A Geometric Approach to Information-Theoretic Private Information Retrieval

Transcription

1 A Geomeric Approach o Informaion-Theoreic Privae Informaion Rerieval David Woodruff MIT dpwood@mi.edu Sergey Yehanin MIT yehanin@mi.edu Absrac A -privae privae informaion rerieval PIR scheme allows a user o rerieve he ih bi of an n-bi sring x replicaed among servers, while any coaliion of up o servers learns no informaion abou i. We presen a new geomeric approach o PIR, and obain A -privae -server proocol wih communicaion O log n1/ 1/, removing he erm of previous schemes. This answers an open quesion of [14]. A -server proocol wih On 1/3 communicaion, polynomial preprocessing, and online wor On/ log r n for any consan r. This improves he On/ log n wor of [8]. Smaller communicaion for insance hiding [3, 14], PIR wih a polylogarihmic number of servers, robus PIR [9], and PIR wih fixed answer sizes [4]. To illusrae he power of our approach, we also give alernaive, geomeric proofs of some of he bes 1-privae upper bounds from [7]. 1 Inroducion Privae informaion rerieval PIR was inroduced in a seminal paper by Chor e al [11]. In such a scheme a server holds an n-bi sring x {0, 1} n, represening a daabase, and a user holds an index i [n] def = {1,..., n}. A he end of he proocol he user should learn x i and he server should learn nohing abou i. A rivial soluion is for he server o send he user x. While privae, he communicaion complexiy is linear in n. In conras, in a non-privae seing, here is a proocol wih only log n + 1 bis of communicaion. This raises he quesion of how much communicaion is really necessary o achieve privacy. Suppored by an NDSEG fellowship. Suppored in par by NTT Award MIT and NSF gran CCR Unforunaely, if informaion-heoreic privacy is required, hen here is no beer soluion han he rivial one [11]. To ge around his, Chor e al [11] suggesed replicaing he daabase among > 1 non-communicaing servers. In his seing, one can do subsanially beer. Indeed, Chor e al [11] give a proocol wih complexiy On 1/3 for as few a wo servers, and an O log n 1/ soluion for he general case. Ambainis [1] hen exended he On 1/3 proocol o achieve O n 1/ 1 complexiy for every. Finally, in [7], building upon [14, 5], Beimel e al reduce log log he communicaion o Õ n log. For consan, he laer is he bes upper bound o dae. The bes lower bound is a humble c log n for some small consan c > 1 [18]. For a survey, see [1]. A drawbac of all of hese soluions is ha if any wo servers communicae, hey can compleely recover i. This moivaes he noion of a privacy hreshold, 1, which limis he number of servers ha migh collude in order o ge informaion abou i. Tha is, he join view of any servers should be independen of i. The case > 1 was addressed in [11, 14, 5]. Beimel and Ishai [5] give he bes. n1/ 1/ upper bound prior o his wor: O Since his bound grows rapidly wih, in [14] i is ased: Can one avoid he overhead induced by our use of replicaion-based secre sharing? We give a scheme wih communicaion O log n1/ 1/ for any, and hus answer his quesion in he affirmaive. Our upper bound is of considerable ineres in he oracle insance-hiding scenario [, 3]. In his seing here is a funcion F m : {0, 1} m m {0, 1} held by c log m oracles. The user has P {0, 1} m, and wans o privaely rerieve F m P, even if up o oracles collude. The user s compuaion, le alone he oal communicaion, should be polynomial in m. For consan, running our PIR scheme on he ruh able of F m gives a scheme wih oal communicaion Õmc/+. This improves he previous bound 1 of Õmc/++ see [14] by a facor of 1 The bes upper bound for 1-privae PIR [7] does no apply since i is

2 m. When m = log n, his is exacly he problem of PIR wih = Ωlog n/ log log n, for which we obain he bes nown bound. Anoher applicaion of our echniques is -ou-of-l robus PIR [9]. In his scenario a user should be able o recover x i even if afer sending his queries, up o l servers do no respond. Previous bounds for his problem include On 1/ log log l log l and Õ n log l log l [9]. The firs bound is wea for small, while he second is wea for large. We improve upon hese wih a -ou-of-l robus proocol wih communicaion On 1/ 1 l log l. Anoher concern wih he abovemenioned soluions is he ime complexiy of he servers per query. Beimel e al [8] show, among oher hings, ha if wo servers are given polynomial-ime preprocessing, hen during he online sage hey can respond o queries wih On/ log n wor, while preserving On 1/3 oal communicaion. By combining a balancing echnique similar o ha in [10] wih a specially-designed -server proocol in our language, we can reduce he wor o On/ log r n for any consan r > 0. I is immediae from our consrucion ha if a server has answers of size a for any a = On 1/3, hen here is a -server proocol wih query size On/a. This, in paricular, resolves an open quesion of [4]. We noe ha using echniques similar o hose in [6], our 1-privae proocols can be modified o achieve he bes nown probe complexiy, which measures he number of bis he user needs o read in he server s answers. Moreover, since we improve upon Theorem 6.1 and Corollary 6.3 of [6], our consrucion also yields minor improvemens for PIR schemes wih logarihmic query lengh, yielding efficien locally decodable codes over large alphabes. Finally, our echniques are of independen ineres, and may serve as a ool for obaining beer upper bounds. As an example of he model s power, we give a new geomeric proof of he bes nown upper bound for 1-privae -server PIR proocols of [7] for < 6. The general idea behind our proocols is he idea of polynomial inerpolaion. As in previous wor, we model he daabase as a degree-d polynomial F F q [z 1,..., z m ] wih m = Odn 1/d. The polynomial F is such ha here is an encoding E : [n] F m q for which F Ei = x i for every i [n]. The user wans o rerieve he value F P for P = Ei while eeping he ideniy of P privae. To his end he user randomly selecs a low-dimensional affine variey i.e. line, curve, plane, ec. χ F m q conaining he poin P and discloses cerain subvarieies of χ o he servers. Each server compues and reurns he values of F and he values of parial derivaives of F a every poin on is subvariey. Finally, he user reconsrucs he resricno nown how o mae i -privae, and in any case, he dependence on here is Ω. ion of F o χ. In paricular he user obains he desired value of F P. The idea of polynomial inerpolaion has been used previously in he privae informaion rerieval lieraure [, 11, 3]; however, we significanly exend and improve upon earlier echniques hrough he use of derivaives and more general varieies. Ouline: In secion we inroduce our noaion and provide some necessary definiions. In secion 3 we describe a non-recursive 1-privae PIR proocol on a line. We also discuss he robusness of our proocol. Secion 4 deals wih - privae PIR proocols for arbirary, and discusses applicaions o insance-hiding. The underlying variey is a curve. In secion 5 we presen our consrucion of PIR proocols wih preprocessing. Finally, in secion 6 we wrap up wih a geomeric proof of some of he upper bounds of [7]. The underlying variey is a low dimensional affine space. Preliminaries By defaul, variables λ h ae values in a finie field F q and variables P, V, V j, Q and Q j ae values in F m q. Le W be an elemen of F m q. We use he subscrip W l o denoe he l-h componen of W. A -server PIR proocol involves servers S 1,..., S, each holding he same n-bi sring x he daabase, and a user U who nows n and wans o rerieve some bi x i, i [n], wihou revealing i. We resric our aenion o oneround, informaion-heoreic PIR proocols. Definiion : [7] A -privae PIR proocol is a riple of algorihms P = Q, A, C. A he beginning of he proocol, he user U invoes Q, n, i o pic a randomized -uple of queries q 1,..., q, along wih an auxiliary informaion sring aux. I sends each server S j he query q j and eeps aux for laer use. Each server S j responds wih an answer a j = A, j, x, q j. We can assume wihou loss of generaliy ha he servers are deerminisic; hence, each answer is a funcion of a query and a daabase. Finally, U compues is oupu by applying he reconsrucion algorihm C, n, a 1,..., a, aux. A proocol as above should saisfy he following requiremens: Correcness : For any, n, x {0, 1} n and i [n], he user oupus he correc value of x i wih probabiliy 1 where he probabiliy is over he randomness of Q. -Privacy : Each collusion of up o servers learns no informaion abou i. Formally, for any, n, i 1, i [n], and every T [] of size T he disribuions Q T, n, i 1 and Q T, n, i are idenical, where Q T denoes concaenaion of j-h oupus of Q for j T. The communicaion complexiy of a PIR proocol P, denoed C P n, is a funcion of and n measuring he oal number of bis communicaed beween he user and

3 servers, maximized over all choices of x {0, 1} n, i [n] and random inpus. In our proocols we represen he daabase x by a mulivariae polynomial F z 1,..., z m over a finie field. The imporan parameers of he polynomial F are is degree d and he number of variables m. A very similar represenaion has been used previously in [7]. An imporan difference of our represenaion is ha we use polynomials over fields larger han F. The polynomial F represens x in he following sense: wih every i [n] we associae a poin Ei F m q ; he polynomial F saisfies: i [n], F Ei = x i. We use he assignmen funcion E : [n] F m q from [7]. Le E1,..., En denoe n disinc poins of Hamming weigh d wih coordinae values from he se {0, 1} F q. Such poins exis if m d n. Therefore m = Odn 1/d variables are sufficien. Define n F z 1,..., z m = z l, i=1 x i Ei l =1 Ei l is he l-h coordinae of Ei. Since each Ei is of weigh d, he degree of F is d. Each assignmen Ei o he variables z i saisfies exacly one monomial in F whose coefficien is x i ; hus, F Ei = x i. Our consrucions rely heavily on he noion of a derivaive of a polynomial over a finie field. Recall ha for fλ = a 0 + d a i λ i F q [λ] he derivaive is defined i=1 by f λ = d ia i λ i 1. i=1 We conclude he secion wih wo echnical lemmas. Lemma 1 Le f F q [λ] and s charf q 1. Suppose fλ 0 = f λ 0 =... = f s λ 0 = 0, hen λ λ 0 s+1 f. Proof: See lemma 6.51 in [15] and noe ha s! 0. Lemma Suppose {λ h }, {v 0 h }, {v1 h } are elemens of F q, where h [s] and {λ h } are disinc; hen here exiss a mos one polynomial fλ F q [λ] of degree s 1 such ha fλ i = v 0 h and f λ h = v 1 h. Proof: Assume here exis wo such polynomials f 1 λ and f λ. Consider heir difference f = f 1 f. Clearly, fλ h = f λ h = 0 for all h [s]. Therefore, by lemma 1 s λ λ h fλ. h=1 The Hamming weigh of a vecor is defined o be he number of nonzero coordinaes. This divisibiliy condiion implies ha fλ = 0 since he degree of f is a mos s 1. 3 PIR on he line We sar his secion wih a PIR proocol of [11]. This proocol has a simple geomeric inerpreaion and has served as he saring poin for our wor. Theorem 3 [11] There exiss a 1-privae - server PIR proocol wih communicaion complexiy O log n 1/ 1. Proocol descripion : Consider a finie field F q, where < q. Le λ 1,..., λ F q be disinc and nonzero. Se d = 1. Le P = Ei. The user wans o rerieve F P. U : Pics V F m q uniformly a random. U S h : P + λ h V U S h : F P + λ h V Privacy : I is immediae o verify ha he inpu P + λ h V of each server S i is disribued uniformly over F m q. Thus he proocol is privae. Correcness : We need o show ha values F P +λ h V for h [] suffice o reconsruc F P. Consider he line L = {P + λv λ F q } in he space F m q. Le fλ = F P + λv be he resricion of F o L. Clearly, f F q [λ] is a univariae polynomial of degree a mos d = 1. Noe ha fλ h = F P + λ h V. Thus U nows he values of fλ a poins and herefore can reconsruc fλ. I remains o noe ha F P = f0. Complexiy : The user sends each of servers a lenghm vecor of values in F q. Recall ha m = Odn 1/d and < q. Thus he oal communicaion from he user o all he servers is O log n 1/ 1. Each S h responds wih a single value from F q, which does no affec he asympoic communicaion of he proocol. In he proocol above here is an obvious imbalance beween he communicaion from he user o he servers and vice versa. The nex heorem exends he echnique of Theorem 3 o fix his imbalance and obain a beer communicaion complexiy. Theorem 4 There exiss a 1-privae -server PIR proocol wih communicaion complexiy O log n 1/ 1. Proocol descripion : We use he sandard mahemaical noaion F z l Q o denoe he value of he parial derivaive of F wih respec o z l a poin Q. Le λ 1,..., λ F q be

4 disinc and nonzero. Se d = 1. Le P = Ei. The user wans o rerieve F P. U : Pics V F m q uniformly a random. U S h : P + λ h V U S h : F P + λ h V, F P z,..., F P 1 z +λh V m +λh V Privacy : The proof of privacy is idenical o he proof from Theorem 3. Correcness : Again, consider he line L = {P + λv λ F q }. Le fλ = F P + λv be he resricion of F o L. Clearly, fλ h = F P + λ h V. Thus he user nows he values {fλ h } for all h []. However, his ime he values {fλ h } do no suffice o reconsruc he polynomial f, since he degree of f may be up o 1. The main observaion underlying our proocol is ha nowing he values of parial derivaives F P z,..., F P 1 z +λh V m, he user can reconsruc he +λh V value of f λ h. The proof is a sraighforward applicaion of he chain rule: f λ = λh F P + λv λ m F = λh z l l=1 P +λh V Thus he user can reconsruc {fλ h } and {f λ h } for all h []. Combining his observaion wih Lemma, we conclude ha user can reconsruc f and obain F P = f0. Complexiy : The user sends each of servers a lengh-m vecor of values in F q. Servers respond wih lengh-m + 1 vecors of values in F q. Recall ha m = Odn 1/d and q. Thus he oal communicaion is O log n 1/ Applicaion o Robus PIR We review he definiion of robus PIR [9]. Definiion 5 A -ou-of-l PIR proocol is a PIR proocol wih he addiional propery ha he user always compues he correc value of x i from any ou of l of he answers. As noed in [9], robus PIR has applicaions o servers which may hold differen versions of a daabase, as long as some have he laes version and here is a way o disinguish hese. Anoher applicaion is o servers wih varying response imes. Here we improve he wo bounds log log log l log l and On 1/ l log l given in [9]. Õ n Indeed, in he proocol above, if for l servers we se he field size q > l and he degree deg F = 1, hen from any servers answers, we can reconsruc f as before. We conclude V l. Theorem 6 There exiss a -ou-of-l robus PIR wih communicaion On 1/ 1 l log l. 4 PIR on he curve Theorem 7 There exiss a -privae -server PIR proocol 1 wih communicaion complexiy O log n1/. Proocol descripion : Again, consider F q, where < q and le λ 1,..., λ F q be disinc and nonzero. Se d = 1. Le P = Ei. The user wans o rerieve F P. U : Randomly pics V 1,..., V F m q. U S h : Q h def = P + λ h V 1 + λ h V λ h V U S h : F Q h, F Q F Q z 1,..., h z m h Privacy : We need o show ha for every T [], where T ; he collusion of servers {S h } learns no informaion abou he poin P = Ei. The join inpu of servers {S h } is {P + λ h V λ h V }. Since he coordinaes are shared independenly, i suffices o show ha for each l [m] and V j l F q chosen independenly and uniformly a random; he values {P l + λ h Vl λ h V l } disclose no informaion abou P l. The las saemen is implied by he properies of Shamir s secre sharing scheme [17]. Correcness : Consider he curve χ = {P +λv λ V λ F q }. Le fλ = F P + λv λ V be he resricion of F o χ. Obviously, f is a univariae polynomial of degree a mos 1. By definiion, we have fλ h = F Q h ; hus U nows he values {fλ h } for all h []. Now we shall see how nowing he values of parial derivaives F Q F Q z 1,..., h z m U reconsrucs h he value of f λ h. Again, he reconsrucion is a sraighforward applicaion of he chain rule: f λ = F P + λv λ V λh λ = m F z l l=1 Q h λh λ P l + λvl λ V l λh Thus U can reconsruc {fλ h } and {f λ h } for all h []. Combining his observaion wih Lemma, we conclude ha he user can reconsruc f and obain F P = f0. Complexiy : As in he proocol of Theorem 4, U sends each of servers a lengh-m vecor of values in F q and servers respond wih lengh-m + 1 vecors of values in F q. Here m = Odn 1/d and q. Thus he oal communicaion is O 1 log n1/.

5 4.1 Applicaion o Insance Hiding As noed in he inroducion, in he insance-hiding scenario [, 3] here is a funcion F m : {0, 1} m {0, 1} held m by c log m oracles for some consan c. The user has a poin P {0, 1} m and should learn F m P. Furher, he view of up o oracles should be independen of P. We have he following improvemen upon he bes nown Õmc/++ bound of [14]. Theorem 8 There exiss a -privae non-adapive oracle insance-hiding scheme wih communicaion and compuaion Õmc/+ def, where Õf = Of log O1 f. Proof: Using he above proocol on he ruh able of F m, he communicaion is O log n1/ 1/ = Õ m m 1/ 1 = Õmc/+. I is also easy o see ha U runs in ime which is quasilinear in he communicaion. 5 PIR wih preprocessing To measure he efficiency of an algorihm wih preprocessing, we use he definiion of wor in [8] which couns he number of precompued and daabase bis ha need o be read in order o respond o a query. The goal of his secion is o prove he following heorem. Theorem 9 There exiss a -server PIR proocol wih On 1/3 communicaion, polyn preprocessing, and On/ log r server wor for any consan r. We need a lemma abou preprocessing polynomials F F p [z 1,..., z m ]. We assume he number of variables m is ending o infiniy, while he degree of F is always consan. The lemma is similar o Theorem 3.1 of [8]. The main idea is o wrie he inpu polynomial F as a sum of polym differen polynomials over disjoin monomials. We do his so ha each summand polynomial G involves only a logarihmic number of variables, and hus we can precompue G on all possible assignmens o is variables. As he differen G are over disjoin monomials, o evaluae F V we simply read one precompued answer for each G, and sum hem up. Lemma 10 Le F be a homogeneous degree-d polynomial in F p [z 1,..., z m ]. Using polym preprocessing ime, for all V F m p, F V can be compued wih Om d / log d m wor. Proof: Pariion [m] ino α = m/ log m disjoin ses D 1,..., D α of size log m. For every sequence 1 1,..., d α, le F D1,...,D d denoe he sum of all monomials of F of he form cz i1 z id for some c F p and i 1 D 1,..., i d D d. The following is he preprocessing algorihm. PreprocessF: 1. For each polynomial F D1,...,D d, a Evaluae F D1,...,D d on all W F m p for which SuppW i D i. Time Complexiy: There are α d = m/ log m d polynomials F D1,...,D d. For each polynomial, here are a mos p d log m = polym differen W whose suppor is in i D i. Thus he algorihm needs only polym preprocessing ime. For a se S [m], le V S denoe he poin V F m p wih V j = V j for j S and V j = 0 oherwise. The following describes how o compue F V. EvaluaeF, V : 1. σ 0.. For each polynomial F D1,...,D d, a σ σ + F D1,...,D d V id i. 3. Oupu σ. Correcness: Immediae from F V = F D1,...,D d V id i. 1,..., d Wor: The sum is over α d = m/ log m d polynomials F D1,...,D d, each wih a precompued answer, and hus he oal wor is Om d / log d m. 5.1 Two server proocol We sar wih he inuiion underlying our wo server preprocessing proocol. Suppose he servers were o represen he daabase as a degree-d polynomial F in m = Θn 1/d variables, where d = r + 1 is an arbirary odd consan. Proceeding as in he proocol of secion 3, he user sends each server a poin on a random line L hrough his poin of ineres. To reconsruc F L, he user needs he evaluaion of F on his query poins, ogeher wih all parial derivaives of F up o order r. The observaion is ha each parial derivaive compued by he servers is a polynomial of degree a leas d r = r + 1 in a mos m variables, and herefore we can apply Lemma 10 o achieve low server wor. However, while he user is only sending Om bis o he servers, he servers answers are of size Om r. To fix his, we use a balancing echnique similar o ha in [10]. Each server pariions he daabase ino daabases F j of size n/,

6 for some parameer. Each daabase will be represened as a degree d polynomial in m = On/ 1/d variables. The user sends poins o each server, one for each daabase. Suppose he user wans F u P. For he 1 daabases F j, j u, ha he user doesn care abou, he sends random V j and V j o servers 1 and respecively. On he oher hand, for he daabase F u ha he cares abou, he proceeds as in he proocol of secion 3. The servers compue he liss of parial derivaives for each daabase, as before, bu insead of sending hem bac, hey send he sum of each parial derivaive over all daabases. We show his informaion is sufficien for he user o reconsruc F u P. The oal wor will be On/ log r+1 n, and by carefully choosing, we can eep he communicaion a On 1/3. Consider a prime 3 field F p for some max, r < p < max, r. Such a prime p exiss by he Berrand s Posulae [16]. S 1 and S preprocess as follows. Preprocessing phasex: 1. s r 1 3r, ns.. Pariion x ino daabases DB 1,..., DB, each conaining n 1 s elemens. 3. Represen DB j as a homogeneous polynomial F j of degree d = r + 1 wih m = O n 1 s/d vars. 4. For a = 0,..., r, for j [], and for l 1,..., l a [m], compue Preprocess a F j z l1 z la. Le DB u be he daabase conaining x i. Assume he user wans F u P. Le δ α,β be 1 if α = β, and 0 oherwise. U : Randomly pics V 1,..., V F m p. U S h : h,j def For j [], Q = 1 h+1 V j + δ j,u P U S h : a {0,..., r} and l 1,..., l a [m], a F j Q j=1 z l1...z = la h,j j=1 Evaluae a F j z l1...z la, Q h,j Correcness: Since d is odd, for all V a F j z l1 z la = 1 a+1 a F j V z l1 z la I follows ha for all a and all j u, a F j z l1 z la + 1aa F j V j z l1 z la l 1,...,l a l 1,...,l a V V j = 0. Pu fλ = F u P +λv u, and define gλ = fλ + 3 In secions 5 and 6 we base our proocols on prime fields F p and do no consider general finie fields F q. We do his o avoid issues relaed o suble properies of derivaives of orders greaer han one in finie fields of small characerisic. Anoher possible soluion o his problem is o use Hasse derivaives referred o as hyperderivaives in [15] insead of usual derivaives. This allows for proocols over arbirary finie fields. f λ. We have a F j Q 1,j z j l1 z la l 1,...,l a + 1a a F j z l1 z la = a F u z l1 z la l 1,...,l a + 1a a F u z l1 z la P +V u Q,j P V u V u l 1 V u l a V u l 1 V u l a V u l 1 V u l a V u l 1 V u l a = f a a f a 1 = g a 1. Thus U can compue g1, g 1 1,..., g r 1 from he answers. Since every monomial of g has even degree, for γ = λ we can define hγ = gλ for a degree-r polynomial h. Using ha dg dλ = dh dγ dγ dλ = λdh dγ, a simple inducion shows ha from g 0 1,..., g r 1, U can compue h 0 1,..., h r 1. The claim is ha hese values deermine h. Indeed, if h 1 h agree on hese values, hen by lemma 1 γ 1 r+1 h1 h, which conradics ha h 1 h has degree a mos r. Hence he user obains h0 = g0 = f0 = F P, and hus F P since he characerisic p >. Privacy: Since he V j are independen and uniformly random, so are he Q 1,j and he Q,j. Thus he view of each of S 1, S is independen of P. Communicaion: U sends Om = On s+1 s/r+1 = On r 1/3r+1/3r = On 1/3 bis. S 1, S respond wih Om + m + + m r = Om r = On 1 sr/r+1 = On 1/3 bis. Server Wor: Noice ha he wor is dominaed by he calls o Evaluae. For any a {0,..., r}, any l 1,..., l a [m], and any j [], he polynomial a F j z l1 z la is eiher 0 or has degree r + 1 a, and a mos m variables. Thus for any V, Evaluae a F j z l1 z la, V can be compued in Om r+1 a / log r+1 a m ime. As he number of such a F j z l1 z la is Om a, i follows ha he ime for all calls o Evaluae per DB is m a m r+1 a O log r+1 a m a = Omd log r+1 m = On1 s log r+1 n. Thus he oal wor over all n s DBs is On/ log r+1 n.

7 5. Applicaion o PIR wih fixed answer sizes In [4] i is ased: For wo-server PIR proocols and for consan b, if he answers have size a mos b, can he queries have size less han n/b? We answer his wih he following heorem. Theorem 11 For any b = On 1/3, here exiss a server PIR proocol wih answer lengh Ob and query lengh On/b, where he consan in he big-oh is independen of n and b. Proof: Before he proocol begins, S 1 and S pariion x ino = On/b 3 daabases DB 1,..., DB each of size Ob 3. Each such DB is a degree-3 polynomial in m = Ob variables. Le DB u be he daabase conaining x i. The proocol follows. U : Randomly pics V 1,..., V F m p. U S h : h,j def For j [], Q U S h : = 1 h+1 V j + δ j,u P j F jq h,j, and l [m], j F j z l Q h,j The correcness follows from he correcness of our preprocessing proocol for r = 1. For he communicaion, U sends m = On/b bis, and S 1 and S each respond wih Ob bis. 6 Recursive PIR in he space Assume is consan. The bes nown upper bound of log log n O log for he communicaion complexiy of 1-privae server PIR proocols is due o Beimel e al. [7]. Alhough heir proof is elemenary, i is raher complicaed and hard o follow. The ey heorem of [7] is: Theorem 1 [7] Theorem 3.5 Suppose here is a 1- privae PIR proocol P wih communicaion complexiy C P n,. Le d, λ, be posiive inegers which may depend on such ha < and d λ + 1 λ 1 + λ. Then here is a 1-privae PIR proocol P wih communicaion complexiy C P n, = O n 1/d + C P n λl/d, l. l l= Recursive applicaions of Theorem 1 saring from a - server proocol wih communicaion complexiy On 1/3 yield he bes nown upper bounds for 1-privae PIR. In his secion we presen an alernaive geomeric proof of he special case of Theorem 1 ha corresponds o seing he value of parameer λ =. This case is sufficien o obain 1-privae PIR proocols wih communicaion complexiy maching he resuls of [7] for all values of < 6, where he bound on was deermined experimenally. Theorem 13 Suppose here is a 1-privae PIR proocol P wih communicaion complexiy C P n,. Le d, be posiive inegers such ha < and d 3. Then here is a 1-privae PIR proocol P wih communicaion complexiy C P n, = O n 1/d + C P n /d,. I may seem ha he bound of Theorem 13 improves upon he bound of Theorem 1 since here are no erms corresponding o values of l [ + 1, ]. However his is no a real improvemen, since he original proof of Theorem 1 can also be modified o eliminae hese erms. We sar wih a high-level view of our proocol. U wans o rerieve he value F P. To his end U randomly selecs a dimensional affine subspace 4 πl conaining he poin P and sends each server S h a 1 dimensional affine subspace 5 πl h πl. Each S h replies wih values and derivaives of he polynomial F a every poin of πl h. We assume he subspaces πl h are in general posiion. In paricular his implies ha for every se T of servers here is a unique poin P T = πl h ha is nown o all of hem. For each subse T of servers U runs a separae - server 1-privae PIR proocol o obain he value of a -h parial derivaive of he funcion F a poin P T in he direcion owards he poin P. Finally we demonsrae ha he informaion abou F obained by U suffices o reconsruc he resricion of F o πl. 6.1 Preliminaries In wha follows we wor in a prime field F p wih max,, d < p. We sar wih some noaion. Le {α h } h [] be disinc and nonzero elemens of F p. For h [] le g h λ 1,..., λ def = α h λ 1 + α hλ α h λ 1. Le L = F p be a dimensional affine space over F p. Consider he hyperplanes L h L : L h def = {λ 1,..., λ g h λ 1,..., λ = 0} 4 We use he complicaed noaion πl for consisency wih he acual proof. 5 In cerain degenerae cases he dimensions of boh πl and πl h may in fac be smaller han and 1.

8 The properies of he Vandermonde marix imply ha for any T [], where T, he hyperplanes {L h } are in general posiion, i.e.: dim L h = T. 1 For T [], such ha T =, le Q T denoe he unique inersecion poin of {L h }. I.e: Q T def = L h. Consider a cerain hyperplane L h and a vecor v F p. We say ha vecor v = v 1,..., v is off he hyperplane L h if α h v 1 + αh v αh v 0. Clearly, for every hyperplane L h here exiss a vecor v F p ha is off L h. Consider he map π : L F m p induced by a uniformly random choice of {V j } j [ ] F m p for a fixed P F m p : πλ 1,..., λ def = P + λ 1 V λ V. Le P T denoe he image of Q T under π, i.e.: P T def = πq T. In he remaining par of his subsecion we esablish wo geomeric lemmas. The firs lemma concerns he nonrecursive par of our proocol. Lemma 14 Le f F p [λ 1,..., λ ], deg f < F p and h []. Suppose f Lh = 0 and f = 0, where v is off L h. Lh Then g h f. v Proof: The fac ha g h f is a direc consequence of Bézou s heorem [13] p To see ha g h divides f wice, le f = g g h. By he chain rule, f v = g v g h + g i α i hv i, and since v is off of L h, j αj h v j 0. Resricing boh sides o L h, he premise of he lemma implies 0 = g Lh, and anoher applicaion of Bézou s heorem gives g h g, which proves he lemma. The nex lemma concerns he recursive par of our proocol. 6 More formally, we have a polynomial f ha vanishes on every F p- poin of a hyperplane L h. This implies ha f vanishes on every F p-poin of L h, since F p > deg f. Now, once we have passed o he algebraically closed field F p, we can apply Bézou s heorem o conclude ha g h and f have a common facor, and herefore g h f. Lemma 15 Le f F p [λ 1,..., λ ]. Assume T [], T =. Suppose f = g g h and v F p is off every {L h } ; hen f v Q T = C gq T, where C 0 is some consan ha depends only on {g h }. Proof: Le C h = g h v = j αj h v j, and observe ha C h 0 since v is off of L h. By repeaed applicaion of he chain rule, a g h v a = δ a,! Ch, Q T where δ α,β is 1 if α = β and 0 oherwise. Again by he chain rule, f = gq T! C v h. Q T The lemma follows by seing C =! h C h. 6. The proocol Proocol descripion : As usual he daabase is represened by a degree d polynomial in m = Odn 1/d variables. Recall ha d 3. Therefore we can rea d as a consan. Le P = Ei. The user wans o rerieve F P. Our proocol is one-round. However as in he wor of [7] i is convenien o hin abou he proocol as several execuions of PIR proocols ha ae place in parallel. U sends servers he affine spaces πl h. Each server reurns he values of F on πl h and he values of all firs order parial derivaives of F on πl h. Moreover, U runs a separae PIR proocol wih every group T of servers o obain he value F P. Below is he formal descripion of P P T T he proocol. Here S T denoes he se of servers {S h }. U : Pics a random π : L F m p, πλ 1,..., λ = P + λ 1 V λ V U S h : πl h U S h : F πlh, F πlh F πlh z 1,..., z m U S T : A -server PIR subproocol for rerieving he value of F P P T P T To complee he descripion of he proocol, we need he following lemma.

9 Lemma 16 Le F z 1,..., z m be an m-variae polynomial of degree d, where d is a consan. Assume P = Ei F m p is a poin of Hamming weigh d. Le T [], T =. Suppose each of he servers {S h } nows he poin P T ; hen U can learn he value of he direcional derivaive s F P P T s P T privaely wih respec o i wih communicaion complexiy OC P m s,. Proof: We have s F P P P T = s T s F P z l1 z P P T ls l1 P P T ls, T l 1,...,l s and since P T and F are nown o all S h wih h T, hese servers can inerpre he RHS of equaion as an m- variae degree-s polynomial G in he ring F p [P 1,..., P m ]. Since deg G = s and he Hamming weigh of P is d, a mos d = O1 monomials M of G are nonzero on P. Thus, o learn GP i is enough for U o learn he coefficiens of hese M. To his end, U and hese servers run a PIR proocol on he lis of coefficiens of monomials M = P i1 P id for 1 i 1,..., i d m. The complexiy is herefore d C P Om s, = OC P m s,. We now show he desired properies of our proocol. Privacy : Since he subproocols are independen, and P is privae by assumpion recall he condiion of heorem 13, in order o show ha P is privae i suffices o show privacy a he op level of recursion. In his level S h s view is πl h = {P + λ 1 V λ V λ j F p, α h λ α h λ = 1}. Observe ha any poin in πl h is some linear combinaion over F p of he poins P + α h 1 V 1,..., P + α h 1 V πl h. Thus S h s view can be generaed from hese poins. Bu as disribuions, P + α h 1 V 1,..., P + α h 1 V R 1,..., R, where he R j F m p are independen and uniformly random. Thus S h s view does no depend P. Correcness: Le f def = F πλ 1,..., λ denoe he resricion of F o πl. We show he informaion ha U obains from {S h } h [] suffices o reconsruc f. Informaion abou F ranslaes ino informaion abou f: 1. For h [], f Lh = F πlh, so U can compue he values of f along every L h.. Now le h []. Le v h F p be a vecor ha is off he hyperplane L h. We show how o compue f Lh v h from F πlh F πlh z 1,..., z m From he chain rule. m l=1 F z l πlh f Lh v h = F πλ1,...,λ Lh v h = v h P l + λ 1 V 1 l λ V l. Lh Thus for every h [], U can compue values of f v h a every poin of L h. 3. Finally, le T [] be such ha T =. Le π l λ 1,..., λ denoe P l + λ 1 Vl λ Vl for l [m]. We have f Q Q = F πλ 1,...,λ = Q T T Q T T j=1 P l j Pl T j = l 1,...,l F z l1...z l P T F P P T P T, where we use ha π lλ 1,...,λ Q T Q T ha P l Pl T where T =, U can reconsruc = P l P T l, and is consan. Thus for every T [], f Q. Q T T Reconsrucing f: I suffices o show he above informaion is sufficien o reconsruc f. Assume here are wo funcions f 1 f F p [λ 1,..., λ ] ha agree on all of he consrains above. Consider heir difference f = f 1 f. We shall prove ha f is idenically zero. By Lemma 14, f can be wrien as f = g gh, h=1 for some g F p [λ 1,..., λ ] wih deg g d. We induc downwards on r, saring wih r =, o show g L h = 0 for every se T of size r. I will follow for r = 0 ha g L = 0, and hus g = 0. For r =, since Q T is off L h for every h T, by Lemma 15 and he above, gq T = 0 for every T [] wih T = r. Le r < and assume inducively ha g L h = 0 for every se T of size greaer han r. Le M = L h for an arbirary se T of size r. Then dimm = r recall

10 equaion 1. Consider he r 1-dimensional spaces of he form M = {j} L h for some j [] \ T. There are r of hem. Then in he space M, he M are disinc hyperplanes and can herefore be described as soluions o ρ M = 0 for degree-1 polynomials ρ M. Applying Bézou s heorem, g M. M ρ M The degree of g M is a mos d since M is an affine space, while deg M ρ M = r. Bu since d 3 by assumpion and r < by inducion, we have d < r, which means ha g M = 0. By inducion, f = g = 0, which complees he proof. Complexiy : In he non-recursive seps, U sends each S h he space πl h described by vecors in F m p. S h responds wih F πlh and F z 1 πlh,..., F z m πlh, which is jus a lis of m + 1p = O1 values 7 in F p. In he recursive seps, by Lemma 16 he oal communicaion is O C P m,. Since m = On 1/d, he oal communicaion of our proocol is C P n, = O n 1/d + C P n /d,. Acnowledgemen S. Yehanin would lie o express his deep graiude o M. Sudan for inroducing he problem o him and many helpful discussions during his wor. References [1] A. Ambainis, Upper bound on he communicaion complexiy of privae informaion rerieval, Proc. of 3h ICALP, LNCS 156, pp , [] D. Beaver and J. Feigenbaum. Hiding insances in mulioracle queries. Proc. of STACS 90, LNCS 415, pp , [3] D. Beaver, J. Feigenbaum, J. Kilian and P. Rogaway. Locally Random Reducions: Improvemens and Applicaions. In Journal of Crypology, 101, pp , [4] R. Beigel, L. Fornow, and W. Gasarch. A nearly igh lower bound for privae informaion rerieval proocols. Technical Repor TR03-087, Elecronic Colloquim on Compuaional Complexiy ECCC, Noe ha we did no aemp o opimize his consan. [5] A. Beimel and Y. Ishai. Informaion-Theoreic Privae Informaion Rerieval: A Unified Consrucion. In 8h ICALP, LNCS 076, pp , 001. [6] A. Beimel, Y. Ishai, and E. Kushileviz. General Consrucions for Informaion-Theoreic Privae Informaion Rerieval. Unpublished manuscrip available a [7] A. Beimel, Y. Ishai, E. Kushileviz, and J. F. Raymond. Breaing he Barrier for Informaion-Theoreic Privae Informaion Rerieval. In Proc. of he 43rd IEEE Symposium on Foundaions of Compuer Science FOCS, pp , 00. [8] A. Beimel, Y. Ishai, and T. Malin. Reducing he servers compuaion in privae informaion rerieval: Pir wih preprocessing. In Crypo 000, LNCS 1880, pp [9] A. Beimel and Y. Sahl. Robus informaion-heoreic privae informaion rerieval. In Proceedings of he 3rd conference on securiy in Communicaions newors SCN, pp , 00. [10] B. Chor and N. Gilboa. Compuaionally privae informaion rerieval. In Proc. of he 3h ACM Sym. on Theory of Compuing STOC, pp , 000. [11] B. Chor, O. Goldreich, E. Kushileviz and M. Sudan. Privae informaion rerieval. In Proc. of he 36rd IEEE Symposium on Foundaions of Compuer Science FOCS, pp , Also, in Journal of he ACM, 45, [1] B. Gasarch, A Webpage on Privae Informaion Rerieval, hp:// gasarch/pir/pir.hml [13] R. Harshorne, Algebraic geomery. New Yor : Springer, [14] Y. Ishai and E. Kushileviz. Improved upper bounds on informaion-heoreic privae informaion rerieval. In Proc. of he 31h ACM Sym. on Theory of Compuing STOC, pp , [15] R. Lidl and H. Niederreier, Finie Fields. Cambridge: Cambridge Universiy Press, [16] T. Nagell. Inroducion o Number Theory. New Yor: Wiley, [17] A. Shamir. How o share a secre. Communicaions of ACM, :61-613, [18] S. Wehner and R. de Wolf, Improved Lower Bounds for Locally Decodable Codes and Privae Informaion Rerieval, preprin available from he LANL quanph archive , 004.