Cryptology ePrint Archive: Report 2016/849

Asymptotically Tight Bounds for Composing ORAM with PIR

Ittai Abraham and Christopher W. Fletcher and Kartik Nayak and Benny Pinkas and Ling Ren

Abstract: Oblivious RAM (ORAM) is a cryptographic primitive that allows a trusted client to outsource storage to an untrusted server while hiding the client's memory access patterns to the server. The last three decades of research on ORAMs have reduced the bandwidth blowup of ORAM schemes from $O(\sqrt{N})$ to $O(1)$. However, all schemes that achieve a bandwidth blowup smaller than $O(\log N)$ use expensive computations such as homomorphic encryptions. In this paper, we achieve a sub-logarithmic bandwidth blowup of $O(\log_d N)$ (where $d$ is a free parameter) without using expensive computation. We do so by using a $d$-ary tree and a two server private information retrieval (PIR) protocol based on inexpensive XOR operations at the servers. We also show a $\Omega(\log_{cD} N)$ lower bound on bandwidth blowup in the modified model involving PIR operations. Here, $c$ is the number of blocks stored by the client and $D$ is the number blocks on which PIR operations are performed. Our construction matches this lower bound implying that the lower bound is tight for certain parameter ranges. Finally, we show that C-ORAM (CCS'15) and CHf-ORAM violate the lower bound. Combined with concrete attacks on C-ORAM/CHf-ORAM, we claim that there exist security flaws in these constructions.

Category / Keywords: Oblivious RAM, PIR, lower bound

Original Publication (with minor differences): IACR-PKC-2017

Date: received 2 Sep 2016, last revised 17 Jan 2017

Contact author: kartik at cs umd edu

Available format(s): PDF | BibTeX Citation

Note: This extends our original submission with a lower bound on ORAMs using PIR and shows two attacks on C-ORAM/CHf-ORAM.

Version: 20170117:164356 (All versions of this report)

Short URL:

Discussion forum: Show discussion | Start new discussion

[ Cryptology ePrint archive ]