Piano: Extremely Simple, Single-server PIR with Sublinear Server Computation

experiment/pir/piano/BUILD.bazel

@@ -0,0 +1,99 @@
+# Copyright 2023 Ant Group Co., Ltd.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#   http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+load("@rules_cc//cc:defs.bzl", "cc_proto_library")
+load("@rules_proto//proto:defs.bzl", "proto_library")
+load("//bazel:psi.bzl", "psi_cc_binary", "psi_cc_library", "psi_cc_test")
+
+package(default_visibility = ["//visibility:public"])
+
+proto_library(
+    name = "piano_proto",
+    srcs = ["piano.proto"],
+)
+
+cc_proto_library(
+    name = "piano_cc_proto",
+    deps = [":piano_proto"],
+)
+
+psi_cc_library(
+    name = "util",
+    srcs = ["util.cc"],
+    hdrs = ["util.h"],
+    deps = [
+        "@yacl//yacl/crypto/aes:aes_intrinsics",
+        "@yacl//yacl/crypto/rand",
+    ],
+)
+
+psi_cc_library(
+    name = "serialize",
+    srcs = ["serialize.h"],
+    deps = [
+        ":piano_cc_proto",
+        ":util",
+        "@yacl//yacl/base:buffer",
+    ],
+)
+
+psi_cc_library(
+    name = "server",
+    srcs = ["server.cc"],
+    hdrs = ["server.h"],
+    deps = [
+        ":piano_cc_proto",
+        ":serialize",
+        ":util",
+        "@yacl//yacl/link:context",
+    ],
+)
+
+psi_cc_library(
+    name = "client",
+    srcs = ["client.cc"],
+    hdrs = ["client.h"],
+    deps = [
+        ":piano_cc_proto",
+        ":serialize",
+        ":util",
+        "@yacl//yacl/link:context",
+    ],
+)
+
+psi_cc_test(
+    name = "piano_test",
+    timeout = "eternal",
+    srcs = ["piano_test.cc"],
+    deps = [
+        ":client",
+        ":server",
+        ":util",
+        "@yacl//yacl/link:context",
+        "@yacl//yacl/link:test_util",
+    ],
+)
+
+psi_cc_binary(
+    name = "piano_benchmark",
+    srcs = ["piano_benchmark.cc"],
+    deps = [
+        ":client",
+        ":server",
+        ":util",
+        "@com_github_google_benchmark//:benchmark_main",
+        "@yacl//yacl/link:context",
+        "@yacl//yacl/link:test_util",
+    ],
+)

experiment/pir/piano/README.md

@@ -0,0 +1,62 @@
+# Piano PIR: Single-Server Private Information Retrieval with Sublinear Computation
+
+## Scheme Parameters and Notation
+
+- $\kappa$: Statistical security parameter
+- $\lambda$: Computational security parameter
+- $\alpha(\kappa)$: Arbitrarily small super-constant function
+- $n$: Database size
+- $Q = \sqrt{n} \log \kappa \cdot \alpha(\kappa)$: Total number of queries
+
+## Preprocessing Phase
+
+### Client-Side Initialization
+
+1. **Primary Table Generation**
+
+   - Sample $M_1 = \sqrt{n} \log \kappa \cdot \alpha(\kappa)$ PRF keys, $\\{sk_1, \ldots, sk_{M_1}\\} \in \\{0,1\\}^{\lambda}$
+   - Initialize parities $\\{p_1, \ldots, p_{M_1}\\}$ to zeros
+2. **Backup Table Generation**
+
+   - For each chunk $j \in \\{0, 1, \ldots, \sqrt{n} - 1\\}$:
+      - Sample $M_2 = \log \kappa \cdot \alpha(\kappa)$ PRF keys $\\{sk_{j,1}, \ldots, sk_{j,M_2}\\}$
+      - Initialize chunk-specific parities $\\{p_{j,1}, \ldots, p_{j,M_2}\\}$ to zeros
+
+### Streaming Database Preprocessing
+
+For each database chunk $DB[j \sqrt{n} : (j+1) \sqrt{n}]$:
+
+- Update primary table parity: for $i \in [M_1]$, $p_i \leftarrow p_i \oplus DB[\text{Set}(sk_i)[j]]$
+- Store replacement entries: sample $M_2$ tuples $(r, DB[r])$ where $r$ is a random index from the current chunk
+- Update backup table parity: for $i \in \\{0, 1, \ldots, \sqrt{n} - 1\\} \setminus \\{j\\}$ and $k \in [M_2]$, $p_{i,k} \leftarrow p_{i,k} \oplus DB[\text{Set}(sk_{i,k})[j]]$
+- Delete current chunk from local storage
+
+## Online Query Phase
+
+Query Protocol for Index $x \in \\{0, 1, \ldots, n-1\\}$
+
+1. **Query Execution**
+
+   - Find primary table hint $T_i = ((sk_i, x^{\prime}), p_i)$ where $x \in \text{Set}(sk_i, x^{\prime})$
+   - Locate chunk $j^* = \text{chunk}(x)$
+   - Find first unused replacement entry $(r, DB[r])$
+   - Send set $S' = S \setminus \\{j^* \to r\\}$ to server
+   - Server returns $q = \bigoplus_{k \in S'} DB[k]$
+   - Compute answer $\beta = q \oplus p_i \oplus DB[r]$
+2. **Table Refresh Mechanism**
+
+   - Locate next unused backup entry $(sk_{j^\*,k}, p_{j^\*,k})$
+   - If no entry exists, generate random $sk_{j^\*,k}$ with $p_{j^\*,k} = 0$
+   - Update primary table with new entry: $((sk_{j^\*,k}, x), p_{j^\*,k} \oplus \beta)$
+
+## Theoretical Guarantees
+
+- **Client Storage**: $O(\sqrt{n})$
+- **Amortized Server Computation**: $O(\sqrt{n})$
+- **Amortized Communication Overhead**: $O(\sqrt{n})$
+- **Query Complexity**: $O(\sqrt{n})$
+
+## References
+
+- **Paper**: [Piano PIR](https://eprint.iacr.org/2023/452)
+- **Implementation**: [GitHub Repository](https://github.com/wuwuz/Piano-PIR-new)