a590003

OWrite(i 1 , . . . , i t ; v 1 , . . . , v t ): The client encrypts and writes (i j , v j ) into A 0 for each j, then initiates a
rebuild phase, described below.
A0
T (1)
1
T (1)
2
S (1) S (2) S (3) S (L)
T (2)
1
T (2)
2
T (3)
1
T (3)
2
...
T (L)
1
T (L)
2
Figure 2: Server data structures in the ORAM instantiation.
Rebuild phase. We complete the scheme description by describing a rebuild phase, which works as follows.
The client repeats the following process until A 0 is empty:
• Increment ctr.
• Remove and decrypt an item from A 0 , calling the result (j, v).
• Let r ≥ 0 be the largest integer such that 2 r divides (ctr mod 2 L ).
• Select new keys K r,1 , K r,2 and use the functions F (K r,1 , ·) and F (K r,2 , ·) as h 1 and h 2 to obliviously
build a new cuckoo table C ′ r holding the removed item (j, v) and all of the data items in C 1 , . . . , C r−1 ,
freshly re-encrypted and with duplicates removed.
• Then, for j = 1 to r − 1, set K j,1 , K j,2 to fresh random keys and set the cuckoo tables C 1 , . . . , C r to be
new, empty tables and C r to be C ′ r.
Note that the remaining tables C r+1 , . . . , C L are not touched.
We can implement the rebuild phase using the any of the protocols (with small variations) from [15, 16].
The most efficient gives an amortized overhead of log l operations for all rebuilds, assuming that the client
can temporarily locally store l δ memory slots during the protocol (but the client does need to store them
between executions of the protocol). If we only allow the client to store a constant number of slots at any
one time, then the we incur an overhead of log 2 l. In either case the worst-case overhead is O(l). Using
the de-amortization techniques from [16, 24], we can achieve worst-case complexity of log 2 l, at the cost of
doubling the server storage. This technique was analyzed in the original ORAM security setting, but it is
not hard to extend our proof to show that it preserves next-read pattern hiding as well.
6.3 Next-Read Pattern Hiding
Theorem 2. Assuming that F is a secure PRF, and the underlying encryption scheme is chosen-plaintext
secure, then the scheme O described above is next-read pattern hiding.
Proof. We show that for any efficient adversary A, the probabilities that A outputs 1 when playing either
NextReadGame 0 A or NextReadGame1 A
differs by only a negligible amount. In these games, the adversary A
19
9. Dynamic Proofs of Retrievability via Oblivious RAM