Search papers, labs, and topics across Lattice.
This paper establishes new lower bounds for single-server private information retrieval (PIR) with preprocessing, demonstrating that any such system utilizing blackbox cryptography must incur significant computational costs. Specifically, it proves that for a client storing \(s\) bits about an \(n\)-bit database, the online amortized computation must be \(\Omega(n/s)\) across multiple queries, alongside either a matching communication cost or a requisite number of server operations. These findings not only provide optimal lower bounds but also eliminate the possibility of achieving doubly efficient PIR systems that leverage blackbox cryptography with sublinear query computation.
Achieving sublinear query computation in single-server PIR with preprocessing is impossible without incurring substantial computational costs, fundamentally reshaping our understanding of efficiency in this domain.
(shortened for arXiv metadata) We study the limits of single-server private information retrieval (PIR) with preprocessing. Prior work has shown that single-server PIR with sublinear communication requires a linear number of (public-key) server operations per query [DMO00, DH24]. Recent breakthrough works, including [CHK22, ZPZS24, LMW23], circumvent these lower bounds by critically leveraging preprocessing to construct single-server PIR with sublinear query computation. Our work presents computation lower bounds for any single-server PIR with preprocessing that makes blackbox usage of {\em any} cryptography (such as random oracles and virtual blackbox obfuscation). For any client preprocessing scheme where the client stores $s$ bits about an $n$-bit database, we prove the online amortized computation must be $\Omega(n/s)$ across $k = \Omega(s)$ queries (even if performed in a single batch query). In more detail, we prove that they must have either $\Omega(n/s)$ amortized online communication or the server must perform $\Omega(n/s)$ cryptographic operations. Our lower bounds are optimal as there exist PIRs with client preprocessing matching exactly one of the above requirements while outperforming the other. Furthermore, our lower bounds also rule out the existence of doubly efficient PIR from blackbox cryptography with sublinear query computation. Our proof framework also supports $\Omega(n/s)$ communication lower bounds for three mildly restricted classes of single-server PIR. We also prove lower bounds for symmetric private information retrieval (SPIR) with client preprocessing in the random oracle model and present a matching SPIR construction with client preprocessing using only OWFs during queries.
