Is There an Oblivious RAM Lower Bound for Online Reads?

Weiss, Mor; Wichs, Daniel

doi:10.1007/978-3-030-03810-6_22

Cited by 14 publications

(6 citation statements)

References 48 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Recently, a new line of work tried to fully understand the limits of the Goldreich and Ostrovsky lower bound, starting with the paper by Boyle and Naor [BN16], showing that, in the offline setting (where the queries are given ahead of time), in the RAM computation model (server-side computation is not allowed), by using specific data encodings (outside of the balls and bin model), the lower bouds can be overcome. This result was extended by Weiss and Wichs [WW18] to settings like read-only ORAM. Finally, Larsen and Nielsen proved in [LN18] a lower bound for online ORAM constructions, very similar to the original Goldreich-Ostrovsky lower bound, that applies to any data representation, even in the case where we only require computational complexity.…”

Section: Related Work On Lower Boundsmentioning

confidence: 63%

Security-Efficiency Tradeoffs in Searchable Encryption

Bost

Fouque

2019

Proceedings on Privacy Enhancing Technologies

View full text Add to dashboard Cite

Besides their security, the efficiency of searchable encryption schemes is a major criteria when it comes to their adoption: in order to replace an unencrypted database by a more secure construction, it must scale to the systems which rely on it. Unfortunately, the relationship between the efficiency and the security of searchable encryption has not been widely studied, and the minimum cost of some crucial security properties is still unclear. In this paper, we present new lower bounds on the trade-offs between the size of the client state, the efficiency and the security for searchable encryption schemes. These lower bounds target two kinds of schemes: schemes hiding the repetition of search queries, and forward-private dynamic schemes, for which updates are oblivious. We also show that these lower bounds are tight, by either constructing schemes matching them, or by showing that even a small increase in the amount of leaked information allows for constructing schemes breaking the lower bounds.

show abstract

Section: Related Work On Lower Boundsmentioning

confidence: 63%

Security-Efficiency Tradeoffs in Searchable Encryption

Bost

Fouque

2019

Proceedings on Privacy Enhancing Technologies

View full text Add to dashboard Cite

show abstract

“…Removing Read operations from traces is also preferable because an analogue of Lem. 2 will show that including will lead to a traceoriented PD definition that is equivalent to ORAMs (instead of write-only ORAMs), thus suffering ORAMs' efficiency lower-bounds [20,5,27,47,22].…”

Section: Independence Of Storage Layersmentioning

confidence: 99%

“…suffer from ORAMs' efficiency lower bound [20,5,27,47,22]. For example, HIVE [4] can be proven secure even if Read leaves traces; indeed, it employs this actively by explaining a hidden access as a public Read.…”

Section: Unified Definitionmentioning

confidence: 99%

SoK: Plausibly Deniable Storage

Chen¹,

Liang²,

Cărbunar³

et al. 2021

Preprint

View full text Add to dashboard Cite

Data privacy is critical in instilling trust and empowering the societal pacts of modern technology-driven democracies. Unfortunately, it is under continuous attack by overreaching or outright oppressive governments, including some of the world's oldest democracies. Increasingly-intrusive anti-encryption laws severely limit the ability of standard encryption to protect privacy. New defense mechanisms are needed.Plausible deniability (PD) is a powerful property, enabling users to hide the existence of sensitive information in a system under direct inspection by adversaries. Popular encrypted storage systems such as TrueCrypt and other research efforts have attempted to also provide plausible deniability. Unfortunately, these efforts have often operated under less well-defined assumptions and adversarial models. Careful analyses often uncover not only high overheads but also outright security compromise. Further, our understanding of adversaries, the underlying storage technologies, as well as the available plausible deniable solutions have evolved dramatically in the past two decades. The main goal of this work is to systematize this knowledge. It aims to:1. identify key PD properties, requirements, and approaches; 2. present a direly-needed unified framework for evaluating security and performance; 3. explore the challenges arising from the critical interplay between PD and modern system layered stacks;4. propose a new "trace-oriented" PD paradigm, able to decouple security guarantees from the underlying systems and thus ensure a higher level of flexibility and security independent of the technology stack.This work is meant also as a trusted guide for system and security practitioners around the major challenges in understanding, designing, and implementing plausible deniability into new or existing systems.

show abstract

“…Thus, the same proof goes through even for semi-offline ORAMs, i.e., if we allow the ORAM to know the type and address of each input operation in y in advance. On the other hand, as our proof uses interleaved sequences of write blocks and read blocks, it is unlikely that it would be possible to extend it to the read-only online ORAM model of Weiss and Wichs [WW18].…”

Section: Oram Lower Boundmentioning

confidence: 99%

“…In fact, Boyle and Naor showed that any general lower bound for offline ORAM (i.e., where each memory access of the ORAM can depend on the whole sequence of operations it needs to obliviously simulate) implies non-trivial lower bounds on sizes of sorting circuits which seem to be out of reach of the known techniques in computational complexity. The connection between offline ORAM lower bounds and circuit lower bounds was extended to read-only online ORAMs (i.e., where only the read operations are processed in online manner) by Weiss and Wichs [WW18] who showed that lower bounds on bandwidth overhead for read-only online ORAMs would imply non-trivial lower bounds for sorting circuits or locally decodable codes.…”

Section: Introductionmentioning

confidence: 99%

Stronger Lower Bounds for Online ORAM

Hubáček

Koucký

Král

et al. 2019

Lecture Notes in Computer Science

View full text Add to dashboard Cite

Oblivious RAM (ORAM), introduced in the context of software protection by Goldreich and Ostrovsky [JACM'96], aims at obfuscating the memory access pattern induced by a RAM computation. Ideally, the memory access pattern of an ORAM should be independent of the data being processed. Since the work of Goldreich and Ostrovsky, it was believed that there is an inherent Ω(log n) bandwidth overhead in any ORAM working with memory of size n. Larsen and Nielsen [CRYPTO'18] were the first to give a general Ω(log n) lower bound for any online ORAM, i.e., an ORAM that must process its inputs in an online manner.In this work, we revisit the lower bound of Larsen and Nielsen, which was proved under the assumption that the adversarial server knows exactly which server accesses correspond to which input operation. We give an Ω(log n) lower bound for the bandwidth overhead of any online ORAM even when the adversary has no access to this information. For many known constructions of ORAM this information is provided implicitly as each input operation induces an access sequence of roughly the same length. Thus, they are subject to the lower bound of Larsen and Nielsen. Our results rule out a broader class of constructions and specifically, they imply that obfuscating the boundaries between the input operations does not help in building a more efficient ORAM.As our main technical contribution and to handle the lack of structure, we study the properties of access graphs induced naturally by the memory access pattern of an ORAM computation. We identify a particular graph property that can be efficiently tested and that all access graphs of ORAM computation must satisfy with high probability. This property is reminiscent of the Larsen-Nielsen property but it is substantially less structured; that is, it is more generic. * 1 Protecting the memory access of a computation is particularly relevant in the light of the recent Spectre [KGG + 18] and Meltdown [LSG + 18] attacks.

show abstract

Is There an Oblivious RAM Lower Bound for Online Reads?

Cited by 14 publications

References 48 publications

Security-Efficiency Tradeoffs in Searchable Encryption

Security-Efficiency Tradeoffs in Searchable Encryption

SoK: Plausibly Deniable Storage

Stronger Lower Bounds for Online ORAM

Contact Info

Product

Resources

About