryption for data at rest—crypto-free mappings remove synchronous en/decryption from the critical path and cut ciphertext expansion, yielding up to 78× lower TPC-H latency and up to 1.8× higher TPC-C throughput versus HEDB while preserving functionality, maintainability, and the stated threat-model guarantees.","pith_inferences":[],"forward_implications":[],"fun_headline_variants":["Crypto-free mappings pull crypto out of CDB critical path","ZENO replaces field encryption with data-independent IDs","Confidential DBs speed up 50x+ by ditching sync crypto ops","Data-independent IDs cut TPC-H latency up to 94x vs HEDB","ZENO keeps secrets, drops crypto from query path"],"cache_read_input_tokens":16512,"weakest_assumption_plain":"Keeping plaintext secrets resident for long periods inside the trusted privacy zone does not open a meaningfully worse digital side-channel surface than the long-lived encryption keys modern confidential databases already hold, provided page-table isolation and existing key-isolation practices are in place.","fun_headline_variants_meta":{"raw":{"variants":["Crypto-free mappings pull crypto out of CDB critical path","ZENO replaces field encryption with data-independent IDs","Confidential DBs speed up 50x+ by ditching sync crypto ops","Data-independent IDs cut TPC-H latency up to 94x vs HEDB","ZENO keeps secrets, drops crypto from query path"]},"model":"grok-4.5","effort":"low","cost_usd":0.005828,"raw_usage":{"total_tokens":1528,"prompt_tokens":739,"num_sources_used":0,"completion_tokens":97,"cost_in_usd_ticks":58280000,"prompt_tokens_details":{"text_tokens":739,"audio_tokens":0,"image_tokens":0,"cached_tokens":256},"completion_tokens_details":{"audio_tokens":0,"reasoning_tokens":692,"accepted_prediction_tokens":0,"rejected_prediction_tokens":0}},"tokens_in":739,"tokens_out":97,"duration_ms":6111,"temperature":1.0,"reasoning_tokens":692,"cache_read_input_tokens":256,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-07-13T22:22:08.749850+00:00","model_set":{"reader":"grok-4.5"},"falsifier":"Re-run the same TPC-H suite and microbenchmarks on an equivalent dual-TEE split, replace the mapping-store Get/Put path with the baseline’s field-level AES-GCM path while holding batch size, memory, and locality fixed, and check whether the reported speedups (up to ~78× on TPC-H, ~1.8× on TPC-C) and storage reductions disappear or reverse.","supporting_citations":[],"review_version":1}