A language for probabilistically oblivious computation

Abstract

An oblivious computation is one that is free of direct and indirect information leaks, e.g., due to observable differences in timing and memory access patterns. This paper presents λ obliv , a core language whose type system enforces obliviousness. Prior work on type-enforced oblivious computation has focused on deterministic programs. λ obliv is new in its consideration of programs that implement probabilistic algorithms, such as those involved in cryptography. λ obliv employs a substructural type system and a novel notion of probability region to ensure that information is not leaked via the observed distribution of visible events. Probability regions support reasoning about probabilistic correlation and independence between values, and our use of probability regions is motivated by a source of unsoundness that we discovered in the type system of ObliVM, a language for implementing state of the art oblivious algorithms. We prove that λ obliv 's type system enforces obliviousness and show that it is expressive enough to typecheck advanced tree-based oblivious RAMs. CCS Concepts: • Security and privacy → Logic and verification.

Verification of Quantitative Hyperproperties Using Trace Enumeration Relations

“…In concurrent work with ours, Barthe et al [11] and Darais et al [22] have introduced specialized mechanisms to prove security of ORAMs. Barthe et al [11] introduced a probabilistic separation logic (PSL) that (among other things) can be used to reason about the security of ORAMs.…”

“…Unlike QHPs, PSL does not permit quantitative reasoning about probabilities of events and also does not (yet) support machine-checked reasoning. Darais et al [22] introduce a type system that enforces obliviousness; they use this type system to implement a tree-based ORAM. Note that QHPs can express specifications other than obliviousness, and obliviousness need not necessarily be a QHP.…”

Data Oblivious ISA Extensions for Side Channel-Resistant and High Performance Computing

“…This means programmers can implement floating point directly, without invoking bitwise libraries [8]. Second, random number generation, as many randomized data oblivious codes require private random numbers (e.g., [64], [65], [66], [23], [21]). Third, a cmov-style ternary/conditional move operator with a Safe predicate for implementing conditionals, and branches/jumps with Unsafe operands to reduce code footprint.…”

“…Beyond data oblivious code written for today's ISAs, there is a rich literature to improve algorithm/data structure [47], [79], [78], [77], [80], [81], [64], [82], [83], [66] performance in the software circuit abstraction. Additionally, there is rich literature to write (e.g., [65], [84]) and compile (e.g., [64], [85], [82]) programs to software circuits. An important observation is that, although many of these works target cryptographic backends such as garbled circuits, their underlying programming abstraction (software circuits) is very similar to the data oblivious abstraction.…”

A probabilistic separation logic

“…Previous systems, however, have also touched on independence. Darais et al [13] define a type and effect system for proving properties of probabilistic computations. Their effect system is based on a new notion of probabilistic region, which they use to track probabilistic dependencies.…”