dedoc/paragraph_dataset huggingface dataset:
Defending Islam Group)
Jama‟at i‟adat al-khilafat al-rashida (TN: Restoration of
the Caliphate Group)
Jama‟at nasr al-Islam wal-aksa (TN: Support of Islam and
Al-Aqsa Group)
Jama‟at wihda al-Muslimin (TN: Muslim Unity Group)
Tanthim al-Jihadi li-tawhid al-Umma wa-inkathiha (TN: Jihad
Organization for Unification and Rescue of the Nation)
Tanthim al-Jihadi litahrir al-aksa wa-tawhid al-Umma (TN:
Jihad Organization to Liberate Al-Aqsa and Unify the
Nation)
Hizb tawhid al-Umma al-Islamiya (TN: Islamic Nation
Unification Party)
aksa (TN: Al-Aqsa Liberation Group) Jama‟at tahrir al-
Jama‟at inkath wanahdat al-Umma (TN: Rescue and
Revitalization of the Nation Group)
Private Stream Search at Almost the Same
Communication Cost as a Regular Search
Matthieu 1 Finiasz and Kannan 2 Ramchandran
1 CryptoExperts
2 UC Berkeley
Abstract. Private Stream Search allows users to perform keyword-based search queries on streaming
data (or on a database) without revealing any information about the keywords they are searching. Using
homomorphic encryption, Ostrovsky and Skeith proposed a solution to this problem in 2005. However,
their solution requires the server to send an answer of size O(mS logm) bits when m documents of S
bits match the query, while a regular (non-private) query only requires mS bits. Following this work,
some improved schemes have been proposed with the aim of keeping the reply from the server linear in
mS. In this work we propose two new communication optimal constructions: both allow communication
linear in mS, but they also oﬀer an expansion factor (compared to a non-private query) asymptotically
equal to 1 when m and S increase. More precisely, our ﬁrst scheme requires m(S+O(log t)) bits (where
t is the size of the database) and our second scheme m(S + C) where C is a constant depending only
on the chosen computational security level.
Keywords: privacy, keyword search, Reed-Solomon codes, LDPC codes.
1 Introduction
Internet search engines are able to gather a lot of information on users from the content of the search
queries they make. Most users don’t really care about this, but more and more users would prefer
the servers not to learn anything from their query. This is the goal of Private Stream Search (PSS)
algorithms: being able to perform a keyword-based search query on a server, without disclosing any
information about the keywords in the query. However, even if the number of users having concerns
about privacy is growing, the number of these users that are willing to trade eﬃciency for privacy
is probably much smaller. Compared to standard non-private search, PSS should not have a much
higher latency (response time) or bandwidth usage (response size) or be less reliable (miss some
matching documents). This is the main focus of this article.
The ﬁrst PSS algorithm was introduced in 2005 by Ostrovsky and Skeith [12,13] and makes
clever use of homomorphic encryption to hide the content of the query while still allowing the
server to perform some computations on it. This scheme requires the use of a public dictionary of
possible keywords and is restricted to OR queries. These restrictions are not the main focus of our
work, but as we discuss later, the use of a fully homomorphic encryption scheme could remove these
restrictions from both the original Ostrovsky-Skeith construction and the new schemes we present
here. Following Ostrovsky and Skeith’s work, some improvements have been proposed independently
by Bethencourt, Song and Waters [1,2] and by Danezis and Dı́az [4,5]. These improvements have
the same structure as the original scheme and are focused mainly on improving the size of the
response from the server (one of the main issues in the original proposal) and the reliability of the
scheme. However, they are suboptimal in some aspects.
The main contribution of this paper is the proposal of two new PSS algorithms combining the
ideas of the Ostrovsky and Skeith construction with results from coding theory, thus allowing for
state of the art results that improve signiﬁcantly on current PSS schemes. Our ﬁrst scheme uses
Reed-Solomon codes [15] and allows for a zero-error guarantee, while oﬀering optimal communica-
tion rates. It can however be computationally heavy at the server. Our second scheme is based on
irregular LDPC codes [6,10] and is asymptotically optimal, thus interesting when a large number
of documents (in practice, a few hundreds) match the query. We also propose an oﬄine-online
2 Matthieu Finiasz and Kannan Ramchandran
scheme, with a higher oﬄine computational cost, but which allows the online step to be as eﬃcient
as a standard non-private search: the response suﬀers no latency and the communication overhead
remains minimal.
This article is organized in 3 sections. Section 2 contains a description of the orignal Ostrovsky-
Skeith PSS construction and of the Bethencourt et al. and Danezis and Dı́az improvements. Then,
in Section 3, we present our two new constructions and give some analysis of their performances.
Finally, in Section 4, we detail some further improvements that apply to our schemes, but also to
the previous PSS schemes.
2 Previous Constructions
2.1 Paillier’s Encryption Scheme
All known private stream search constructions require the use of homomorphic encryption and the
original Ostrovsky-Skeith construction relies on Paillier’s cryptosystem [14]. The new schemes we
present in Section 3 also rely on this scheme. Of course, any other homomorphic encryption scheme
could be used instead, with only minor modiﬁcations to the PSS schemes.
Paillier’s cryptosystem is a public key cryptosystem: in our PSS applications, a user and a
server will communicate, and all encryptions will be done with respect to the user’s key. We shall
denote by E : ZN 7→ Z 2 N Paillier’s encryption function and by D : Z 2 N 7→ ZN the associated
decryption function. As the encryption is randomized, the same message can have diﬀerent asso-
ciated ciphertexts, decrypting to the same value. We thus introduce the notation y ≡ ′ y which is
equivalent to D(y) = ′ D(y ): y and ′ y are encryptions of the same message. With these notations,
the homomorphic property can be expressed as:
E(x )× 1 E(x ) 2 ≡ E(x1 + x ) 2 and c E(x) ≡ E(c× x) for any c ∈ ZN .
Additionally, Paillier’s cryptosystem is semantically secure, so the server cannot distinguish between
E(0) and E(1). For simplicity, we will consider that N is 1024 bits long, but it should of course be
chosen according to the required security level.
The Damg̊ard-Jurik Extension. Semantic security requires a randomized encryption, which
necessarily induces a message expansion: the ciphertext is larger than the associated message.
Paillier’s cryptosystem has a constant expansion factor of 2, for small messages of logN bits, but
also for longer messages spanning several encrypted blocks.
To improve this, Damg̊ard and Jurik [3] proposed a variant of Paillier’s homomorphic encryption
scheme which works very similarly but takes a message in s ZN (for any value of s) and outputs a
message in Z s+1 N . For a message of s logN bits, the expansion factor is only s+1
s , which tends to
1 when the message size increases. However, the price to pay for this smaller expansion rate is a
factor 2 O(s ) on the cost of encryption/decryption.
Using the Damg̊ard-Jurik encryption scheme with a modulus N of 1024 bits, the communication
overhead is 1024 bits whatever the message size. More generally, this overhead is a constant C
depending only on the required security level.
2.2 The Ostrovsky-Skeith Construction
A private stream search algorithm works in three steps: ﬁrst the user builds a query and sends it to
the server, then the server executes the query which outputs a result that it sends back to the user,
ﬁnally the user extracts the queried documents from the result he received. Here is the description
of these three algorithms for the original PSS scheme from Ostrovsky and Skeith [12].
Communication Optimal Private Stream Search 3
Query Construction. Let Ω = {w , 1 w , 2 . . . , w } |Ω| be the dictionary of possible keywords and K ⊆ Ω
be the set of keywords the user wants to query. The query is Q = {q , 1 q , 2 . . . , q }, |Ω| where qj =
E(1 ) w ∈K j and 1 denotes the indicator function. The user thus sends an encrypted bit for each
element in the dictionary: this bit is 1 if the keyword is part of the user’s search, 0 otherwise.
As each encryption is independently randomized and due to the semantic security of Paillier’s
cryptosystem, the server cannot tell which of these encrypted bits are 1 and 0.
As part of the query, the user also sends m, the expected number of matching documents, and γ,
a reliability parameter (a larger γ gives a better probability of recovering all matching documents).
Query Execution. Upon receiving the query (Q,m, γ), the server ﬁrst creates a buﬀer B of size
ℓ = γm and initializes each of its positions to the value 1 ≡ E(0).
Let us assume the database contains t documents. Then, for each document fi ∈ ZN in the
database, the server computes the set Wi ⊆ Ω of keywords in the dictionary that match document
f . i It then computes Fi =
(∏
w ∈W j i
)fi ≡
∏
fi E(1 ) w ∈K j . Thanks to the homomorphic
property of E , we also have: Fi ≡ E
1w ∈K j
. Denoting ci =
1w ∈K j the number
of keywords of K that match f , i we then have Fi = E(c f ). i i The server then select γ random
positions bi = {b , i,1 . . . , b } i,γ ⊂ [1,mγ] of the buﬀer B and updates each of these γ positions by
multiplying its current value by F . i
After processing all the documents in the database, the j-th buﬀer position will be equal to
Bj =
1j∈bi
i ≡ E
(∑
i 1 c f i i j∈bi
, that is, the encryption of a linear combination of documents in
the database. This linear combination is sparse if only few documents match the query K, meaning
most of the ci are equal to 0. The server then sends the buﬀer B back to the user.
In practice, everything happens as if the server had a random binary matrix H of size γm × t
with γ ones in each column and it was computing B ≡ E(H × (c f ) ). i i i∈[1,t]
Document Extraction. When receiving the encrypted buﬀer B, the user starts by decrypting each
buﬀer position to get D(B ) j =
i 1 c f . i i j∈bi He then scans the γm decrypted buﬀer positions for
what we call singletons: buﬀer positions that contain only one ﬁle, that is, positions such that
1 ci j∈bi = 0 for all but one value of i. The user discards all buﬀer positions that are not singletons
and extracts the value fi of one document from each singleton.
Asymptotic Cost. The encrypted buﬀer that is sent back by the server to the user has size γm.
In order for the user to recover the m matching documents with a high probability of success,
γ must be of the order of O(logm). If documents are S bits long, using Paillier’s cryptosystem,
encrypted buﬀer positions should be 2S bits long and the answer is thus of order 2mSO(logm).
It can be reduced to m(S + 1024)O(logm) using the Damg̊ard-Jurik extension (with a 1024-bits
modulus N). The expansion factor is only logarithmic in m, but some improvements are needed to
keep the buﬀer size linear in the number of matching documents.
2.3 The Danezis-Dı́az Improvement
In [4,5], Danezis and Dı́az propose to modify slightly Ostrovsky and Skeith’s construction, allowing
them to dramatically decrease the size of the buﬀer B. Their algorithm works exactly like the
Ostrovsky-Skeith scheme, but with the following modiﬁcations:
– the query Q is the same, but the user chooses a target buﬀer size ℓ (typically ℓ = 2m),
– before processing the query, the server embeds the index i of each document inside f , i
4 Matthieu Finiasz and Kannan Ramchandran
– when processing the query, instead of adding the document to γ random buﬀer positions, the
server now uses a public hash function/pseudo-random number generator h, seeded by the index
i, to deterministically choose a set of d positions where the document fi will be added. The
integer d is a parameter of the system. In terms of matrices, H is such that its i-th column is
Hi = h(i), a binary vector of Hamming weight d.
The main change that Danezis and Dı́az bring is a new document extraction algorithm. As in
the Ostrovsky-Skeith construction, the user starts by looking for singletons and extracts the value
of some documents from these singletons. However, now, each document also contains its index i,
and from i, the user can generate Hi = h(i) and know exactly where this document was added
in the buﬀer. He can thus completely remove any document he recovers from the buﬀer, thereby
uncovering new singletons. This simple iterative decoding algorithm allows for a much smaller buﬀer
than in the original scheme, while maintaining a decoding cost linear in the buﬀer size.
This algorithm was only empirically tested by Danezis and Dı́az, but their experimental results
show that a buﬀer size of ℓ = 2m is suﬃcient to recover a high percentage of the m matching
documents. However, they do not give any formal analysis.
2.4 The Bethencourt-Song-Waters Construction
In [1,2], Bethencourt, Song and Waters propose a completely diﬀerent angle to improve on the
Ostrovsky-Skeith scheme. Their approach is useful when documents are long (more than logN
bits), which will be the case in many applications. In the previous schemes, the expansion ratio
between the number of matching documents and the buﬀer size was independent of the document
size. Meaning that even for large documents, the expansion would be logm for the Ostrovsky-Skeith
scheme and 2 for the Danezis-Dı́az variant.
Bethencourt et al. propose to use a similar scheme, but with 3 diﬀerent buﬀers. The ﬁrst buﬀer
will contain the value of the documents (and will thus scale with the size of the documents), and
the two other buﬀers are independent of the document size and are used to send the values of the
ci and the indexes i of the matching documents.
With this technique, Bethencourt et al. are able to achieve an asymptotic expansion rate of 1
(using the Damg̊ard-Jurik cryptosystem), but their technique suﬀers a few drawbacks:
– recovering the indexes i of matching documents relies on Bloom ﬁlters and requires the reply
to be of size O(m log t
) m to have a good probability of success. This dependence in the size t of
the database is not desirable and, as we will see, not necessary.
– recovering the document values requires to solve a linear system of size m ×m, which can be
quite expensive compared to the rest of the document extraction process. Other algorithms have
a linear cost in the buﬀer size.
3 Two New PSS Constructions
Building on the original Ostrovsky-Skeith scheme, we propose two new communication optimal
constructions. The key idea is to consider that the job of the server is simply to compute a sparse
encrypted vector E(c f ) i i and then compress it in the encrypted domain. Thanks to the homomorphic
property of Paillier’s cryptosystem it is possible to compute the syndrome of this vector with respect
to the parity check matrix H of an error correcting code. Using two optimal code constructions
(Reed-Solomon codes [15] and irregular LDPC codes [6,10]) we obtain our two new PSS schemes. Of
course, the idea of using a linear function to compress a sparse vector is not new, but homomorphic
encryption allows to do this in the encrypted domain too. This is also what previous PSS schemes
were doing, without explicitly stating it, and using sub-optimal linear compression.
Communication Optimal Private Stream Search 5
low weight bits
Fig. 1. Embedding of two Reed-Solomon codes and of fi inside an element of ZN . |Ω| and t are
the dictionary and the database sizes: the zero-paddings allow to avoid overﬂows when computing
linear combinations of f ′
. j,i
3.1 A Zero-Error Construction Using Reed-Solomon Codes
Apart from the communication overhead, one drawback of the existing PSS constructions is that
they have a non-zero probability of failure. This is true even for very large expansion rates. In
particular, when the number m of matching documents is small, the failure probability of all
previous schemes becomes higher for a given expansion rate. We thus propose a deterministic
algorithm that will guarantee that the document extraction will never fail if the number of matching
documents is known. This algorithm uses Reed-Solomon codes and exploits their MDS (maximum
distance separable) property in the following way:
– Reed-Solomon codes can correct up to m errors using 2m syndromes,
– they can also correct m erasures (errors at a known position) using only m syndromes.
Description of the Construction. A direct application of this would consist in replacing the
matrix H in the PSS algorithm by the parity check matrix of a Reed-Solomon code over ZN . Then,
recovering the value of any m documents would be equivalent to correcting m errors with the code
and would only require ℓ = 2m buﬀer positions. However, it is possible to do better than this.
Indeed, this straightforward application allows documents of logN bits, but also allows a database
of up to N elements. In practice the database is much smaller than N (which for security reasons
will be at least 1024 2 ), and using a Reed-Solomon code on ZN is a waste. The server can encode the
values of the ci (and their positions) as errors in a smaller Reed-Solomon code, and then encode
the documents as erasures, which can be eﬃciently recovered once the ci are known. Here is how
the algorithm works.
Query Construction. This step is the same as for the other algorithms (described in Section 2.2).
Along with the query Q, the user sends an expected number of results m.
Query Execution. As in the previous constructions, for each document f , i the server computes the