On the Practicality of PIR - Radu Sion

Network Security and Applied
Cryptography Laboratory
http://crypto.cs.stonybrook.edu
On the Practicality of PIR
Radu Sion
Stony Brook NSAC Lab
sion@cs.stonybrook.edu
Carbunar Bogdan
Motorola Labs
carbunar@motorola.com
ver. 2.1 (2/25/2007)
© 2005-07. All Rights Reserved.

What is PIR ?
Stony Brook Network Security and Applied Cryptography Lab
Initial concerns:
communication
complexity
Today: is endto-end
picture
practical ?
bit string d[n]
x
x
1
2
3
work
interaction
x
x
work
Alice
Question d[i]=?
x
x
x
n-2
n-1
n
i
Bob
Practicality of Private Information Retrieval (NDSS, February 2006)
2

What is “practical” ?
Stony Brook Network Security and Applied Cryptography Lab
Many things.
But often, in real life, these are
defined by execution time.
Practicality of Private Information Retrieval (NDSS, February 2006)
3

What is a practical PIR protocol ?
Stony Brook Network Security and Applied Cryptography Lab
Baseline: a cheaper PIR protocol than
trivial database transfer (for now !).
What is cheaper ?
Often, ”not slower”.
Faster. Not always !
Practicality of Private Information Retrieval (NDSS, February 2006)
4

Time to “illustrate” …
Stony Brook Network Security and Applied Cryptography Lab
… we choose: E. Kushilevitz and R. Ostrovsky,
“Replication is not needed: single database,
computationally-private information retrieval”, FOCS 1997.
Why ?
It is the least computationally expensive and arguably the
fastest of the bunch.
The results can be applied to all 7+ single-server
computational protocols we looked at (based on wellestablished
intractability assumptions)
They also apply to any protocol with a per-bit cost >
fraction (e.g., 1/10) of the cost of a modular multiplication.
Practicality of Private Information Retrieval (NDSS, February 2006)
5

Protocol overview
Stony Brook Network Security and Applied Cryptography Lab
bit string d[n]
3
Π(v[i]*d[i]) = QNR ?
yes
d[i]=1
Question d[i]=?
QR 1
QR 2
QR 3
.
QR i-1
QNR
QR i+1
.
QR n-2
QR n-1
QR n
v[i] 1
Π(v[i]*d[i])
Perform same
protocol per
column and
look at returned
product of
interest
2
x
x
x
x
x
x
x
1
2
3
n-2
n-1
n
escape O(n) costs
i
n
x
x
x
x
x
n
x
x
Π 1 Π 2
... Π 3
client
server
Practicality of Private Information Retrieval (NDSS, February 2006)
6

Execution time analysis
Stony Brook Network Security and Applied Cryptography Lab
PIR-favorable simplification: we ignore anything else
but the server-side modular multiplication costs.
Conclusion: PIR is “practical” iff. per-bit serverside
complexity is faster than bit transfer.
Practicality of Private Information Retrieval (NDSS, February 2006)
7

RSA Key Size Schedules
Stony Brook Network Security and Applied Cryptography Lab
Practicality of Private Information Retrieval (NDSS, February 2006)
8

Past: MIPS Schedule
Stony Brook Network Security and Applied Cryptography Lab
Practicality of Private Information Retrieval (NDSS, February 2006)
Note: 15MBps/5MBps costs $29.95/mo.
9

Past: 1 bit multiplication vs. transfer
Stony Brook Network Security and Applied Cryptography Lab
Practicality of Private Information Retrieval (NDSS, February 2006)
10

Present: Hardware
Stony Brook Network Security and Applied Cryptography Lab
Illustrative baseline. Results hold within orders of magnitude
(e.g., if chip would be ten times faster). Wide spread. Fast
ALUs. Setup: 3.6GHz, 1GB RAM. 11000 MIPS (Intel).
Practicality of Private Information Retrieval (NDSS, February 2006)
11

Present: Benchmarks
Stony Brook Network Security and Applied Cryptography Lab
1024 bit values: 273,000 mod. mul. / sec.
PIR-processing one bit: >>3700 ns
10MBps transfer: ~100-120 ns
Trivial transfer is 35+ times faster than PIR.
Question: But what about faster hardware ?
Practicality of Private Information Retrieval (NDSS, February 2006)
12

Present: Low bandwidth conditions
Stony Brook Network Security and Applied Cryptography Lab
Conclusion: Today’s
PIR protocols become
usable for low (tens of
KBps) bandwidths.
But: … at additional
computation costs ☺
Practicality of Private Information Retrieval (NDSS, February 2006)
13

Future: Moore Says ☺ …
Stony Brook Network Security and Applied Cryptography Lab
Practicality of Private Information Retrieval (NDSS, February 2006)
14

Future: CPU Speed follows Moore !
Stony Brook Network Security and Applied Cryptography Lab
Source: “Gigascale Integration-Challenges and Opportunities”,
Shekhar Borkar, Director, Circuit Research, Intel Corp.
Practicality of Private Information Retrieval (NDSS, February 2006)
15

Network Speed: Nielsen’s Law
Stony Brook Network Security and Applied Cryptography Lab
“high end connection speed
grows 50% per year”
Practicality of Private Information Retrieval (NDSS, February 2006)
16

Future: 1 bit multiplication vs. transfer
Stony Brook Network Security and Applied Cryptography Lab
The wizard predicts …
(logarithmic)
Practicality of Private Information Retrieval (NDSS, February 2006)
17

What about sPIR ?
Stony Brook Network Security and Applied Cryptography Lab
Here do PIR instead: “Naor-
Pinkas PIR-SPIR reduction”
[56] M. Naor and B. Pinkas.
Oblivious transfer and
polynomial evaluation. In STOC
’99: Proceedings of the thirtyfirst
annual ACM symposium on
Theory of computing, pages
245–254, New York, NY, USA,
1999. ACM Press.
Practicality of Private Information Retrieval (NDSS, February 2006)
18

What do we do ?
Stony Brook Network Security and Applied Cryptography Lab
New PIR protocols
Gasarch & Yerukhimovich protocol ?!
Gentry & Ramzan ?
Hardware PIR (Sean Smith @ Darthmouth)
Weaker privacy metrics (statistical)
Important: use correct baseline for “practical”
compare with application requirements, not
with trivial transfer (e.g., 4TB database –
trivial transfer over 100MBps takes 22+ hrs)
Practicality of Private Information Retrieval (NDSS, February 2006)
19

Trusted Hardware
Stony Brook Network Security and Applied Cryptography Lab
secure
insert/update
arbitrary
private query
Secure
Memory
encrypted query
response
data client
Secure Co-
Processor
Host CPU
Outsourced
Data
(encrypted)
Server Storage
encrypted item
data management server
A secure co-processor on the data
management side may allow for significant
leaps in expressivity for queries where privacy
and completeness assurance are important.
Practicality of Private Information Retrieval (NDSS, February 2006)
20

IBM 4764
Stony Brook Network Security and Applied Cryptography Lab
RSA1024 Sign: 848/sec
RSA1024 Verify: 1157/sec
3DES: 1-8MB/sec
DES: 1-8MB/sec
SHA1: 1-21MB/sec
IBM 4764-001: 266MHz PowerPC. 64KB battery-backed
SRAM storage. Crypto hardware engines: AES256, DES,
TDES, DSS, SHA-1, MD5, RSA. FIPS 140-2 Level 4 certified.
Practicality of Private Information Retrieval (NDSS, February 2006)
21

IBM 4764 Architecture
Stony Brook Network Security and Applied Cryptography Lab
Practicality of Private Information Retrieval (NDSS, February 2006)
22

Comparison: Pentium 4
Stony Brook Network Security and Applied Cryptography Lab
Illustrative baseline.
Pentium 4. 3.4GHz.
1GB RAM. 11000 MIPS.
OpenSSL 0.9.7f
DES/CBC: 70MB/sec
RC4: 138MB/sec
MD5: 18-615MB/sec
SHA1: 18-340MB/sec
Modular MUL 1024: 273000/sec
RSA1024 Sign: 261/sec
RSA1024 Verify: 5324/sec
3DES: 26MB/sec
Practicality of Private Information Retrieval (NDSS, February 2006)
23

Sample DON’T
Stony Brook Network Security and Applied Cryptography Lab
queries
crypto work
client/server
interaction
Outsourced
Data
good idea ?
not so sure !
Server Storage
data
client
Host CPU
crypto work
crypto work
“client proxy”
database server
queries
Secure Co-
Processor
data
client
“client-server”
interaction
Host CPU
Outsourced
Data
Server Storage
database server
Practicality of Private Information Retrieval (NDSS, February 2006)
24

in/yes > /dev/lunchtime
Stony Brook Network Security and Applied Cryptography Lab
wet !?
Thank you !
Practicality of Private Information Retrieval (NDSS, February 2006)
25

Protocol overview
Stony Brook Network Security and Applied Cryptography Lab
Practicality of Private Information Retrieval (NDSS, February 2006)
26