Unconditional
SECURE COMPUTATIONPrimitive

Multi-server PIR

In plain words

Look something up in a database without the database learning what you looked up. With two servers that never talk to each other, this needs no hard math at all.

The idea: With two servers it works like this. You send server A a random list of row numbers, and server B the same list with your row added if it was missing, or removed if it was there. Each server combines (XORs) the rows on its list and sends back the result. Combine the two answers and everything cancels except your row. Each server alone sees just a random list, so it learns nothing, unless the two compare notes.

Why it matters: Makes private lookups possible, for contacts, websites or medical information.

Fetching a row without saying which
row 1row 2row 3row 4row 5row 6row 7row 8databaseServer Aasked for rows1, 3, 4, 7Server Basked for rows1, 3, 4, 5, 7A ⊕ B= row 5
Each server combines (XORs) the rows on its list and sends back one result. The two lists are random-looking and differ only in row 5, so combining the two answers cancels everything except row 5. Each server alone sees a random list and learns nothing about which row you wanted, as long as the servers don't compare notes.

The details

On the map: fetch a record without the servers learning which. Single-server PIR implies OT, so it needs KE-level assumptions instead

Private information retrieval lets you fetch an item from a database without the server learning which item you wanted, for example looking up a domain or a contact privately.

If two or more servers hold copies and don't collude, this can be done unconditionally: each server only sees a random-looking query (Chor, Goldreich, Kushilevitz, Sudan 1995)[1].

With a single server PIR is still possible but needs computational assumptions. It implies oblivious transfer[2], so it needs public-key-level assumptions. Practical single-server schemes use lattices[3].

Rests on

If any of these breaks, this breaks too.

If it falls

If this breaks, these break with it.

Nothing on the map depends on it: it is an end point, something people use directly.

References

  1. B. Chor, O. Goldreich, E. Kushilevitz and M. Sudan. Private information retrieval. Proceedings of IEEE 36th Annual Foundations of Computer Science, 1995. doi:10.1109/sfcs.1995.492461
  2. Giovanni Di Crescenzo, Tal Malkin and Rafail Ostrovsky. Single Database Private Information Retrieval Implies Oblivious Transfer. Advances in Cryptology — EUROCRYPT 2000. doi:10.1007/3-540-45539-6_10
  3. Alexandra Henzinger, Matthew M. Hong, Henry Corrigan-Gibbs et al. One Server for the Price of Two: Simple and Fast Single-Server Private Information Retrieval. USENIX Security 2023. usenix.org/conference/usenixsecurity23/presentation/henzinger