Henry Corrigan-Gibbs Dmitry Kogan EPFL & MIT Stanford - - PowerPoint PPT Presentation

β–Ά
henry corrigan gibbs dmitry kogan
SMART_READER_LITE
LIVE PREVIEW

Henry Corrigan-Gibbs Dmitry Kogan EPFL & MIT Stanford - - PowerPoint PPT Presentation

Oct 07, 2023 264 likes β€’541 views

Henry Corrigan-Gibbs Dmitry Kogan EPFL & MIT Stanford Eurocrypt 2020 PIR schemes with linear-time offline phase, sublinear-time online lookups, no additional storage on the server. Results preview communication &

slide-1
SLIDE 1

Eurocrypt 2020

Henry Corrigan-Gibbs

EPFL & MIT

Dmitry Kogan

Stanford

slide-2
SLIDE 2

PIR schemes with

  • linear-time offline phase,
  • sublinear-time online lookups,
  • no additional storage on the server.

2

Results preview Two servers: π‘œ communication & online time from PRG Single server: π‘œ2/3 communication & online time from DCR

slide-3
SLIDE 3

Background The offline/online model Our results 2-server scheme From two servers to one Conclusion & open problems

3

slide-4
SLIDE 4

[CGKS95]

Goal Read a record from a DB without DB learning which record you read. Extensions larger records, key-value DBs [CGN98] Applications medical encyclopedia, stocks private messaging, search, DNS

4

Index 𝑗 ∈ [π‘œ] Database 𝑦 ∈ 0,1 π‘œ 𝑦𝑗 ∈ {0,1}

π‘œ = {1, … , π‘œ}

slide-5
SLIDE 5

Correctness Client learns its bit of interest (with overwhelming prob.) Security (Malicious) server β€œlearns nothing” about client’s desired bit For all databases 𝑦 ∈ 0,1 π‘œ, for all 𝑗, π‘˜ ∈ [π‘œ],

View of server when client reads bit 𝑗 β‰ˆπ‘‘ View of server when client reads bit π‘˜

5

slide-6
SLIDE 6

Correctness Client learns its bit of interest (with overwhelming prob.) Security (Malicious) server β€œlearns nothing” about client’s desired bit Minimize communication

6

slide-7
SLIDE 7

Multi-server PIR [CGKS95]

  • Replicate DB on non-colluding servers
  • State of the art (following [Amb97,CG97,BIO,BIKR02,Yek08,Efr12,…]):
  • Information-theoretic security: π‘œπ‘(1) communication [DG16]
  • Computational security: 𝑃(log π‘œ) communication [GI14, BGI15]

Single-server PIR [KO97]

  • Requires cryptographic assumptions
  • State of the art:
  • polylog π‘œ communication [CMS99, Lip05,…]

7

slide-8
SLIDE 8

Server linearly scans the entire DB to respond to a query β‡’a barrier to deployment Server must do 𝛁(𝒐) work to respond to a query [BIM04]

  • Intuition: If server doesn’t touch bit 𝑗, client isn’t reading bit 𝑗
  • Holds even if you have many non-colluding servers
  • Holds irrespective of cryptographic assumptions

8

slide-9
SLIDE 9
  • Encode the DB: PIR with preprocessing [BIM04]
  • Advantage: significant decrease in server time
  • Disadvantage: significant increase in server storage
  • 1-server: DEPIR [BIPW17, CHR17], PANDA [HOWW18]
  • Amortize cost: Batch PIR [IKOS04, IKOS06, LG15, Hen16, ACLS18]
  • Reduce individual server’s work: PIR with sharded DB [DHS14]
  • Relax the privacy guarantee: PIR with differential privacy [TDG16]
  • Move public-key operations to an offline phase:

Private Stateful Information Retrieval [PPY18]

9

slide-10
SLIDE 10

Background The offline/online model Our results 2-server scheme From two servers to one Conclusion & open problems

10

slide-11
SLIDE 11

11

𝑃(π‘œ) time

Hint

𝑦 ∈ 0,1 π‘œ 𝑦 ∈ 0,1 π‘œ

LEFT RIGHT

  • The left server runs in linear time.
  • But work happens before client

decides which bit to read.

β‰ˆ π‘œ bits

slide-12
SLIDE 12

12

Hint Client stores hint

𝑦 ∈ 0,1 π‘œ 𝑦 ∈ 0,1 π‘œ

LEFT RIGHT

slide-13
SLIDE 13

13

𝑝(π‘œ) time

Index 𝑗 ∈ [π‘œ] 𝑦𝑗 ∈ {0,1} Sublinear online time

𝑦 ∈ 0,1 π‘œ 𝑦 ∈ 0,1 π‘œ

LEFT RIGHT

Hint

𝑦𝑗

[DIO01, BIM04, BLW17, PPY18]

slide-14
SLIDE 14

Two-server scheme

  • π‘œ communication and online time (from any PRG)
  • Can reuse a single offline interaction for many online queries

Single-server scheme

  • π‘œ2/3 communication and online time (from DDH, DCR,…)
  • π‘œ from FHE
  • No public-key operations in the online phase

Lower bound

  • For offline/online schemes that store DB in its original form
  • Communication 𝐷 and online time π‘ˆ must be 𝐷 β‹… π‘ˆ β‰₯ π‘œ

up to poly πœ‡, log π‘œ factors for length-π‘œ DB and sec. parameter πœ‡ Our π‘œ schemes achieve

  • ptimal comm–online time

tradeoff

14

slide-15
SLIDE 15

15

Background The offline/online model Our results 2-server scheme From two servers to one Conclusion & open problems

slide-16
SLIDE 16

16

𝑦 ∈ 0,1 π‘œ Random subsets 𝑇1, … , 𝑇𝑛 βŠ‚ [π‘œ] each of size 𝑇

π‘˜ =

π‘œ

Use pseudorandomness to compress to π‘ƒπœ‡ 1

Computes β„Ž1, … , β„Žπ‘› ∈ {0,1} β„Žπ‘˜ = ෍

β„“βˆˆπ‘‡π‘˜

𝑦ℓ mod 2 S1, β„Ž1, … , 𝑇𝑛, β„Žπ‘›

LEFT

𝑦 ∈ 0,1 π‘œ

RIGHT

slide-17
SLIDE 17

LEFT

17

Index 𝑗 ∈ [π‘œ] 𝑦𝑗 = β„Žπ‘˜ + 𝑏 mod 2 S1, β„Ž1, … , 𝑇

π‘˜, β„Žπ‘˜, … , 𝑇𝑛, β„Žπ‘›

𝑏 = ෍

β„“βˆˆπ‘»β€²π‘¦β„“ mod 2

𝑦 ∈ 0,1 π‘œ

RIGHT

If 𝑗 βˆ‰ π‘»πŸ βˆͺ β‹― βˆͺ 𝑻𝒏 , output β€œfail” Else, 𝑗 ∈ π‘»π’Œ,

  • With prob

π‘œβˆ’1 π‘œ

, send a random set 𝑻′ containing 𝑗 and output β€œfail”

  • Else, send β€œpunctured set” 𝑻′ = π‘»π’Œ βˆ– {𝑗}

Ξ£β„“βˆˆπ‘‡π‘˜π‘¦β„“ Ξ£β„“βˆˆπ‘‡π‘˜βˆ–{𝑗}𝑦ℓ

𝑦𝑗

slide-18
SLIDE 18

LEFT

18

Index 𝑗 ∈ [π‘œ] 𝑦𝑗 = β„Žπ‘˜ + 𝑏 mod 2 S1, β„Ž1, … , 𝑇

π‘˜, β„Žπ‘˜, … , 𝑇𝑛, β„Žπ‘›

𝑏 = ෍

β„“βˆˆπ‘»β€²π‘¦β„“ mod 2

𝑦 ∈ 0,1 π‘œ

RIGHT

If 𝑗 βˆ‰ π‘»πŸ βˆͺ β‹― βˆͺ 𝑻𝒏 , output β€œfail” Else, 𝑗 ∈ π‘»π’Œ,

  • With prob

π‘œβˆ’1 π‘œ

, send a random set 𝑻′ containing 𝑗 and output β€œfail”

  • Else, send 𝑻′ = π‘»π’Œ βˆ– {𝑗}

Choose 𝑛 β‰ˆ π‘œ β‹… log π‘œ Then:

  • Pr Fail1 ≀ negl π‘œ

(π‘œ log2 π‘œ balls into π‘œ bins)

  • Pr Fail2 ≀ 1/ π‘œ

Repeat all πœ‡ times to drive down failure prob.

slide-19
SLIDE 19

19

RIGHT 𝑦 ∈ 0,1 π‘œ

𝑦 ∈ 0,1 π‘œ

LEFT

slide-20
SLIDE 20

20

LEFT RIGHT

𝑦 ∈ 0,1 π‘œ

  • With prob

π‘œβˆ’1 π‘œ

, send a random set 𝑻′ containing 𝑗, output β€œfail”

  • Else, send set 𝑻′ = π‘»π’Œ βˆ– {𝑗}

uniformly random size- π‘œ βˆ’ 1 subset of [π‘œ]

w.p. π‘ž =

π‘œβˆ’1 π‘œ

w.p. 1 βˆ’ π‘ž

random set containing 𝑗 random set without 𝑗

slide-21
SLIDE 21

21

LEFT RIGHT LEFT

𝑏

𝑻′ ΰ·¨ 𝑃( π‘œ) bits ΰ·¨ 𝑃( π‘œ) bits ΰ·¨ 𝑃(π‘œ) time ΰ·¨ 𝑃( π‘œ) time

slide-22
SLIDE 22

22

Problem: cannot reuse 𝑇

π‘˜

Given 𝑇

π‘˜ 1and 𝑇 π‘˜ 2, server knows 𝑗1 = 𝑇 π‘˜ 2 βˆ– 𝑇 π‘˜ 1

RIGHT

S1, β„Ž1, … , π‘‡π‘˜ , β„Žπ‘˜, … , 𝑇𝑛, β„Žπ‘› S1, β„Ž1, … , π‘‡π‘˜ , β„Žπ‘˜, … , 𝑇𝑛, β„Žπ‘› S1, β„Ž1, … , π‘‡π‘œπ‘“π‘₯, , … , 𝑇𝑛, β„Žπ‘› S1, β„Ž1, … , π‘‡π‘œπ‘“π‘₯, β„Žπ‘œπ‘“π‘₯, … , 𝑇𝑛, β„Žπ‘›

LEFT

Idea: sample replacement set π‘‡π‘œπ‘“π‘₯ fetch its parity β„Žπ‘œπ‘“π‘₯ from left server Preserving joint distribution of {𝑇

π‘˜} and

privacy from left server requires care

(see paper)

Goal: amortize cost of offline phase

Linear time

Runs in 𝒐 time (vs. 𝒐 to redo offline phase)

π‘œ time

slide-23
SLIDE 23

Two-server scheme summary

  • π‘œ communication, online time, amortized total time per-query
  • Client uses π‘œ time and storage
  • Only need PRGs

Extensions (see paper)

  • Trade-off communication for online time
  • Statistical-security variant: π‘œ2/3 communication and client time
  • Reducing online communication to 𝐦𝐩𝐑 𝒐
  • Using short description of β€˜Puncturable sets’
  • Client storage and time increase to π‘œ5/6

23

slide-24
SLIDE 24

24

Background The offline/online model Our results 2-server scheme From two servers to one Conclusion & open problems

slide-25
SLIDE 25

26

Linear-time

  • ffline phase

Sublinear-time

  • nline phase

Run both offline and online phases with the same server Single server homomorphically evaluates offline query

  • Option 1: Fully HE
  • π‘œ communication and online time
  • Option 2: Additively HE
  • π‘œ2/3 communication and online time

Security only holds if server does not see both offline and online queries

slide-26
SLIDE 26

PIR with sublinear online time and no additional server storage 2-server:

  • Offline: ΰ·¨

π‘ƒπœ‡( π‘œ) communication, linear time

  • Online: Oπœ‡ log π‘œ communication, ΰ·¨

π‘ƒπœ‡( π‘œ) server time, ΰ·¨ π‘ƒπœ‡ π‘œ5/6 client time

1-server: ΰ·¨

π‘ƒπœ‡(π‘œ2/3) communication & online time ( ΰ·¨ π‘ƒπœ‡( π‘œ) with FHE)

Matching communication-online time lower bound (see paper)

  • Reduction from Yao’s box problem

Open problems

dkogan@cs.stanford.edu henrycg@csail.mit.edu eprint 2019/1075

Open problem: reduce client work Open problem: amortize between clients

30