Perfectly Secure Oblivious RAM with Sublinear Bandwidth Overhead

Abstract

Oblivious RAM (ORAM) has established itself as a fundamental cryptographic building block. Understanding which bandwidth overheads are possible under which assumptions has been the topic of a vast amount of previous works. In this work, we focus on perfectly secure ORAM and we present the first construction with sublinear bandwidth overhead in the worst-case. All prior constructions with perfect security require linear communication overhead in the worst-case and only achieve sublinear bandwidth overheads in the amortized sense. We present a fundamentally new approach for constructing ORAM and our results significantly advance our understanding of what is possible with perfect security.

Our main construction, Lookahead ORAM, is perfectly secure, has a worst-case bandwidth overhead of , and a total storage cost of on the server-side, where N is the maximum number of stored data elements. In terms of concrete server-side storage costs, our construction has the smallest storage overhead among all perfectly and statistically secure ORAMs and is only a factor 3 worse than the most storage efficient computationally secure ORAM. Assuming a client-side position map, our construction is the first, among all ORAMs with worst-case sublinear overhead, that allows for a online bandwidth overhead without server-side computation. Along the way, we construct a conceptually extremely simple statistically secure ORAM with a worst-case bandwidth overhead of , which may be of independent interest.

A Attack on [GMSS16]

In a work by Gordon et al. [GMSS16] the authors present an ORAM, called M-ORAM. Their construction has a flaw and does not provide obliviousness. In the following, we give a high-level overview of their scheme and sketch our attack that breaks their obliviousness claims.

The construction partitions the server-side storage into a fixed number of rows and a number of columns that depends on the dataset’s size. Every cell in their rectangular storage layout holds one data element. Additionally, every row has its own separate constant-sized stash.

Initially, all data elements are present in the storage rectangle in a randomly permuted order and the stashes are empty. Simply speaking an access is performed by accessing one element in each row of their data structure. In one of the rows the desired element is accessed and in all other rows a uniformly random cell is selected. More precisely, the authors claim that to achieve obliviousness not all “dummy” cells are selected uniformly at random, instead some of them are random cells from the previous access. After retrieving one cell from each row, the client shuffles the cells and puts one cell into each stash. The client picks one random block from each stash and sends it back to the server as the new content of the retrieved cells.

Let $x_1, \dots , x_N$ be some data elements stored in the ORAM data structure, the access sequences $\left( \mathsf {read}(x_1), \mathsf {read}(x_2), \mathsf {read}(x_1)\right)$ and $(\mathsf {read}(x_1), \mathsf {read}(x_2), \mathsf {read}(x_3))$ can be distinguished with a success probability that is non-negligible in the security parameter. From a high-level perspective, every access selects a subset of cells from the data structure and every two subsets corresponding to two consecutive accesses intersect at some random cells. For three accesses the proposed approach breaks down. Looking at our first access sequence, the proposed construction has a slightly higher bias of the first and third access subset intersecting, since we are accessing the same element.

We have contacted the authors and they have acknowledged our attack.