dedoc/paragraph_dataset huggingface dataset:
encryption E(c ) i of the number of queried keywords matching f . i Then, instead of simply computing
fi E(c ) i , the server will embed several values in an integer f ′
j,i ∈ ZN as shown in Fig. 1. This requires
two diﬀerent Reed-Solomon codes RS and ′ RS . The code RS will be used to recover the ci and is
deﬁned on Zpt where pt is the smallest prime greater than the database size t (it should also be
greater than the dictionary size |Ω|) and the coeﬃcients of its parity check matrix are thus deﬁned
as RSj,i = j i mod p . t Similarly, ′ RS will be used to recover the values of fi and is deﬁned over
Zpf where pf is the largest prime that can ﬁt in the remaining bits of one plaintext (Paillier or
Damg̊ard-Jurik). We have ′ RSj,i = j i mod pf . Thus, for each of the m positions of buﬀer B, the
server multiplies Bj by f E(c ) i
j,i . Once the whole database has been processed, Bj ≡ E
(∑t
i=1 c f i
j,i
6 Matthieu Finiasz and Kannan Ramchandran
Document Extraction. As usual, the user starts by decrypting the buﬀer B. He then splits each
plaintext he obtains in 3 parts: the ﬁrst part corresponding to
i c RS i
f , i j,i the second to
i c RS i 2j,i
and the third to
i c RS . i 2j+1,i These linear combinations have been computed in the encrypted
domain by the server, with no reduction modulo pt or pf : this is why some zero-padding is required
(see Fig. 1) to avoid overﬂows. The user thus starts by reducing the last two elements modulo pt
for each j ∈ [1,m], and gets 2m syndrome positions in RS of the sparse vector (c ). i This is enough
to recover the values and positions of the m non-zero ci elements using the Reed-Solomon error
correcting algorithm.
Then, the user reduces the ﬁrst part of each plaintext modulo pf to obtainm syndrome positions
in ′ RS of the sparse vector (c f ). i i As the non-zero ci elements are known, the positions of the non-
zero c f i i are also known, and the user has to solve an erasure problem. The m syndrome positions
are enough to recover the values of c f , i i and thus also of f . i
Computational Cost. Compared to the Ostrovsky-Skeith construction, the use of Reed-Solomon
codes has an heavy impact on the server side computations. As all the lines of a Reed-Solomon
parity check matrix are diﬀerent, the server has to compute a modular exponentiation f E(c ) i
j,i for
each coeﬃcient in the matrix, that is mt exponentiations instead of t in the other algorithms.
However, on the user side, the computational cost remains similar and will be dominated by the
buﬀer decryption step. Reed-Solomon decoding costs 2 O(m ) multiplications in Zpt and Zpf , which
can be upper bounded by 2 2 O(m (logN) ). Decryption costs 3 O(m(logN) ), which will dominate as
long as m is smaller than a few thousands. The document extraction process is thus no longer linear
in m, but the quadratic component is negligible in practice.
Communication Cost. With this scheme, a buﬀer of size m is enough to recover m matching
documents, which is optimal. However, part of each buﬀer position is reserved for the recovery of
the ci and for zero-padding. For each document, an overhead of 5 log t + 3 log |Ω| bits has to be
transmitted. The 3 log t + 3 log |Ω| padding 3 bits are wasted bits that are due to the structure of
the Paillier encryption scheme: using a diﬀerent homomorphic encryption scheme could improve
this. The remaining 2 log t bits are however necessary to get a deterministic zero-error algorithm:
the user has to solve an error correction problem, meaning he will have to learn both the value
and the position of the errors, leading to an overhead of O(log t) bits per document. Overall, for m
matching documents of S bits, this scheme requires 2m(S+O(log t)) bits using the original Paillier
cryptosystem or m(S+1024+O(log t)) using the Damg̊ard-Jurik extension. Asymptotically, when
m and S tend to inﬁnity, this corresponds to an expansion ratio (compared to a non-private search)
of 2 using Paillier and 1 using Damg̊ard-Jurik.
Note that these ratios are valid only if the user knows in advance the number m of matches to
expect. This can be the case in some scenarios, but not in a typical keyword search. In this case, the
user will query form positions and will receive a syndrome of sizem: if less thanm documents match
the query he will be able to extract all of them with probability 1, but if more than m documents
match the query he will not be able to decode and will not get any document. This gives another
way of looking at the zero-error property: the user knows when he misses something, whereas in
the Ostrovsky-Skeith scheme, the user will usually be able to extract at least a few documents,
but has no information wether he got all the documents or not. With our Reed-Solomon scheme,
it is possible to imagine an interactive 4 protocol where the user can query for additional syndrome
3 In practice, this can be reduced to 3 logm+3 log |K| bits, but having a dependency on m is not really convenient.
It can however be easily reduced to 3 log t+ 3c for any c if queries are limited c 2 keywords at a time.
4 Special care has to be taken when designing such an interactive protocol, so as not lose too much privacy by
disclosing the actual number of matches to the server.
Communication Optimal Private Stream Search 7
Fig. 2. Embedding of f , i a padding and a checksum of fi inside an element of ZN . |Ω| is the
dictionary size (a bound on c ) i and the paddings avoid overﬂows when multiplying f ′
i by c . i
positions when the decoding fails, thus allowing him to choose a small m at ﬁrst and still be sure
to get all the documents in the end.
3.2 An Asymptotically Optimal Construction Using Irregular LDPC Codes
Description of the Construction. In order to improve the asymptotic communication cost and
remove any dependency on the database size t, it is necessary to use a randomized scheme (thus
with a non-zero probability of failure): in that case, it is well known that (irregular) LDPC codes can
oﬀer much better performance than Reed-Solomon codes. However, the error correction problem
also has to be transformed into an erasure correction problem. This is possible by combining the
following ideas (which is similar to what Danezis and Dı́az proposed):
– instead of using a ﬁx LDPC matrix, generate it from the documents fi themselves,
– use a decoding algorithm similar to the erasure correction algorithm proposed by Luby and
Mitzenmacher for veriﬁcation codes [8].
Query Construction. This step is the same as for the Ostrovsky-Skeith construction. Instead of m
and γ, the user sends the desired buﬀer length ℓ to the server.
Query Execution. The server ﬁrst initializes a buﬀer B of size ℓ to E(0) in every position. Then,
for each document fi it proceeds as follows:
– compute f ′
i from fi as shown in Fig. 2, adding a padding (with a single 1 between some zeros)
and a small non-linear checksum of fi itself (a cryptographic hash of 64 bits can be used),
– compute E(c f i ′
) i exactly as in the original scheme,
– using a pseudo-random number generator seeded by f , i generate
5 an integer d following a given
distribution (the best choice for this distribution is discussed at the end of this section) and
generate a uniformly random binary column vector Hi of length ℓ and Hamming weight d,
– for every non-zero position in H , i multiply the corresponding position in buﬀer B by E(c f i ′
). i
In the end, B = E(H × (c f i
)) i contains the encrypted syndrome of the sparse (c f i
) i vector with
respect to the parity check matrix H of an irregular LDPC code.
Document Extraction. When receiving buﬀer B, the user starts by decrypting it and looks for
singletons. The detection of singletons is made easy by the structure of f ′
i (see Fig. 2). The isolated
1 allows to read the value of ci directly and divide c f i
i by it: if it is indeed a singleton, the checksum
will be valid and the value of fi can be recovered, otherwise the checksum will not be valid (with
high probability).
With every singleton the user gets the value of one document fi and can now regenerate (using
the same PRNG as the server) the corresponding column H . i Knowing Hi (and c ) i it is possible to
5 Note that Danezis and Dı́az use the document index i to generate the column H , i which requires to number
documents. Using the document itself as the seed makes application to streaming data more natural.
8 Matthieu Finiasz and Kannan Ramchandran
c’
Fig. 3. Local view of the bipartite graph as a tree. The dashed lines correspond to nodes/edges
removes at the end of step j. The edge between v and c will be removed at step j +1 as one son ′ c
of v is a singleton (it has no sons remaining at the end of step j).
remove document fi from the other syndrome positions where it has been added, thus uncovering
new singletons, which in turn can reveal new documents f . i This gives an iterative algorithm which
we analyse asymptotically here.
Choosing an Optimal Column Weight Distribution. In order to analyze the decoding al-
gorithm, the matrix H can be transformed into a bipartite graph. On the left of the graph are m
information nodes (the non-zero (c f i
) i elements) and on the right are ℓ parity nodes (the decrypted
syndromes). These nodes are connected by edges: each 1 in H is an edge in the graph, linking a
information node and a parity node. For each edge in the graph, its left degree is the number of
edges connected to its information node and its right degree the number of edges connected to its
parity node. Then the decoding algorithm consists in repeating the following steps:
– select all edges with right degree 1 (edges connected to singletons),
– remove these edges from the graph as well as the associated left and right nodes,
– remove all other edges that were connected to the left nodes (no other edges were connected to
the right nodes).
Decoding is successful if, at the end, all the edges have been removed from the graph.
Studying the probability of success of this algorithm for given parameters m and ℓ is diﬃcult,
however, as proven in [9], if the left and right degree distribution of edges remains constant and m
and ℓ tend to inﬁnity, the asymptotic proportion of edges removed at each step can be computed.
Let λ(x) =
i λ x i
i−1 and ρ(x) =
i ρ x i
i−1, where λi (resp. ρ ) i denote the probability that an
edge of the graph has left (resp. right) degree i. Also, let bj denote the proportion of edges of the
graph that are still present after step j of the algorithm. Then b0 = 1 (all the edges are present
before the algorithm starts) and:
bj+1 = λ(1− ρ(1− b )). j (1)
We will not prove this formula here (please refer to [9,11] for the complete proof), but the
intuition is the following. During the decoding process, the neighborhood around the edge (v, c)
between a message node v and a parity node c, can be seen as a tree (see Fig. 3). The decoding
process then consists in letting information ﬂow from the leaves of the tree to its root: the (v, c)
edge will be removed from the graph at step j +1 if the value of v can be determined at step j +1
and it can thus send its value to c. As can be seen on Fig. 3, the value of the message v can be
determined if it has a son ′ c that is a singleton at the end of step j of the algorithm, meaning one
of the sons of v is a leaf. The probability this happens can easily be computed if the distributions
λ and ρ are known. The parity node ′ c is connected to k edges with probability ρk and it is a
Communication Optimal Private Stream Search 9
Table 1. Minimal expansion rates asymptotically allowing recovery of all the documents, for
speciﬁc values of d, in the algorithm of Danezis and Dı́az.
singleton at the end of step j if its k − 1 sons in the Fig. 3 tree have been removed: this happens
with probability Psingleton =
k ρ (1− k b ) j
k−1 = ρ(1− b ). j
Similarly, node v has ′ k neighbors (and thus ′ k − 1 sons) with probability ′ λk , so one of them
will be a singleton with probability 1−
′ k λ
(1− k P ) singleton
′ k −1 = 1− λ(1− P ). singleton The edge
(v, c) is thus removed at step j+1 with probability 1−λ(1−ρ(1− b )), j which leads to formula (1).
Asymptotically, the decoding algorithm is successful if bj
j→∞ −→ 0, which will be the case if:
∀x ∈ [0, 1], λ(1− ρ(1− x)) ≤ x.
Of course, for ﬁnite values of m and ℓ, the algorithm can fail even if this condition is veriﬁed.
The sequence of bj represents the expected evolution of the number of edges in the graph, but the
algorithm will deviate from the average from time to time.
Application to Danezis and Dı́az’s Algorithm. In [4], Danezis and Dı́az propose to use a constant
weight d for the columns of H. This means that λ(x) = d−1 x . The distribution ρ is a little more
complicated as it is induced by λ. A row of H will have a weight following a binomial distribution: it
is the sum ofm random coins equal to 1 with probability d
ℓ . We thus have ρi =
iℓ
ℓ
) ( i
1− d
ℓ )
m−i
and so, when m is large, ρ(x) = exp
− md
ℓ (1− x)
The best rate ℓ
m one can achieve for a given d is given in Table 1 and is obtained from the
equation:
∀x ∈ [0, 1],
1− md exp(−
ℓ x)
)d−1
≤ x.
The best asymptotic choice is d = 3, which does not mean that for a given m and ℓ the best
probability of success is always achieved for d = 3. This however proves that Danezis and Dı́az’s
algorithm with constant column weight d can indeed achieve communications linear in m. However,
it can never have a good probability of success for expansion rates smaller than 1.22.
The Harmonic Distribution. Using a constant column weight makes the description of the algorithm
easy and gives very good results for some parameters (see Fig. 5), but it is not optimal.
The decoding problem we are facing is very close to the problem of decoding LT-codes [7] and,
for LT-codes, it was proven that the optimal distribution choice is the so-called Robust Soliton
distribution. However, in our context, using this distribution would correspond to ﬁxing ρ(x), that
is, choosing a row weight distribution. This is not possible as each instance of our decoding problem
corresponds to a set of m random columns of H, meaning we only have full control on the column
weight distribution λ(x). The row distribution will always be given by ρ(x) = exp
− md̃
where d̃ = 1/
λi
i is the average column weight of H. Thus, the constraint on λ(x) is:
∀x ∈ [0, 1], λ
1− md̃ exp(−