A Brief History Of

1. A Brief History Of History Independent Data Structures

2. Credit: South China Morning Post

3. Oblivious Data Structures

4. [Mic97] Daniele Micciancio • Oblivious data structures: Applications to cryptography - STOC 1997 An attempt to solve the privacy problem in incremental cryptography

5. [BGG95] M. Bellare, O. Goldreich, S. Goldwasser • Incremental Cryptographyand Application to Virus Protection - STOC 1995

6. T ------------------ B9ECE18C950AFBFA6B0FDBFA4FF731D3 Th ------------------ EEEB9A8EB45DD351D9EC0EB4ACCE66CE Thi ------------------ A4704FD35F0308287F2937BA3ECCF5FE This is a survey on the area of history inde-pendent data struc-tures. I will show you how this area developed in the last decade [. . .] ------------------ B97799DE817E55BCC3ADE4370246EB0D … Why Incremental? Most cryptographic primitives act on the document as a whole. • MD5 Signature Re-compute from scratch is wasteful • Ideally, the running time should be O(f(|change|)).

7. The Free Food Cam At 15 frame per second, 1 M pixel per frame, 3 byte per pixel http://zimbs4.srv.cs.cmu.edu/coke/ffc.html(Google for the phrase “free food cam”)

8. 2004-09-21 13:15:55

9. How do you know these pictures are authentic? 2004-09-21 13:46:24

10. C A,B D A B C D E Tree Signatures [BGG95] • Represent the document as a 2-3 Tree whose leaves contain constant-size block of characters • Non-incrementally sign each leaf and each internal node • Each change only takes O(logn) signature updates S S S S S S S S

11. Privacy of Tree Signatures An Apparent Paradox The very nature of digital signature )there can be no secret about the document and its signature… • How can privacy be an issue of when your original intent is to publish the document and its signature?

12. Is Microsoft Word really so evil? Metadata • Oct 2000: The Wall Street Journal reports that a candidate running for the U.S. Senate began receiving anonymous emails containing messages written in MS Word criticizing and attacking the candidate. A savvy aide looked at the document properties and discovered they were authored by the chief-of-staff of the opposing party. • Feb 2003: A dossier on Iraq’s security and intelligence organizations, cited by Colin Powell and published by 10 Downing Street, is discovered to have been plagiarized from a U.S. researcher on Iraq. Since the dossier was published on their website in MS Word format, researchers also discovered the four people in the British government who edited the document. They were subsequently called to Parliament for a hearing. • Mar 2004: SCO Group, seller of UNIX and Linux, sent out a warning letter to 1,500 of the world’s largest companies threatening legal liability for using Linux if they failed to obtain a license from the Utah-based company. After filing suit against Daimler-Chrysler, metadata in a MS Word document revealed that the SCO’s attorneys had originally identified Bank of America as the defendant. From http://www.abanet.org/tech/ltrc/publications/metadata.html “a fine document”

13. C A,B D A B C D E Metadata in Tree Signatures • Represent the document as a 2-3 Tree whose leaves contain constant-size block of characters • Non-incrementally sign each leaf and each internal node • Where is the metadata? S S S S S S S S How can a 2-3 tree leak information?

14. C A,B D A B C D E The Wedding Guest List As you may know, some of us are getting married soon! • As hard-core computer scientists, of course you will maintain the guest list in sorted order • (using an object-oriented multimedia relational XML database) Congrads!

15. Blelloch Blandford Manual Sorting Is Hard

16. C A,B D A B C D E Back To The Guest List And as the guest list gets compiled, there will always be someone who gets added to the list LAST… • “You added me after you have added {Foo}?”

17. B C A C A D A B C E A C D E B C A C,D A,B D A B C D E A B C D E Between B and D is C…ontention Initial Insert(“D”) Initial Insert(“B”)

18. [NT01] Moni Naor, Vanessa Teague • Anti-persistence:History Independent Data Structures - STOC 2001

19. [Mic97] Daniele Micciancio • Oblivious data structures: Applications to cryptography - STOC 1997 An attempt to solve the privacy problem in incremental cryptography

20. Oblivious Data Structures Informal definition • A data structure is said to be oblivious if it does not give out any knowledge about the sequence of update operations that have been applied to it other than the final result of the operations.

21. Formal Definition [Mic97] Let M be a set of operations,and S be a set of algorithms implementing them. We say S is oblivious if: • for any two sequences of operations p1, p2, …, pnand q1, q2, …, qm that lead to the same set of values,the execution of these sequences have identical output probability distributions.

22. Oblivious 2-3 Tree Issue: How do 2-3 trees “leak”? • Degrees of nodes give out too much information Solution: Randomize the degrees! • Degrees should split uniformly between 2 and 3

23. Results in [Mic97] Oblivious 2-3 Trees • Insertion and Deletion in expected O(logn) time whp • Search in worst-case O(logn) time Incremental Signature Scheme • Security: Tamper Proof, as defined in [BGG95] • Privacy: Private (hmm… we will see :P) • Expected O(logn) signature updates per change whp

24. For More Information

25. History Independence

26. C A,B D A B C D E Are We Done Yet? In an oblivious 2-3 tree, the degreesindeed don’t tell you anything aboutthe update sequence. • What else can leak information?

27. C A,B D A B C D E Interface Matters Dictionary ADT • Insert(key) • Delete(key) • Search(key) Does this allow you to ask“is k1 is inserted some time before k2?” Principle When privacy is concerned, if some piece of information cannot be retrieved via the legitimate interface of a system, then it should not be retrievable even with full access to the system.

28. Full Access 00000200: 006e 1ef0 6335 0000 563d 0673 77a2 f4fc .n..c5..V=.sw... 00000210: c81b 44b0 c62c 7e3e ff89 504e 470d 0a1a ..D..,~>..PNG... 00000220: 0a00 0000 0d49 4844 5200 0000 9600 0000 .....IHDR....... 00000230: 3908 0600 0001 a34c e24f 0000 0009 7048 9......L.O....pH 00000240: 5973 0000 0b13 0000 0b13 0100 9a9c 1800 Ys.............. 00000250: 0000 0467 414d 4100 00b1 9e61 4c41 f700 ...gAMA....aLA.. 00000260: 0000 2063 4852 4d00 007a 3000 0080 9800 .. cHRM..z0..... 00000270: 00f4 2400 0084 cb00 006d 5f00 00e8 6c00 ..#......m_...l. 00000280: 003c 8b00 001b 58ca 10f6 b800 0034 c849 .<....X......4.I 00000290: 4441 5478 da62 fc5f 3ff9 fff3 e72a 0ce2 DATx.b._?....*.. 000002a0: 921e 0c07 9e3f 6778 2629 c970 1848 4bda .....?gx&).p.HK. 000002b0: 4b32 3c97 00d2 7640 faf5 3506 49c9 7f0c K2<...v@..5.I... 000002c0: cf9f 9f07 d23c 40fa 1190 5600 d2df 81b4 .....<@...V..... 000002d0: 1190 6664 90e4 5365 0008 2096 e7cf ff01 ..fd..Se.. ..... 000002e0: 054c 18ae 020d f80b 3448 dfff 3783 1e8f .L......4H..7... 000002f0: 24c3 379e df0c 5fc4 2419 76ff bacf 2021 #.7..._.#.v... ! 00000300: f10a a8e1 1850 1d0b 90be cb20 0d54 f7f4 .....P..... .T.. 00000310: f90d 205f 15c8 7f0a a4ed 80f4 0d06 8000 .. _............ 00000320: 6292 9434 04db c006 5470 1e68 201b 372b b..4....Tp.h .7+ 00000330: 83b3 ab3e c32f 0156 8648 231d 060e 8ec7 ...>./.V.H#.....

29. [NT01] Moni Naor, Vanessa Teague • Anti-persistence:History Independent Data Structures - STOC 2001

30. C A,B D A B C D E Memory Representation Most memory allocators have a tendency to • allocate newer objects at higher addresses Shape Memory A B A,B D C D E C

31. History Independence [NT01] Definition A data structure implementation is history independent if any two sequences S1 and S2 that yield the same content induce the same distribution on the memory representation. • Similar to Micciancio’s definition, except this is specified on memory representation

32. Thief Hacker Single vs. Multiple Observations

33. Strong History Independence [NT01] Definition Let P1= {i11, i12, … , i1l} and P2= {i21, i22, … , i2l}be two lists of points such that for all b2{1, 2} and 1·j·l, we have that 1·ibj· |Sb| and the content of data structure following S1 up to i1j and S2 up to i2j are identical. A data structure implementation is strongly history independent if for any S1,P1,S2,P2 the distributions of the memory representations at the points i1j and i2j are identical.

34. P1 S1 … …         D1 P2 S2 D2 Strong History Independence [NT01] i14 i11 i12 i13 i15   i21 i22 i23 i24 i25

35. Weak History Independence [NT01] Definition A data structure implementation is history independent if any two sequences S1 and S2 that yield the same content induce the same distribution on the memory representation. • Similar to definition [Mic97], except this is specified on memory representation Weakly

36. Checkpoint • How HIDS got started • Why obliviousness is inadequate • What WHI and SHI are The rest of this talk: - WHI is bearable - SHI is hard

37. Results in [NT01] Besides the definitions, • WHI object allocators • Applied to Dynamic perfect hashing • SHI hash table • Currently does not support deletion • WHI Union-Find (sketch)

38. Insert(new card x) Put the x at the end Swap x with another card, chosen u.a.r. Delete(card at position j) Swap card with the last card Discard the (new) last card Incremental Card Shuffling LemmaThe permutation of cards remains random with these procedures.

39. Fixed Size Object Allocator Turn any bounded-indegree, fixed-size record oblivious data structure into WHI • Record allocation takes O(1) time • Need to be careful when moving blocks Examples • Treaps • Oblivious 2-3 Trees

40. Variable Size Object Allocator Create buckets for objects of geometrically increasing size B1, B2, B4, B8... (exercise :P) • Record allocation takes O(slogs) time • From here, adapt the dynamic perfect hashing into WHI

41. Insert(new card x) Put the x at the end Swap x with another card, chosen u.a.r. Going Back To Card Shuffling Don’t store the randomness and we get WHI But that alsorules out SHI

42. Example D1 D2 3, 1, 2 3, 1, 2 Ins(5) Ins(4) 3, 5, 2, 1 3, 4, 2, 1 Ins(5) 3, 4, 5, 1, 2 Del(4) 3, 2, 5, 1

43. Ordered Hashing In open addressing, how do you break tie in a collision? • Resolve by alphabetical order O. Amble, D. Knuth • Ordered hash tables - The Computer Journal 17(2), 1974

44. SHI Hash Table Looks like Ordered Hashing on Steroid Define a priority function p(i, x, y) : {0, …, N-1} £U£U {True, False} Round # Contestants Theorem If p(i, x, y) defines a total order, then the hash table is SHI.

45. SHI Hash Table Youth-rules true if age(i,x) < age(i,y) p(i, x, y) = true if age(i,x)=age(i,y) and x< y false otherwise Theorems For any sequence of insertions the expected amortized insertion probe-time for an element is 1/(1-). For any element, the expected probe-time for successful or unsuccessful search is 1/(1-)

46. Observation in [NT01] “It is interesting to note that all the SHI data structures we have found have the property that each data structure content has a unique representation.” • SHI ) Unique Representation?

47. SHI ) Unique Representation

48. [H.02] J. Hartline, E. S. Hong, A. E. Mohr, W. R. Pentney, E. C. Rocke • Characterizing History Independent Data Structures - ISSAC 2002

49. Results in [H.02] A (somewhat) simpler definition of WHI and SHI • Show SHI ) Unique Representation Relax SHI to a new definition: SHI* • The adversary can distinguish between empty and non-empty sequences of operations Show how to resize WHI data structures

50. Hysteresis Your wedding is running out of budget? Capacity 2n n 0 #Items 0.75n n