This paper presents Riposte, a new system for anonymous broadcast messaging. Riposte is the first such system, to our knowledge, that simultaneously protects against traffic-analysis attacks, prevents anonymous denial-of-service by malicious clients, and scales to million-user anonymity sets. To achieve these properties, Riposte makes novel use of techniques used in systems for private information retrieval and secure multi-party computation. For latency-tolerant workloads with many more readers than writers (e.g. Twitter, Wikileaks), we demonstrate that a three-server Riposte cluster can build an anonymity set of 2,895,216 users in 32 hours.
Our DPF constructions make extensive use of prior work on private information retrieval (PIR) @cite_20 @cite_48 @cite_30 @cite_60 . Recent work demonstrates that it is possible to make theoretical PIR fast enough for practical use @cite_80 @cite_51 @cite_56 . Function secret sharing @cite_78 generalizes DPFs to allow sharing of more sophisticated functions (rather than just point functions). This more powerful primitive may prove useful for PIR and anonymous messaging applications in the future.
@cite_30 @cite_78 @cite_60 @cite_48 @cite_56 @cite_80 @cite_51 @cite_20
2752936485 2524023279 2755521559 2739960748
We study the problem of Private Information Retrieval (PIR) in the presence of prior side information. The problem setup includes a database of @math independent messages possibly replicated on several servers, and a user that needs to retrieve one of these messages. In addition, the user has some prior side information in the form of a subset of @math messages, not containing the desired message and unknown to the servers. This problem is motivated by practical settings in which the user can obtain side information opportunistically from other users or has previously downloaded some messages using classical PIR schemes. The objective of the user is to retrieve the required message without revealing its identity while minimizing the amount of data downloaded from the servers. We focus on achieving information-theoretic privacy in two scenarios: (i) the user wants to protect jointly its demand and side information; (ii) the user wants to protect only the information about its demand, but not the side information. To highlight the role of side information, we focus first on the case of a single server (single database). In the first scenario, we prove that the minimum download cost is @math messages, and in the second scenario it is @math messages, which should be compared to @math messages, the minimum download cost in the case of no side information. Then, we extend some of our results to the case of the database replicated on multiple servers. Our proof techniques relate PIR with side information to the index coding problem. We leverage this connection to prove converse results, as well as to design achievability schemes. We consider the problem of private information retrieval (PIR) over a distributed storage system. The storage system consists of @math non-colluding databases, each storing a coded version of @math messages. In the PIR problem, the user wishes to retrieve one of the available messages without revealing the message identity to any individual database. We derive the information-theoretic capacity of this problem, which is defined as the maximum number of bits of the desired message that can be privately retrieved per one bit of downloaded information. We show that the PIR capacity in this case is @math , where @math is the rate of the @math code used. The capacity is a function of the code rate and the number of messages only regardless of the explicit structure of the storage code. The result implies a fundamental tradeoff between the optimal retrieval cost and the storage cost. The result generalizes the achievability and converse results for the classical PIR with replicating databases to the case of coded databases. The problem of private information retrieval with private side information (PIR-PSI) is recently introduced by In this problem, @math replicated databases each store @math messages, of which @math are known to the user as side-information. The identity of these @math messages is unknown to the databases. The user wishes to retrieve, as efficiently as possible, a new desired message without revealing any information about the joint indices of the desired and side-information messages. We show that the capacity of PIR-PSI is @math . Thus, the capacity of PIR-PSI with @math messages, @math databases and side-information of @math messages is identical to the capacity of PIR with @math messages, @math databases and no side-information, which was found previously by Sun and Jafar. The achievability and converse proofs are essentially inherited from the original work of Sun and Jafar. We consider the problem of private information retrieval (PIR) over a distributed storage system. The storage system consists of N non-colluding databases, each storing an MDS-coded version of M messages. In the PIR problem, the user wishes to retrieve one of the available messages without revealing the message identity to any individual database. We derive the information-theoretic capacity of this problem, which is defined as the maximum number of bits of the desired message that can be privately retrieved per one bit of downloaded information. We show that the PIR capacity in this case is C = (1 + K N + K2 N2 + ··· + KM−1 NN−1)−1 = (1 + R c + R2 c + ··· + RM c −1)−1 = 1−R c R c M, where R c is the rate of the (N, K) code used. The capacity is a function of the code rate and the number of messages only regardless of the explicit structure of the storage code. The result implies a fundamental tradeoff between the optimal retrieval cost and the storage cost. The result generalizes the achievability and converse results for the classical PIR with replicating databases to the case of coded databases.