Revisiting Square Root ORAM Efficient Random Access in Multi-Party - - PowerPoint PPT Presentation

▶
revisiting square root oram
SMART_READER_LITE
LIVE PREVIEW

Revisiting Square Root ORAM Efficient Random Access in Multi-Party - - PowerPoint PPT Presentation

Oct 10, 2022 239 likes •505 views

Revisiting Square Root ORAM Efficient Random Access in Multi-Party Computation Samee Zahur Xiao Wang Mariana Raykova Adri Gascn Jack Doerner Jonathan Katz David Evans oblivc.org/sqoram Secure multi-party computation applications Set

slide-1
SLIDE 1

Revisiting Square Root ORAM

Efficient Random Access in Multi-Party Computation

Samee Zahur Jack Doerner David Evans Xiao Wang Jonathan Katz Mariana Raykova Adrià Gascón

  • blivc.org/sqoram
slide-2
SLIDE 2

Secure multi-party computation applications

Set intersection [FNP04] Linear ridge-regression [NWIJBT13] Median computation [AMP04] Iris code matching [LCPLB12] Matrix factorization for recommendations [NIWJTB13]

slide-3
SLIDE 3

Random Access

slide-4
SLIDE 4

Hiding access pattern

Linear scan

Access every element Per-access cost: Θ 𝑜

Oblivious RAM

Continually shuffle elements around Per-access cost: Θ(log𝑞 𝑜)

slide-5
SLIDE 5

Figure from: Wang, Chan, Shi. Cir ircuit it Oram

  • am. CCS’15

Linear scan

slide-6
SLIDE 6

6

(our work)

slide-7
SLIDE 7

Approach: revisit old schemes

Classic “square root” scheme by Goldreich and Ostrovsky (1996). Considered slow for MPC because

  • f per-access hash evaluation.

Per-access amortized cost: Θ 𝑜 log 𝑜

slide-8
SLIDE 8

Four-element ORAM Larger Sizes

slide-9
SLIDE 9

4-Block ORAM

Cost: 5𝐶 + 𝐶+2𝐶+3𝐶 + … = 11𝐶 every 3 accesses

slide-10
SLIDE 10

Comparison

Linear scan Cost: 4𝐶 = 12𝐶/3 Our scheme Cost: 11𝐶/3

slide-11
SLIDE 11

Four-element ORAM Larger Sizes

slide-12
SLIDE 12

Position map

3 2 1

1 2 3

1 3 2

1 2 3

slide-13
SLIDE 13

Keeping position map updated

Position map

slide-14
SLIDE 14

Keeping position map updated

Position map

slide-15
SLIDE 15

Rinse and repeat

  • 1. Shuffle elements
  • 2. Recreate position map
  • 3. Service 𝑈 =

𝑜 log 𝑜 accesses

slide-16
SLIDE 16

Creating position map

slide-17
SLIDE 17

Creating position map

slide-18
SLIDE 18

Inverse permutation

𝜌𝐵 𝑞 𝜌𝐵 ⋅ 𝑞 𝜌𝐶 = 𝜌𝐵 ⋅ 𝑞

slide-19
SLIDE 19

Inverse permutation

𝜌𝐵 Bob computes 𝜌𝐶

−1 = 𝑞−1 ⋅ 𝜌𝐵 −1

𝜌𝐵 𝜌𝐶

−1 ⋅ 𝜌𝐵

= 𝑞−1 ⋅ 𝜌𝐵

−1 ⋅ 𝜌𝐵

= 𝑞−1 𝜌𝐶 = 𝜌𝐵 ⋅ 𝑞 𝜌𝐶

slide-20
SLIDE 20

Rinse and repeat

  • 1. Shuffle elements
  • 2. Recreate position map
  • 3. Service 𝑈 =

𝑜 log 𝑜 accesses at Θ 𝑜 log 𝑜

slide-21
SLIDE 21

Access time

slide-22
SLIDE 22

Initialization cost

slide-23
SLIDE 23

Benchmarks

Task Parameters Linear scan Circuit ORAM Square-root ORAM

Binary search 210 searches 215 elements

1020 s 5041 s 825 s

Breadth-first search 210 vertices 213 edges

4570 s 3750 s 680 s

Stable matching 29 pairs

  • 189000 s

119000 s

scrypt hashing N = 214

≈ 7 days 2850 s 1920 s

slide-24
SLIDE 24

Conclusion

We revisited a well-known scheme and used it to

  • Lower initialization cost
  • Improve breakeven point

Shows that asymptotic costs are not the final word, concrete costs require more consideration.

slide-25
SLIDE 25

Download

  • blivc.org/sqoram

Contact for help: Samee Zahur <samee@virginia.edu>