Paper 2021/1256

Oblivious Message Retrieval

Zeyu Liu and Eran Tromer

Abstract

Anonymous message delivery systems, such as private messaging services and privacy-preserving payment systems, need a mechanism for recipients to retrieve the messages addressed to them, without leaking metadata or letting their messages be linked. Recipients could download all posted messages and scan for those addressed to them, but communication and computation costs are excessive at scale. We show how untrusted servers can detect messages on behalf of recipients, and summarize these into a compact encrypted digest that recipients can easily decrypt. These servers operate obliviously and do not learn anything about which messages are addressed to which recipients. Privacy, soundness, and completeness hold even if everyone but the recipient is adversarial and colluding (unlike in prior schemes). Our starting point is an asymptotically-efficient approach, using Fully Homomorphic Encryption and homomorphically-encoded Sparse Random Linear Codes. We then address the concrete performance using bespoke tailoring of lattice-based cryptographic components, alongside various algebraic and algorithmic optimizations. This reduces the digest size to a few bits per message scanned. Concretely, the servers' cost is ~$1 per million messages scanned, and the resulting digests can be decoded by recipients in ~20ms. Our schemes can thus practically attain the strongest form of receiver privacy for current applications such as privacy-preserving cryptocurrencies.

Note: 1. Adding Intex-HEXL optimization for runtime, and changed benchmarks and GCP costs accordingly 2. Adding a bound derivation for SRLC1 (Lemma 6.5) 3. Changing scheme names to OMDt1, OMDt2, OMDp1, OMRt1, OMRp1, OMRp2 (with a summary of schemes in appendix A) 4. Adding comparisons and citations for the Private Stream Searching line of work 5. Fixed typos