Revisiting Square Root ORAM Efficient Random Access in Multi-Party - PowerPoint PPT Presentation

Revisiting Square Root ORAM Efficient Random Access in Multi-Party Computation Samee Zahur Xiao Wang Mariana Raykova Adrià Gascón Jack Doerner Jonathan Katz David Evans oblivc.org/sqoram

Secure multi-party computation applications Set intersection Iris code matching [FNP04] [LCPLB12] Matrix factorization for recommendations [NIWJTB13] Median computation Linear ridge-regression [AMP04] [NWIJBT13]

Random Access

Hiding access pattern Linear scan Oblivious RAM Access every element Continually shuffle elements around Per-access cost: Θ(log 𝑞 𝑜) Per-access cost: Θ 𝑜

Linear scan Figure from: Wang, Chan, Shi. Cir ircuit it Oram am . CCS’15

(our work) 6

Approach: revisit old schemes Classic “square root” scheme by Goldreich and Ostrovsky (1996). Considered slow for MPC because of per-access hash evaluation. Per-access amortized cost: Θ 𝑜 log 𝑜

Four-element ORAM Larger Sizes

4-Block ORAM Cost: 5 𝐶 + 𝐶 +2 𝐶 +3 𝐶 + … = 11 𝐶 every 3 accesses

Comparison Our scheme Linear scan Cost: 4 𝐶 = 12 𝐶 /3 Cost: 11 𝐶 /3

Four-element ORAM Larger Sizes

Position map 0 1 2 3 0 1 2 3 3 0 2 1 1 3 0 2

Keeping position map updated Position map

Keeping position map updated Position map

Rinse and repeat 1. Shuffle elements 2. Recreate position map 3. Service 𝑈 = 𝑜 log 𝑜 accesses

Creating position map

Creating position map

Inverse permutation 𝑞 𝜌 𝐵 ⋅ 𝑞 𝜌 𝐶 = 𝜌 𝐵 ⋅ 𝑞 𝜌 𝐵

Inverse permutation 𝜌 𝐵 𝜌 𝐶 𝜌 𝐶 = 𝜌 𝐵 ⋅ 𝑞 𝜌 𝐵 Bob computes −1 ⋅ 𝜌 𝐵 −1 = 𝑞 −1 ⋅ 𝜌 𝐵 𝜌 𝐶 −1 𝜌 𝐶 = 𝑞 −1 ⋅ 𝜌 𝐵 −1 ⋅ 𝜌 𝐵 = 𝑞 −1

Rinse and repeat 1. Shuffle elements at Θ 𝑜 log 𝑜 2. Recreate position map 3. Service 𝑈 = 𝑜 log 𝑜 accesses

Access time

Initialization cost

Benchmarks Circuit Square-root Task Parameters Linear scan ORAM ORAM 2 10 searches 1020 s 5041 s 825 s Binary search 2 15 elements 2 10 vertices Breadth-first 4570 s 3750 s 680 s 2 13 edges search 2 9 pairs - 189000 s 119000 s Stable matching ≈ 7 days 2850 s 1920 s N = 2 14 scrypt hashing

Conclusion We revisited a well-known scheme and used it to • Lower initialization cost • Improve breakeven point Shows that asymptotic costs are not the final word, concrete costs require more consideration.

Download oblivc.org/sqoram Contact for help: Samee Zahur <samee@virginia.edu>