2-Server PIR with Subpolynomial Communication

Dvir, Zeev; Gopi, Sivakanth

doi:10.1145/2968443

Cited by 76 publications

(32 citation statements)

References 17 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…In a breakthrough result, the work in [13] matched the CC of two-server PIR with the CC of the best-known three-server PIR, improving from the best previously-known 2 n/3 to 2 O( √ nlog(n)) . Their work cleverly combined and extended several non-trivial ideas, both new and ones that appeared in previous work in some form.…”

Section: Two-server Pirmentioning

confidence: 99%

“…The reconstruction procedure uses the shared evaluations as derivatives to compute this free coefficient, which is non-zero iff a x is one. In the original protocol description of [13], the client used the input for reconstructing the output, which is not consistent with share conversion, where the input is not required for reconstruction. We restate the above protocol by letting the servers "play back" the original shares to the client to stay consistent with the BIKO share conversion framework.…”

mentioning

confidence: 99%

See 1 more Smart Citation

On Share Conversions for Private Information Retrieval

Paskin-Cherniavsky

Schmerler

2019

Entropy

View full text Add to dashboard Cite

Beimel et al. in CCC 12’ put forward a paradigm for constructing Private Information Retrieval (PIR) schemes, capturing several previous constructions for k ≥ 3 servers. A key component in the paradigm, applicable to three-server PIR, is a share conversion scheme from corresponding linear three-party secret sharing schemes with respect to a certain type of “modified universal” relation. In a useful particular instantiation of the paradigm, they used a share conversion from ( 2 , 3 ) -CNF over Z m to three-additive sharing over Z p β for primes p 1 , p 2 , p where p 1 ≠ p 2 and m = p 1 · p 2 . The share conversion is with respect to the modified universal relation C S m . They reduced the question of whether a suitable share conversion exists for a triple ( p 1 , p 2 , p ) to the (in)solvability of a certain linear system over Z p . Assuming a solution exists, they also provided a efficient (in m , log p ) construction of such a sharing scheme. They proved a suitable conversion exists for several triples of small numbers using a computer program; in particular, p = p 1 = 2 , p 2 = 3 yielded the three-server PIR with the best communication complexity at the time. This approach quickly becomes infeasible as the resulting matrix is of size Θ ( m 4 ) . In this work, we prove that the solvability condition holds for an infinite family of ( p 1 , p 2 , p ) ’s, answering an open question of Beimel et al. Concretely, we prove that if p 1 , p 2 > 2 and p = p 1 , then a conversion of the required form exists. We leave the full characterization of such triples, with potential applications to PIR complexity, to future work. Although larger (particularly with m a x ( p 1 , p 2 ) > 3 ) triples do not yield improved three-server PIR communication complexity via BIKO’s construction, a richer family of PIR protocols we obtain by plugging in our share conversions might have useful properties for other applications. Moreover, we hope that the analytic techniques for understanding the relevant matrices we developed would help to understand whether share conversion as above for C S m , where m is a product of more than two (say three) distinct primes, exists. The general BIKO paradigm generalizes to work for such Z m ’s. Furthermore, the linear condition in Beimel et al. generalizes to m’s, which are products of more than two primes, so our hope is somewhat justified. In case such a conversion does exist, plugging it into BIKO’s construction would lead to major improvement to the state of the art of three-server PIR communication complexity (reducing Communication Complexity (CC) in correspondence with certain matching vector families).

show abstract

Section: Two-server Pirmentioning

confidence: 99%

mentioning

confidence: 99%

On Share Conversions for Private Information Retrieval

Paskin-Cherniavsky

Schmerler

2019

Entropy

View full text Add to dashboard Cite

show abstract

“…For t = 1 and r = 2, Chor et al [11] constructed the first 2-server PIR with communication complexity O(n 1/3 ), which has been optimal for a long time. Dvir and Gopi [13] improved [11] with a 2-server PIR of communication complexity n O((log log n/ log n) 1/2 ) , which is the current record. For t = 1 and any r > 1, Ambainis [1] and Beimel et al [4] constructed (t, r)-PIR schemes with communication complexity O(2 r 2 n 1/(2r−1) ) and n O(log log r/r log r) , respectively.…”

Section: B Related Workmentioning

confidence: 99%

“…The reconstruction algorithms in [3], [11], [17] are fixed and the reconstruction algorithm in [13], [14] relies on a parameter (aux), which is generated by the user. In the itFSS scheme obtained from the PIR scheme in [14], the reconstructor can still learn f α,1 (α ) from the shares without this parameter if we modify the output decoder.…”

Section: More Instantiationsmentioning

confidence: 99%

Towards Efficient Information-Theoretic Function Secret Sharing

Zhang

2020

IEEE Access

View full text Add to dashboard Cite

A (t, r)-function secret sharing ((t, r)-FSS) scheme allows a dealer to secret-share a function f among r parties as r secret keys k 1 ,. .. , k r such that for any input x the parties can compute r output shares that allow the reconstruction of f (x) but any ≤ t of the parties cannot learn any information about f. FSS schemes for point functions have been constructed under the name of distributed point functions (DPFs). The existing DPFs are computationally secure and based on the existence of PRGs or OWFs. As a result, the protocols where DPFs work as building blocks are computationally secure as well. In this paper, we study information-theoretically secure (t, r)-FSS (called (t, r)-itFSS) and propose a generic transformation from information-theoretic private information retrieval (PIR) schemes to itFSS schemes for point functions. We measure the efficiency of itFSS with its communication complexity, which can be defined as the total length of the secret keys and the output shares, maximized over the choices of f and x. By instantiating the generic transformation, we obtain (t, r)-itFSS schemes for a variety of choices of (t, r), which have sublinear (in the functions' domain size) communication complexity. How to make sure that the parties' shares of f (x) do not reveal more information than what needed to compute f (x) is an interesting problem. An itFSS with this property is called function-private. In this paper, we also define a parameter called the mutual rate of itFSS in order to measure the amount of information that will be leaked by the parties' output shares. We calculate the mutual rates for several specific itFSS schemes. We also define computational function privacy and propose a 2-party itFSS scheme with computational function privacy.

show abstract

“…3 LDCs where the codewords are over a large alphabet are studied because of their relation to private information retrieval schemes [11,25]. In [15], 2-query LDCs of length n = exp(k o (1) ) over an alphabet of size exp(k o(1) ) were constructed. There is also some exciting recent work on LDCs where the number of queries grows with k, in which case there are explicit constructions with constant rate (that is, n = O(k)) and query complexity q = exp(O( √ log n)); in fact we can even achieve the optimal rate-distance tradeoff of traditional error correcting codes [29,28,22].…”

Section: Introductionmentioning

confidence: 99%

Untitled

Briët¹,

Dvir²,

Gopi³

2019

Theory of Comput.

Self Cite

View full text Add to dashboard Cite

Locally decodable codes (LDCs) are error correcting codes that allow for decoding of a single message bit using a small number of queries to a corrupted encoding. Despite decades of study, the optimal trade-off between query complexity and codeword length is far from understood. In this work, we give a new characterization of LDCs using distributions over Boolean functions whose expectation is hard to approximate (in L ∞ norm) with a small number of samples. We coin the term "outlaw distributions" for such distributions since they "defy" the Law of Large Numbers. We show that the existence of outlaw distributions over sufficiently "smooth" functions implies the existence of constant query LDCs and vice versa. We give several candidates for outlaw distributions over smooth functions coming from finite field incidence geometry, additive combinatorics and hypergraph (non)expanders. We also prove a useful lemma showing that (smooth) LDCs which are only required to work on average over a random message and a random message index can be turned into true LDCs at the cost of only constant factors in the parameters.

show abstract

2-Server PIR with Subpolynomial Communication

Cited by 76 publications

References 17 publications

On Share Conversions for Private Information Retrieval

On Share Conversions for Private Information Retrieval

Towards Efficient Information-Theoretic Function Secret Sharing

Untitled

Contact Info

Product

Resources

About