1. Private Information Retrieval Amos Beimel – Ben-Gurion University http://www.cs.bgu.ac.il/~beimel Tel-Hai, June 4, 2003 This talk is based on talks by: Yuval Ishai, Eyal Kushilevitz, Tal Malkin

2. Private Information Retrieval (PIR) [CGKS95] Goal: allow user to query database while hiding the identity of the data-items she is after. Note: hides identity of data-items; not existence of interaction with the user. Motivation: patent databases; stock quotes; web access; many more.... Paradox(?): imagine buying in a store without the seller knowing what you buy. (Encrypting requests is useful against third parties; not against owner of data.)

3. Modeling Server: holds n-bit string x n should be thought of as very large User: wishes –to retrieve x i and –to keep i private Remark: most basic version; building block for involved retrieval.

4. Private Information Retrieval (PIR) x=x 1,x 2,..., x n {0,1} n SERVER i {1,…n} xixi USER ij ? 7 4 3 n

5. NO privacy!!! Communication: log n SERVER USER x =x 1,x 2,..., x n xixi Non-Private Protocol i i {1,…n}

6. Server sends entire database x to User. Information theoretic privacy. Communication: n SERVER xixi USER x =x 1,x 2,..., x n x 1,x 2,..., x n Trivial Private Protocol Is this optimal?

7. Obstacle Theorem [CGKS]: In any 1-server PIR with information theoretic privacy the communication is at least n.

8. More “solutions” User asks for additional random indices. Drawback: reveals a lot of information Employ general crypto protocols to compute x i privately. Drawback: highly inefficient (polynomial in n ). Anonymity (e.g., via Anonymizers). Note: different concern: hides identity of user; not the fact that x i is retrieved.

9. Two Approaches Information-Theoretic PIR [CGKS95,Amb97,...] Replicate database among k servers. Unconditional privacy against t servers. Default: t=1 Computational PIR [CG97,KO97,CMS99,...] Computational privacy, based on cryptographic assumptions.

10. Known Comm. Upper Bounds Multiple servers, information-theoretic PIR: 2 servers, comm. n 1/3 [CGKS95] k servers, comm. n 1/  (k) [CGKS95, Amb96,…,BIKR02] log n servers, comm. Poly( log(n) ) [BF90, CGKS95] Single server, computational PIR: Comm. Poly( log(n) ) Under appropriate computational assumptions [KO97,CMS99]

11. Approach I: k-Server PIR Correctness: User obtains x i Privacy: No single server gets information about i U S1S1 x {0,1} n S2S2 i SkSk

12. Information-Theoretic 2-Server PIR Best Known Protocol: comm. n 1/3 [CGKS95] Open Question: Is this optimal? This Talk: comm. n 1/2 Two Stages: 1.Protocol I: n bit queries, 1 bit answers 2.Protocol II: n 1/2 bit queries, n 1/2 bit answers

13. Protocol I: 2-server PIR S2S2 i U i n Q 1  {1,…,n} S1S1 Q 2 =Q 1  i 001100111000

14. Protocol I: 2-server PIR S2S2 i U i n Q 1  {1,…,m} S1S1 Q 2 =Q 1  i 0 1 0 0 11 01 0 0 010

15. Protocol I: 2-server PIR S2S2 i U i n Q 1  {1,…,n} S1S1 a1a2=xia1a2=xi Q 2 =Q 1  i 0 1 0 0 1 01 0 0 011 1 0

16. PIR with O(n 1/2 ) Communication S2S2 j,i U i X m=n 1/2 Q 1  {1,…,m} S1S1 Q 2 =Q 1  i j a 1,j  a 2,j =x j,i

17. Computational PIR with O(n 1/2 ) Comm. Tool: (randomized) homomorphic encryption b b’b’ b  b’ =  Example Quadratic Residue: E(0)  QR N E(1)  NQR N QR QR = QR NQR QR = NQR

18. Computational PIR with O(n 1/2 ) Comm. 0 1 1 0 1 1 1 0 1 1 0 0 0 0 0 1 n 1/2 i User sends n 1/2 encryptions c 1 =E(0), c 2 =E(0), c 3 =E(1), c 4 = E(0) For each row Server sends a “bit” c2c3c2c3 c1 c2c3c1 c2c3 c1c2c1c2 c4c4 User recovers ith column of x j

19. PIR – Related Work Extensions: –Symmetric PIR [GIKM,NP] –t-privacy [CGKS,IK,BI] –Robust PIR [BS] More settings [OS,GGM,DIO,BIM,...] PIR as a building-block [NN,FIMNSW,...]

20. Current (& Future) Research Focus so far: communication complexity Obstacle: time complexity All existing protocols require high computation by the servers (linear computation per query). Theorem [BIM]: Expected computation of the servers is  (n) Major research goal: Improving time complexity via preprocessing / amortization / off-line computation ( Preliminary results in [BIM,IKOS])