[PPT] - On Basing Private Information Retrieval on NP-Hardness Tianren Liu 1 PowerPoint Presentation

SLIDE 1

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

On Basing Private Information Retrieval on NP-Hardness

Tianren Liu1 Vinod Vaikuntanathan1

1MIT

liutr@mit.edu, vinodv@csail.mit.edu

Thirteenth IACR Theory of Cryptography Conference

Tianren, Vinod (MIT) Basing PIR on NP-Hardness TCC 2016-A 1 / 14

SLIDE 2

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Assumptions and Primitives in Cryptography

NP ⊈ BPP Avg-NP ⊈ BPP OWF CRHF Pub-key Enc OWP Trapdoor Permutation PIR Add-Homomorphic Enc

Tianren, Vinod (MIT) Basing PIR on NP-Hardness TCC 2016-A 2 / 14

SLIDE 3

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Assumptions and Primitives in Cryptography

NP ⊈ BPP Avg-NP ⊈ BPP OWF CRHF Pub-key Enc OWP Trapdoor Permutation PIR Add-Homomorphic Enc Can we prove the security of a cryptographic primitive from the minimal assumption NP ⊈ BPP? (Brassard 1979)

Tianren, Vinod (MIT) Basing PIR on NP-Hardness TCC 2016-A 2 / 14

SLIDE 4

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

(Black-box) Security Proofs

To prove the security of X based on NP ⊈ BPP, find a (p.p.t.) reduction R s.t. for any oracle A that “breaks the security of X”, RA solves SAT R

Tianren, Vinod (MIT) Basing PIR on NP-Hardness TCC 2016-A 3 / 14

SLIDE 5

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

(Black-box) Security Proofs

To prove the security of X based on NP ⊈ BPP, find a (p.p.t.) reduction R s.t. for any oracle A that “breaks the security of X”, RA solves SAT R A

Tianren, Vinod (MIT) Basing PIR on NP-Hardness TCC 2016-A 3 / 14

SLIDE 6

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

(Black-box) Security Proofs

To prove the security of X based on NP ⊈ BPP, find a (p.p.t.) reduction R s.t. for any oracle A that “breaks the security of X”, RA solves SAT R A ( x ) { accepts w.p. ≥ 2/3, if x ∈ SAT accepts w.p. ≤ 1/3, if x / ∈ SAT

Tianren, Vinod (MIT) Basing PIR on NP-Hardness TCC 2016-A 3 / 14

SLIDE 7

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

(Black-box) Security Proofs

To prove the security of X based on NP ⊈ BPP, find a (p.p.t.) reduction R s.t. for any oracle A that “breaks the security of X”, RA solves SAT R A ( x ) { accepts w.p. ≥ 2/3, if x ∈ SAT accepts w.p. ≤ 1/3, if x / ∈ SAT Note: Black-box security proof but allow arbitrary construction.

Tianren, Vinod (MIT) Basing PIR on NP-Hardness TCC 2016-A 3 / 14

SLIDE 8

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Impossibility Results

NP ⊈ BPP Avg-NP ⊈ BPP OWF CRHF Pub-key Enc OWP Trapdoor Permutation PIR Add-Homomorphic Enc No known cryptographic scheme based on NP ⊈ BPP. Several negative results* (Brassard

1979, . . . )

Tianren, Vinod (MIT) Basing PIR on NP-Hardness TCC 2016-A 4 / 14

SLIDE 9

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Impossibility Results

NP ⊈ BPP Avg-NP ⊈ BPP OWF CRHF Pub-key Enc OWP Trapdoor Permutation PIR Add-Homomorphic Enc One-way Permutations

(Brassard 1979)

Tianren, Vinod (MIT) Basing PIR on NP-Hardness TCC 2016-A 4 / 14

SLIDE 10

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Impossibility Results (restricting the primitives)

NP ⊈ BPP Avg-NP ⊈ BPP OWF CRHF Pub-key Enc OWP Trapdoor Permutation PIR Add-Homomorphic Enc Homomorphic Encryption∗

(Bogdanov-Lee 2013)

One-way Functions∗

(Akavia-Goldreich-Goldwasser- Moshkovitz 2006, Bogdanov-Brzuska 2014)

Tianren, Vinod (MIT) Basing PIR on NP-Hardness TCC 2016-A 4 / 14

SLIDE 11

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Impossibility Results (restricting the reductions)

NP ⊈ BPP Avg-NP ⊈ BPP OWF CRHF Pub-key Enc OWP Trapdoor Permutation PIR Add-Homomorphic Enc Public-key Encryption Scheme, via “smart” reduction

(Goldreich-Goldwasser 1998)

Collision-resistant Hash Functions, via constant-adaptive reduction

(Haitner-Mahmoody-Xiao 2009)

Average-case NP, via non-adaptive reduction

(Bogdanov-Trevisan 2006)

Tianren, Vinod (MIT) Basing PIR on NP-Hardness TCC 2016-A 4 / 14

SLIDE 12

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Our Result: Private Information Retrieval [CGKS95, KO97]

NP ⊈ BPP Avg-NP ⊈ BPP OWF CRHF Pub-key Enc OWP Trapdoor Permutation PIR Add-Homomorphic Enc

Theorem (Informal)

Let Π be a single-server

ne-round PIR scheme.

Security of Π can not be based on NP-hardness unless polynomial hierarchy collapses.

Tianren, Vinod (MIT) Basing PIR on NP-Hardness TCC 2016-A 5 / 14

SLIDE 13

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Our Result: Private Information Retrieval [CGKS95, KO97]

NP ⊈ BPP Avg-NP ⊈ BPP OWF CRHF Pub-key Enc OWP Trapdoor Permutation PIR Add-Homomorphic Enc Rule out approximately correct PIR. Rule out PIR with communication complexity n − o(n).

Theorem (Informal)

Let Π be a single-server

ne-round PIR scheme.

Security of Π can not be based on NP-hardness unless polynomial hierarchy collapses.

Tianren, Vinod (MIT) Basing PIR on NP-Hardness TCC 2016-A 5 / 14

SLIDE 14

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Proof Overview

Lemma 1 (Single-server one-round) PIR can be broken with an SZK

racle

Lemma 2 Language L ∈ BPPSZK = ⇒ L ∈ AM ∩ coAM

(Mahmoody & Xiao, 2010)

Thus: if there is a reduction from SAT to breaking PIR, then SAT ∈ AM ∩ coAM. Lemma 3 NP ̸⊆ coAM unless polynomial hierarchy collapses

(Boppana, H˚ astad & Zachos, 1987)

Thus: if there is a reduction from SAT to breaking PIR, then polynomial hierarchy collapses.

Tianren, Vinod (MIT) Basing PIR on NP-Hardness TCC 2016-A 6 / 14

SLIDE 15

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Proof Overview

Lemma 1 (Single-server one-round) PIR can be broken with an SZK

racle

Lemma 2 Language L ∈ BPPSZK = ⇒ L ∈ AM ∩ coAM

(Mahmoody & Xiao, 2010)

Thus: if there is a reduction from SAT to breaking PIR, then SAT ∈ AM ∩ coAM. Lemma 3 NP ̸⊆ coAM unless polynomial hierarchy collapses

(Boppana, H˚ astad & Zachos, 1987)

Thus: if there is a reduction from SAT to breaking PIR, then polynomial hierarchy collapses.

Tianren, Vinod (MIT) Basing PIR on NP-Hardness TCC 2016-A 6 / 14

SLIDE 16

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Proof Overview

Lemma 1 (Single-server one-round) PIR can be broken with an SZK

racle

Lemma 2 Language L ∈ BPPSZK = ⇒ L ∈ AM ∩ coAM

(Mahmoody & Xiao, 2010)

Thus: if there is a reduction from SAT to breaking PIR, then SAT ∈ AM ∩ coAM. Lemma 3 NP ̸⊆ coAM unless polynomial hierarchy collapses

(Boppana, H˚ astad & Zachos, 1987)

Thus: if there is a reduction from SAT to breaking PIR, then polynomial hierarchy collapses.

Tianren, Vinod (MIT) Basing PIR on NP-Hardness TCC 2016-A 6 / 14

SLIDE 17

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Proof Overview

Lemma 1 (Single-server one-round) PIR can be broken with an SZK

racle

Lemma 2 Language L ∈ BPPSZK = ⇒ L ∈ AM ∩ coAM

(Mahmoody & Xiao, 2010)

Thus: if there is a reduction from SAT to breaking PIR, then SAT ∈ AM ∩ coAM. Lemma 3 NP ̸⊆ coAM unless polynomial hierarchy collapses

(Boppana, H˚ astad & Zachos, 1987)

Thus: if there is a reduction from SAT to breaking PIR, then polynomial hierarchy collapses.

Tianren, Vinod (MIT) Basing PIR on NP-Hardness TCC 2016-A 6 / 14

SLIDE 18

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Proof Overview

Lemma 1 (Single-server one-round) PIR can be broken with an SZK

racle

Lemma 2 Language L ∈ BPPSZK = ⇒ L ∈ AM ∩ coAM

(Mahmoody & Xiao, 2010)

Thus: if there is a reduction from SAT to breaking PIR, then SAT ∈ AM ∩ coAM. Lemma 3 NP ̸⊆ coAM unless polynomial hierarchy collapses

(Boppana, H˚ astad & Zachos, 1987)

Thus: if there is a reduction from SAT to breaking PIR, then polynomial hierarchy collapses.

Tianren, Vinod (MIT) Basing PIR on NP-Hardness TCC 2016-A 6 / 14

SLIDE 19

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Proof Overview

Lemma 1 (Single-server one-round) PIR can be broken with an SZK

racle

Lemma 2 Language L ∈ BPPSZK = ⇒ L ∈ AM ∩ coAM

(Mahmoody & Xiao, 2010)

Thus: if there is a reduction from SAT to breaking PIR, then SAT ∈ AM ∩ coAM. Lemma 3 NP ̸⊆ coAM unless polynomial hierarchy collapses

(Boppana, H˚ astad & Zachos, 1987)

Thus: if there is a reduction from SAT to breaking PIR, then polynomial hierarchy collapses.

Tianren, Vinod (MIT) Basing PIR on NP-Hardness TCC 2016-A 6 / 14

SLIDE 20

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Proof Overview

Lemma 1 (Single-server one-round) PIR can be broken with an SZK

racle

Lemma 2 Language L ∈ BPPSZK = ⇒ L ∈ AM ∩ coAM

(Mahmoody & Xiao, 2010)

Thus: if there is a reduction from SAT to breaking PIR, then SAT ∈ AM ∩ coAM. Lemma 3 NP ̸⊆ coAM unless polynomial hierarchy collapses

(Boppana, H˚ astad & Zachos, 1987)

Thus: if there is a reduction from SAT to breaking PIR, then polynomial hierarchy collapses.

Tianren, Vinod (MIT) Basing PIR on NP-Hardness TCC 2016-A 6 / 14

SLIDE 21

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Proof Overview

Lemma 1 (Single-server one-round) PIR can be broken with an SZK

racle

Lemma 2 Language L ∈ BPPSZK = ⇒ L ∈ AM ∩ coAM

(Mahmoody & Xiao, 2010)

Thus: if there is a reduction from SAT to breaking PIR, then SAT ∈ AM ∩ coAM. Lemma 3 NP ̸⊆ coAM unless polynomial hierarchy collapses

(Boppana, H˚ astad & Zachos, 1987)

Thus: if there is a reduction from SAT to breaking PIR, then polynomial hierarchy collapses.

Tianren, Vinod (MIT) Basing PIR on NP-Hardness TCC 2016-A 6 / 14

SLIDE 22

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Single-server One-round Private Information Retrieval

Client Index i ∈ {1, . . . , n} One Server Data x ∈ {0, 1}n

Tianren, Vinod (MIT) Basing PIR on NP-Hardness TCC 2016-A 7 / 14

SLIDE 23

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Single-server One-round Private Information Retrieval

Client Index i ∈ {1, . . . , n} Client send a query

q

− − − − − − − − → One Server Data x ∈ {0, 1}n

Tianren, Vinod (MIT) Basing PIR on NP-Hardness TCC 2016-A 7 / 14

SLIDE 24

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Single-server One-round Private Information Retrieval

Client Index i ∈ {1, . . . , n} Client send a query

q

− − − − − − − − → One Server Data x ∈ {0, 1}n

a

← − − − − − − − − Server answer

Tianren, Vinod (MIT) Basing PIR on NP-Hardness TCC 2016-A 7 / 14

SLIDE 25

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Single-server One-round Private Information Retrieval

Client Index i ∈ {1, . . . , n} Client send a query

q

− − − − − − − − → Correctness: The client learns xi One Server Data x ∈ {0, 1}n

a

← − − − − − − − − Server answer

Tianren, Vinod (MIT) Basing PIR on NP-Hardness TCC 2016-A 7 / 14

SLIDE 26

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Single-server One-round Private Information Retrieval

Client Index i ∈ {1, . . . , n} Client send a query

q

− − − − − − − − → Correctness: The client learns xi (W.p. 1 − ε.) One Server Data x ∈ {0, 1}n

a

← − − − − − − − − Server answer

Tianren, Vinod (MIT) Basing PIR on NP-Hardness TCC 2016-A 7 / 14

SLIDE 27

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Single-server One-round Private Information Retrieval

Client Index i ∈ {1, . . . , n} Client send a query

q

− − − − − − − − → Correctness: The client learns xi (W.p. 1 − ε.) One Server Data x ∈ {0, 1}n

a

← − − − − − − − − Server answer Privacy: The server learn nothing about i

Tianren, Vinod (MIT) Basing PIR on NP-Hardness TCC 2016-A 7 / 14

SLIDE 28

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Single-server One-round Private Information Retrieval

Client Index i ∈ {1, . . . , n} Client send a query

q

− − − − − − − − → Correctness: The client learns xi (W.p. 1 − ε.) One Server Data x ∈ {0, 1}n

a

← − − − − − − − − Server answer Privacy: The server learn nothing about i

An Oracle Breaking Single-server One-round PIR

Given a query q, guess the index with probability > 1/n + 1/ poly.

Tianren, Vinod (MIT) Basing PIR on NP-Hardness TCC 2016-A 7 / 14

SLIDE 29

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Break PIR with SZK oracle (Lemma 1)

Client Index i ∈ {1, . . . , n} Generate a query

q

− − − − − − − − →

Tianren, Vinod (MIT) Basing PIR on NP-Hardness TCC 2016-A 8 / 14

SLIDE 30

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Break PIR with SZK oracle (Lemma 1)

Client Index i ∈ {1, . . . , n} Generate a query

q

− − − − − − − − → Server Random x ∈ {0, 1}n

Tianren, Vinod (MIT) Basing PIR on NP-Hardness TCC 2016-A 8 / 14

SLIDE 31

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Break PIR with SZK oracle (Lemma 1)

Client Index i ∈ {1, . . . , n} Generate a query

q

− − − − − − − − → Server Random x ∈ {0, 1}n

a

← − − − − − − − − Server answers

Tianren, Vinod (MIT) Basing PIR on NP-Hardness TCC 2016-A 8 / 14

SLIDE 32

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Break PIR with SZK oracle (Lemma 1)

Client Index i ∈ {1, . . . , n} Generate a query

q

− − − − − − − − → Server Random x ∈ {0, 1}n

a

← − − − − − − − − Server answers Claim 1: I(xi; a) is big∗.

∗The randomness is from x and from the proceduce generating the answer. Tianren, Vinod (MIT) Basing PIR on NP-Hardness TCC 2016-A 8 / 14

SLIDE 33

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Break PIR with SZK oracle (Lemma 1)

Client Index i ∈ {1, . . . , n} Generate a query

q

− − − − − − − − → Server Random x ∈ {0, 1}n

a

← − − − − − − − − Server answers Claim 1: I(xi; a) is big∗. Proof: Correctness.

∗The randomness is from x and from the proceduce generating the answer. Tianren, Vinod (MIT) Basing PIR on NP-Hardness TCC 2016-A 8 / 14

SLIDE 34

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Break PIR with SZK oracle (Lemma 1)

Client Index i ∈ {1, . . . , n} Generate a query

q

− − − − − − − − → Server Random x ∈ {0, 1}n

a

← − − − − − − − − Server answers Claim 1: I(xi; a) = 1 assuming perfect correctness Proof: Correctness.

∗The randomness is from x and from the proceduce generating the answer. Tianren, Vinod (MIT) Basing PIR on NP-Hardness TCC 2016-A 8 / 14

SLIDE 35

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Break PIR with SZK oracle (Lemma 1)

Client Index i ∈ {1, . . . , n} Generate a query

q

− − − − − − − − → Server Random x ∈ {0, 1}n

a

← − − − − − − − − Server answers Claim 1: I(xi; a) = 1 assuming perfect correctness Proof: Correctness. Claim 2: ∑n

j=1 I(xj; a) ≤ H(a) ≤ |a|.

∗The randomness is from x and from the proceduce generating the answer. Tianren, Vinod (MIT) Basing PIR on NP-Hardness TCC 2016-A 8 / 14

SLIDE 36

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Break PIR with SZK oracle (Lemma 1)

Client Index i ∈ {1, . . . , n} Generate a query

q

− − − − − − − − → Server Random x ∈ {0, 1}n

a

← − − − − − − − − Server answers Claim 1: I(xi; a) = 1 assuming perfect correctness Proof: Correctness. Claim 2: ∑n

j=1 I(xj; a) ≤ H(a) ≤ |a|.

Proof: As x1, . . . , xn are independent.

∗The randomness is from x and from the proceduce generating the answer. Tianren, Vinod (MIT) Basing PIR on NP-Hardness TCC 2016-A 8 / 14

SLIDE 37

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Break PIR with SZK oracle (Lemma 1)

Client Index i ∈ {1, . . . , n} Generate a query

q

− − − − − − − − → Server Random x ∈ {0, 1}n

a

← − − − − − − − − Server answers Claim 1: I(xi; a) = 1 assuming perfect correctness Proof: Correctness. Claim 2: ∑n

j=1 I(xj; a) ≤ H(a) ≤ |a|.

Proof: As x1, . . . , xn are independent. Corollary: ∑n

j=1 I(xj; a) is small.

∗The randomness is from x and from the proceduce generating the answer. Tianren, Vinod (MIT) Basing PIR on NP-Hardness TCC 2016-A 8 / 14

SLIDE 38

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Idea: Reduce Breaking PIR to Estimating Entropy

Given a query q, guess the index Claim 1: I(xi; a) = 1 assuming perfect correctness Claim 2: ∑n

j=1 I(xj; a) ≤ H(a) ≤ |a|.

Tianren, Vinod (MIT) Basing PIR on NP-Hardness TCC 2016-A 9 / 14

SLIDE 39

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Idea: Reduce Breaking PIR to Estimating Entropy

Given a query q, guess the index Emulate how the server answer q when x ∈ {0, 1}n is random Estimate I(xj; a) for each j ∈ {1, . . . , n} using SZK oracle (on next slide) Claim 1: I(xi; a) = 1 assuming perfect correctness Claim 2: ∑n

j=1 I(xj; a) ≤ H(a) ≤ |a|.

Tianren, Vinod (MIT) Basing PIR on NP-Hardness TCC 2016-A 9 / 14

SLIDE 40

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Idea: Reduce Breaking PIR to Estimating Entropy

Given a query q, guess the index Emulate how the server answer q when x ∈ {0, 1}n is random Estimate I(xj; a) for each j ∈ {1, . . . , n} using SZK oracle (on next slide) Output a random i′ w.p. I(xi′; a) ∑n

j=1 I(xj; a)

Claim 1: I(xi; a) = 1 assuming perfect correctness Claim 2: ∑n

j=1 I(xj; a) ≤ H(a) ≤ |a|.

Tianren, Vinod (MIT) Basing PIR on NP-Hardness TCC 2016-A 9 / 14

SLIDE 41

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Idea: Reduce Breaking PIR to Estimating Entropy

Given a query q, guess the index Emulate how the server answer q when x ∈ {0, 1}n is random Estimate I(xj; a) for each j ∈ {1, . . . , n} using SZK oracle (on next slide) Output a random i′ w.p. I(xi′; a) ∑n

j=1 I(xj; a)

Guess correctly w.p. ≥ 1 |a| Claim 1: I(xi; a) = 1 assuming perfect correctness Claim 2: ∑n

j=1 I(xj; a) ≤ H(a) ≤ |a|.

Tianren, Vinod (MIT) Basing PIR on NP-Hardness TCC 2016-A 9 / 14

SLIDE 42

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Idea: Reduce Breaking PIR to Estimating Entropy

Given a query q, guess the index Emulate how the server answer q when x ∈ {0, 1}n is random Estimate I(xj; a) for each j ∈ {1, . . . , n} using SZK oracle (on next slide) Output a random i′ w.p. I(xi′; a) ∑n

j=1 I(xj; a)

Guess correctly w.p. ≥ 1 − h(ε) |a| Claim 1: Eq[I(xi; a)] ≥ 1 − h(ε) assuming correctness w.h.p. Claim 2: ∑n

j=1 I(xj; a) ≤ H(a) ≤ |a|.

Tianren, Vinod (MIT) Basing PIR on NP-Hardness TCC 2016-A 9 / 14

SLIDE 43

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Mutual Information and SZK

Mutual information I(xi; a) = H(xi) + H(a) − H(xi, a) = H(xi) − H(xi|a) Entropy Approximation is in SZK:

Given a circuit generating a distribution D, and h To distinguish between H(D) ≥ h +

1 poly and H(D) ≤ h − 1 poly

Can estimate entropy given an SZK oracle

Tianren, Vinod (MIT) Basing PIR on NP-Hardness TCC 2016-A 10 / 14

SLIDE 44

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Mutual Information and SZK

Mutual information I(xi; a) = H(xi) + H(a) − H(xi, a) = H(xi) − H(xi|a) Entropy Approximation is in SZK:

Given a circuit generating a distribution D, and h To distinguish between H(D) ≥ h +

1 poly and H(D) ≤ h − 1 poly

Can estimate entropy given an SZK oracle

Tianren, Vinod (MIT) Basing PIR on NP-Hardness TCC 2016-A 10 / 14

SLIDE 45

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Mutual Information and SZK

Mutual information I(xi; a) = H(xi) + H(a) − H(xi, a) = H(xi) − H(xi|a) Entropy Approximation is in SZK:

Given a circuit generating a distribution D, and h To distinguish between H(D) ≥ h +

1 poly and H(D) ≤ h − 1 poly

Can estimate entropy given an SZK oracle

Tianren, Vinod (MIT) Basing PIR on NP-Hardness TCC 2016-A 10 / 14

SLIDE 46

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Mutual Information and SZK

Mutual information I(xi; a) = H(xi) + H(a) − H(xi, a) = H(xi) − H(xi|a) Entropy Approximation is in SZK:

Given a circuit generating a distribution D, and h To distinguish between H(D) ≥ h +

1 poly and H(D) ≤ h − 1 poly

Can estimate entropy given an SZK oracle Client i, index Server data x, random tape q a

Tianren, Vinod (MIT) Basing PIR on NP-Hardness TCC 2016-A 10 / 14

SLIDE 47

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Mutual Information and SZK

Mutual information I(xi; a) = H(xi) + H(a) − H(xi, a) = H(xi) − H(xi|a) Entropy Approximation is in SZK:

Given a circuit generating a distribution D, and h To distinguish between H(D) ≥ h +

1 poly and H(D) ≤ h − 1 poly

Can estimate entropy given an SZK oracle Client i, index Server data x, random tape q a

Tianren, Vinod (MIT) Basing PIR on NP-Hardness TCC 2016-A 10 / 14

SLIDE 48

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Mutual Information and SZK

Mutual information I(xi; a) = H(xi) + H(a) − H(xi, a) = H(xi) − H(xi|a) Entropy Approximation is in SZK:

Given a circuit generating a distribution D, and h To distinguish between H(D) ≥ h +

1 poly and H(D) ≤ h − 1 poly

Can estimate entropy given an SZK oracle Client i, index Server data x, random tape q, fixed a

Tianren, Vinod (MIT) Basing PIR on NP-Hardness TCC 2016-A 10 / 14

SLIDE 49

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Recall Proof Overview

Lemma 1 (Single-server one-round) PIR can be broken with an SZK

racle

Lemma 2 Language L ∈ BPPSZK = ⇒ L ∈ AM ∩ coAM

(Mahmoody & Xiao, 2010)

Thus: if there is a reduction from SAT to breaking PIR, then SAT ∈ AM ∩ coAM. Lemma 3 NP ̸⊆ coAM unless polynomial hierarchy collapses

(Boppana, H˚ astad & Zachos, 1987)

Thus: if there is a reduction from SAT to breaking PIR, then polynomial hierarchy collapses.

Tianren, Vinod (MIT) Basing PIR on NP-Hardness TCC 2016-A 11 / 14

SLIDE 50

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Open problem: Multiple-round

Multiple-round PIR Could we rule out multiple-round PIR? One-round PIR

Tianren, Vinod (MIT) Basing PIR on NP-Hardness TCC 2016-A 12 / 14

SLIDE 51

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Open problem: Multiple-round

Multiple-round PIR Could we rule out multiple-round PIR? One-round PIR Client i, index

random tape

Server x, data

random tape

q a

Tianren, Vinod (MIT) Basing PIR on NP-Hardness TCC 2016-A 12 / 14

SLIDE 52

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Open problem: Multiple-round

Multiple-round PIR Could we rule out multiple-round PIR? One-round PIR Given the view of server, it’s easy to generate another view. Client i, index

random tape

Server x, data

random tape

q a

Tianren, Vinod (MIT) Basing PIR on NP-Hardness TCC 2016-A 12 / 14

SLIDE 53

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Open problem: Multiple-round

Multiple-round PIR Could we rule out multiple-round PIR? One-round PIR Given the view of server, it’s easy to generate another view. Client i, index

random tape

Server x, data

random tape

m1 a1 m2 a2 m3 a3 Client i, index

random tape

Server x, data

random tape

q a

Tianren, Vinod (MIT) Basing PIR on NP-Hardness TCC 2016-A 12 / 14

SLIDE 54

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Open problem: CRHF

NP ⊈ BPP Avg-NP ⊈ BPP OWF CRHF Pub-key Enc OWP Trapdoor Permutation PIR Add-Homomorphic Enc PIR

(This work)

One-way Permutations

(Brassard 1979)

Tianren, Vinod (MIT) Basing PIR on NP-Hardness TCC 2016-A 13 / 14

SLIDE 55

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Open problem: CRHF

NP ⊈ BPP Avg-NP ⊈ BPP OWF CRHF Pub-key Enc OWP Trapdoor Permutation PIR Add-Homomorphic Enc PIR

(This work)

One-way Permutations

(Brassard 1979)

Could we rule out reduction from SAT to finding collisions?

(TCC 2017?)

Tianren, Vinod (MIT) Basing PIR on NP-Hardness TCC 2016-A 13 / 14

SLIDE 56

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Thank you!

Tianren, Vinod (MIT) Basing PIR on NP-Hardness TCC 2016-A 14 / 14