  Effective query recovery attacks against Searchable Symmetric Encryption
(SSE) schemes typically rely on auxiliary ground-truth information about the
queries or dataset. Query recovery is also possible under the weaker
statistical auxiliary information assumption, although statistical-based
attacks achieve lower accuracy and are not considered a serious threat. In this
work we present IHOP, a statistical-based query recovery attack that formulates
query recovery as a quadratic optimization problem and reaches a solution by
iterating over linear assignment problems. We perform an extensive evaluation
with five real datasets, and show that IHOP outperforms all other
statistical-based query recovery attacks under different parameter and leakage
configurations, including the case where the client uses some access-pattern
obfuscation defenses. In some cases, our attack achieves almost perfect query
recovery accuracy. Finally, we use IHOP in a frequency-only leakage setting
where the client's queries are correlated, and show that our attack can exploit
query dependencies even when PANCAKE, a recent frequency-hiding defense by
Grubbs et al., is applied. Our findings indicate that statistical query
recovery attacks pose a severe threat to privacy-preserving SSE schemes.
