OptORAMa: Optimal Oblivious RAM

Abstract

Oblivious RAM (ORAM), first introduced in the ground-breaking work of Goldreich and Ostrovsky (STOC ’87 and J. ACM ’96) is a technique for provably obfuscating programs’ access patterns, such that the access patterns leak no information about the programs’ secret inputs. To compile a general program to an oblivious counterpart, it is well-known that amortized blowup is necessary, where N is the size of the logical memory. This was shown in Goldreich and Ostrovksy’s original ORAM work for statistical security and in a somewhat restricted model (the so called balls-and-bins model), and recently by Larsen and Nielsen (CRYPTO ’18) for computational security. A long standing open question is whether there exists an optimal ORAM construction that matches the aforementioned logarithmic lower bounds (without making large memory word assumptions, and assuming a constant number of CPU registers). In this paper, we resolve this problem and present the first secure ORAM with amortized blowup, assuming one-way functions. Our result is inspired by and non-trivially improves on the recent beautiful work of Patel et al. (FOCS ’18) who gave a construction with amortized blowup, assuming one-way functions. One of our building blocks of independent interest is a linear-time deterministic oblivious algorithm for tight compaction: Given an array of n elements where some elements are marked, we permute the elements in the array so that all marked elements end up in the front of the array. Our O ( n ) algorithm improves the previously best known deterministic or randomized algorithms whose running time is or , respectively.

Dynamic Searchable Encryption with Small Client Storage

“…Recent advances in ORAM. Recently, [47], [6] proposed novel ORAM constructions, with improved efficiency matching the theoretical optimal overhead of O(log N ). It is possible to modify these to yield oblivious maps, thus asymptotically improving our schemes SD d and QOS as well as [27], [10], [29].…”

Mitigating Leakage in Secure Cloud-Hosted Data Structures

“…ORAMs are a powerful primitive that enable access to storage hosted by a potentially untrusted server such as a cloud storage provider without leaking any information beyond the number of accesses. As a result, there has been a lot of work in ORAM [3,24,39,46,53] leading to logarithmic overhead constructions. Furthermore, ORAM lower bounds [41,48] have shown that these are the best possible constructions.…”

Application-Oriented Succinct Data Structures for Big Data

“…In 1987, Goldreich proposed a seminal concept called ORAM, or Oblivious RAM (Random Access Memory), which can theoretically hide the content of data and their access patterns [28,29]. Many variations of ORAMs have been proposed since then [2,15,20,38,57,58,70,71,74].…”

“…Hash-based ORAMs utilize hierarchical hash techniques based on one-way functions. They include the original Goldreich's Square-Root ORAM (SR-ORAM) [28,29] and many succeeding ORAMs [2,38,58]. In contrast, treebased ORAMs maintain data in tree data structures [57,71,74].…”

“…Recently, PanORAMa proposed by Patel et al [58] achieved O(log n ⋅ poly(log log n)) bandwidth blowup. More recently, OptORAMa with tight bandwidth blowup was proposed by Asharov et al [2]. It should be noted that PanO-RAMa and OptORAMa are complicated algorithms and rather difficult to implement.…”