[Paper Review] Capacity-Achieving PIR Schemes with Optimal Sub-Packetization

Zhifang Zhang, Jingke Xu|arXiv (Cornell University)|Oct 31, 2017

Cryptography and Data Security15 references3 citations

TL;DR

This paper presents a linear capacity-achieving private information retrieval (PIR) scheme with optimal sub-packetization for replicated servers under $T$-private access, reducing sub-packetization from $N^M$ to $dn^{M-1}$, where $d = \gcd(N,T)$ and $n = N/d$. The scheme achieves the theoretical lower bound on sub-packetization and reduces field size by a factor of $1/(Nd^{M-2})$ compared to prior work.

ABSTRACT

Suppose a database containing $M$ records is replicated across $N$ servers, and a user wants to privately retrieve one record by accessing the servers such that identity of the retrieved record is secret against any up to $T$ servers. A scheme designed for this purpose is called a private information retrieval (PIR) scheme. In practice, capacity-achieving and small sub-packetization are both desired for PIR schemes, because the former implies the highest download rate and the latter usually means simple realization. For general values of $N,T,M$, the only known capacity-achieving PIR scheme was designed by Sun and Jafar in 2016 with sub-packetization $N^M$. In this paper, we design a linear capacity-achieving PIR scheme with much smaller sub-packetization $dn^{M-1}$, where $d={ m gcd}(N,T)$ and $n=N/d$. Furthermore, we prove that for any linear capacity-achieving PIR scheme it must have sub-packetization no less than $dn^{M-1}$, implying our scheme has the optimal sub-packetization. Moreover, comparing with Sun and Jafar's scheme, our scheme reduces the field size by a factor of $\frac{1}{Nd^{M-2}}$.

Motivation & Objective

• To determine the optimal sub-packetization for linear capacity-achieving PIR schemes under $T$-private access.
• To reduce implementation complexity by minimizing sub-packetization while maintaining capacity-achieving performance.
• To establish a theoretical lower bound on sub-packetization for such schemes.
• To design a practical PIR scheme that achieves both capacity and optimal sub-packetization.
• To reduce the required finite field size compared to prior capacity-achieving schemes.

Proposed method

• Derives a lower bound on sub-packetization using entropy and rank relationships in linear PIR schemes.
• Constructs a PIR scheme based on MDS codes and structured linear combinations of file segments.
• Uses a mixing-expanding framework with generator matrices $G_k$ for MDS codes of varying dimensions.
• Applies column permutations to transform the generator matrix $\widetilde{G}$ into the final encoding matrix $G$.
• Implements query and response phases using linear combinations of sub-packetized file segments across $N$ servers.
• Verifies correctness and privacy via structural conditions (s1) and (s2) on the scheme's linear components.

Experimental results

Research questions

• RQ1 What is the theoretical minimum sub-packetization required for a linear capacity-achieving $T$-private PIR scheme with $N$ replicated servers and $M$ records?
• RQ2 Can a PIR scheme achieve capacity with sub-packetization significantly below $N^M$?
• RQ3 How does the greatest common divisor $d = \gcd(N,T)$ influence the optimal sub-packetization?
• RQ4 What is the relationship between sub-packetization, field size, and scheme complexity in linear PIR?
• RQ5 Can a scheme be constructed that simultaneously achieves capacity, optimal sub-packetization, and reduced field size?

Key findings

• The optimal sub-packetization for linear capacity-achieving $T$-private PIR schemes is $dn^{M-1}$, where $d = \gcd(N,T)$ and $n = N/d$, and this bound is tight.
• The proposed scheme achieves this optimal sub-packetization, reducing it by a factor of $1/(nd^{M-1})$ compared to Sun and Jafar's $N^M$ scheme.
• The scheme reduces the required finite field size by a factor of $1/(Nd^{M-2})$ compared to the state-of-the-art capacity-achieving scheme.
• The rate of the scheme is $\frac{1 - T/N}{1 - (T/N)^M}$, matching the known capacity for $T$-private PIR.
• The lower bound on sub-packetization is proven using entropy and rank analysis of linear combinations in the scheme.
• The construction is verified to satisfy correctness and privacy via structural conditions (s1) and (s2) on the linear components.