a590003

can formalize this, however, in a pattern-hiding model where any two sequences with equal memory usage
are required to be indistinguishable.
Efficiency. In this scheme the client stores the counter and the keys, which can be derived from a single
key using the PRF. The server stores log l tables, where the j-th table requires 2 j + λ memory slots, which
sums to O(l + λ · log l). Using the optimization above, we only need a single stash, reducing the sum to
O(l + λ). When executing ORead, each index read requires accessing two slots plus the λ stash slots in each
of the log l tables, followed by a rebuild. OWrite is simply one write followed by a rebuild phase. The table
below summarizes the efficiency measures of the scheme.
Client Storage
O(1)
Server Storage O(l + λ)
Read Complexity O(λ · log l) + RP
Write Complexity O(1) + RP
Table 1: Efficiency of ORAM scheme above. “RP” denotes the aggregate cost of the rebuild phases, which
is O(log l), or O(log 2 l) in the worst-case, per our discussion above.
7 Efficiency
We now look at the efficiency of our PORAM construction, when instantiated with the ORAM scheme from
section 6 (we assume the rebuild phases are implemented via the Goodrich-Mitzemacher algorithm [15] with
the worst-case complexity optimization [16, 24].) Since our PORAM scheme preserves (standard) ORAM
security, we analyze its efficiency in two ways. Firstly, we look at the overhead of PORAM scheme on top of
just storing the data inside of the ORAM without attempting to achieve any PoR security (e.g., not using
any error-correcting code etc.). Secondly, we look at the overall efficiency of PORAM. Third, we compare
it with dynamic PDP [12, 30] which does not employ erasure codes and does not provide full retrievability
guarantee. In the table below, l denotes the size of the client data and λ is the security parameter. We
assume that the ORAM scheme uses a PRF whose computation takes O(λ) work.
PORAM Efficiency vs. ORAM Overall vs. Dynamic PDP [12]
Client Storage Same O(λ) Same
Server Storage × O(1) O(l) × O(1)
Read Complexity × O(1) O(λ log 2 l) × O(log l)
Write Complexity × O(λ) O(λ 2 × log 2 l) × O(λ × log l)
Audit Complexity Read × O(λ) O(λ 2 × log 2 l) × O(log l)
By modifying the underlying ORAM to dynamically resize tables during rebuilds, the resulting PORAM
instantiation will achieve the same efficiency measures as above, but with l taken to be amount of memory
currently used by the memory access sequence. This is in contrast to the usual ORAM setting where l is
taken to be a (perhaps large) upper bound on the total amount of memory that will ever be used.
Acknowledgements
Alptekin Küpçü would like to acknowledge the support of TÜBİTAK, the Scientific and Technological
Research Council of Turkey, under project number 112E115. David Cash and Daniel Wichs are sponsored
by DARPA under agreement number FA8750-11-C-0096. The U.S. Government is authorized to reproduce
22
9. Dynamic Proofs of Retrievability via Oblivious RAM