[m4dc4pXXX]

* How is it possible to construct all the previous "search tokens" on the server side?

* The client stores does a lot of work (storing a map of all keys, for one). Could the client get away with ONLY generating a new search token when a document is updated/inserted? That is, could the client only be responsible for creating "UTc+1 ← H1(Kw, STc+1)" and "e ← ind ⊕ H2(Kw, STc+1)" (in the update portion of "Algorithm 1")? In other words, could the map W be stored on the server, as well?

Hope these questions make sense!

[swordswinger12]

-Usually the SSE model accounts for a malicious server that just stores every search token it's given, so the server doesn't need to reconstruct them.

- You could store W on the server, but you would leak additional information to the server during an update - namely, the per-keyword update frequency. Section 5.5 describes an extension to reduce client-side storage at the cost of additional computation.