On the Optimal File Size of Capacity-Achieving Byzantine-Resistant Private Information Retrieval Schemes

TL;DR

This paper explores how to design efficient private information retrieval systems that resist server collusion and errors while minimizing download costs and file size.

Contribution

The paper introduces PIR schemes with minimal download costs and smallest file size, adaptable to varying numbers of participating servers.

Findings

PIR schemes with minimal download costs and smallest file size are proposed.

A scheme is introduced that adapts to varying numbers of participating servers.

The results extend previous conference findings to handle straggler servers.

Abstract

We consider the problem of designing a Private Information Retrieval (PIR) scheme for n files replicated on k servers that can collude and return incorrect answers. Our goal is to correctly retrieve a specific message while keeping its identity private from the database servers. We focus on minimizing download costs and propose PIR schemes with minimal download costs and the smallest file size (proportional to the number of involved servers). Motivated by the possible presence of stragglers, we extend our previous conference results and propose a scheme in which the number of participating servers may vary.

Full text

1. Introduction

A Private Information Retrieval (PIR) scheme is a tool to retrieve a given file $[eqn]$ from a database $[eqn]$ , while keeping its identity $[eqn]$ private for the database servers [1,2]. This setup has many related practical applications, including protecting the identity of stock market records reviewed by investment funds and efficiently retrieving blockchain transactions for Ethereum and Bitcoin lightweight clients [3,4]. In this paper, we are interested in multi-server PIR settings, in which each of the k servers stores the database, and the client queries each server once. The goal in the classical PIR setting is to keep the identity of the retrieved file private from up to t honest-but-curious servers. In the PIR literature, such a scheme is called a t-private k-server PIR scheme, and this property is known as t-privacy. However, such a setup assumes that servers are honest-but-curious and that they provide correct answers, which cannot be guaranteed in the cloud environment. For example, servers may store outdated databases and, consequently, provide erroneous answers. This case corresponds to the unsynchronized PIR problem in the literature [5]. A more severe case arises when some servers are controlled by an adversary who aims to confuse the user by sending corrupted answers. This scenario is known as the PIR with adversarial servers problem [6].

Motivated by the challenges mentioned above, in this paper we focus on the scenario in which the user can retrieve the correct file of interest in the presence of up to b incorrect responses from servers, known as b-Byzantine resistance [7,8,9,10]. We note that errors introduced by Byzantine servers can be intentional or unintentional; however, in both cases, the user must still be able to retrieve the desired message. In what follows, we focus on the case of an omniscient Byzantine adversary with zero probability of error, while leaving the case of a limited-knowledge adversary with a vanishingly small probability of error, as per [11], for further research.

One of the main performance metrics of PIR schemes is the download rate, defined as the ratio of the retrieved file size to the total amount of information downloaded by the user. The maximum achievable download rate is known under the name of capacity [12]. Maximizing the download rate for PIR schemes in different scenarios is a well-studied scientific problem [1]. The capacity of Byzantine PIR was established in [7], where the authors also proposed a general achievable scheme based on MDS codes. This involves dividing each file into multiple sub-packets, with the number of sub-packets denoted as the sub-packetization. In [7], the scheme had a sub-packetization value of $[eqn]$ , while the problem of determining its minimum value was posed as an open problem by the authors. Since the proposed construction relies on MDS codes, it requires a sufficiently large finite field size. To take this factor into account, in this paper we focus on the total file size. Note that a large number of field elements makes storage and indexing complicated, while a large field size affects the speed of the involved operations [13]. The main result of this paper is the first capacity-achieving Byzantine-resistant PIR scheme with small file size, which fills the existing gap in the research literature and answers the question posed in [7].

There has been considerable research on reducing the file size and finding its minimum value for different PIR setups in the capacity-achieving regime, where the file size is typically large. The latter includes 1-colluding replicated PIR [14], 1-colluding MDS-coded PIR [15,16,17], and t-colluding replicated PIR [18]. However, to the best of our knowledge, there are no papers that consider a similar problem for Byzantine-resistant PIR. To address this gap, in this paper, we continue our study from [19] and propose a b-Byzantine-resistant k-server PIR scheme attaining asymptotic capacity and with a small file size.

We begin with a t-private PIR scheme based on a recently proposed communication-efficient secret sharing scheme with a small share size from [20]. In this scheme, we represent the whole database as a single vector, and our goal is to privately retrieve certain subsets of its elements. To achieve this, we construct queries such that the desired elements of the vector correspond to the values of a polynomial of a certain degree at specific points. The servers then provide the values of this polynomial at different points, or some function derived from them. In our case, this function is the trace mapping, and we rely on the secret reconstruction algorithms from [20]. To transform this scheme into a Byzantine-resistant setup, inspired by [21], we utilize the idea of constructing a generalized Reed–Solomon code from traces downloaded from servers. The resulting scheme is non-universal, meaning that we have a fixed number of servers with certain restrictions that must participate in the retrieval process. This was described in the conference version of this paper [19]. In this journal version, we generalize the scheme to a universal setup in which there is a finite set of possible values for the number of servers participating in recovery. This makes it possible to configure the scheme based on the current number of available servers. To achieve this, we increase the extension degree of the underlying field and utilize the fact that the extended field can contain several intermediate fields with different extension degrees. Within each of these intermediate fields, the corresponding non-universal scheme can be applied. Since the non-universal scheme is a special case of the universal one, in this paper we present only the universal scheme. We also formally prove that the file size in this scheme is optimal among all capacity-achieving Byzantine-resistant PIR schemes with a sufficiently large number of files.

The rest of this paper is organized as follows: In Section 2, we introduce all of the definitions that we need and list state-of-the-art results. Section 3 is devoted to an explanation of the universal Byzantine-resistant PIR scheme. In Section 4, we derive a lower bound on the file size. Finally, in Section 5, we present a comparison of the proposed scheme with another Byzantine-resistant PIR scheme that attains the capacity for an asymptotically large number of files and allows us to vary the number of participating servers. In Section 6, we provide the conclusions.

2. Preliminaries

2.1. Notations

For any prime power q, we denote the finite field with q elements by $[eqn]$ and call it the base field. Let $[eqn]$ be its extension of degree e, and call it the extended field. An extension of the field $[eqn]$ of degree $[eqn]$ , where $[eqn]$ , forms an intermediate field $[eqn]$ , which is a subfield of $[eqn]$ . For any $[eqn]$ we define the trace-mapping function from $[eqn]$ to $[eqn]$ as $[eqn]$ . We note that this is an $[eqn]$ -linear function. It is clear that $[eqn]$ can be seen as an $[eqn]$ -linear space of dimension $[eqn]$ . We can define an $[eqn]$ -basis $[eqn]$ and its trace-dual basis $[eqn]$ . It is clear that $[eqn]$ if $[eqn]$ , and $[eqn]$ otherwise. By $[eqn]$ we denote the ring of polynomials over $[eqn]$ . The minimal polynomial of an element $[eqn]$ of the finite field $[eqn]$ is a nonzero monic polynomial of the smallest degree in $[eqn]$ , such that its value at the point $[eqn]$ is zero. We refer the reader to [22] for an extensive introduction to finite field theory. By $[eqn]$ we denote the entropy of a discrete random variable X, and by $[eqn]$ we denote the mutual information between two discrete random variables X and Y. A comprehensive overview of information theory can be found in [23]. The main notations utilized in this paper are listed in Table 1.

Throughout this paper, we consider a database with n files, each containing s elements of the extended field. The parameter s is the sub-packetization. We represent the database as the vector $[eqn]$ of length $[eqn]$ . We define the file $[eqn]$ and introduce the following database polynomial over $[eqn]$ with $[eqn]$ indeterminates $[eqn]$ :

$$[eqn]$$

It is clear that $[eqn]$ for the indicator vector $[eqn]$ of length $[eqn]$ with all zeros except a single one in the position $[eqn]$ . As a result, to retrieve file $[eqn]$ , we have to obtain elements $[eqn]$ . For example, in the case of $[eqn]$ and $[eqn]$ , we have two files of two elements, $[eqn]$ and $[eqn]$ . The database is $[eqn]$ , and the database polynomial has the following form: $[eqn]$ . It is clear that, to recover the file $[eqn]$ , we need to obtain the values of $[eqn]$ at the points $[eqn]$ and $[eqn]$ .

2.2. k-Server PIR Schemes

Let us formally define the k-server PIR scheme for the replicated database. The user aims to retrieve the file $[eqn]$ by sending queries $[eqn]$ to k servers. Upon receiving the query $[eqn]$ , each server $[eqn]$ computes the corresponding answer $[eqn]$ and sends it back to the user. In the Byzantine PIR setting, there exists an unknown set of up to b servers that may provide incorrect answers to queries. With this introduction, we can now formally define k-server t-private b-Byzantine-resistant PIR.

Definition 1(k-server t-private b-Byzantine-resistant PIR). A k-server t-private b-Byzantine-resistant PIR is a scheme that satisfies the following properties:

• 1. (Privacy) The scheme is t-private, i.e., any subset of t or fewer queries does not reveal any information about the identity of the file of interest.
• 2. (Correctness) The scheme is correct and b-Byzantine-resistant, i.e., the user is always able to successfully decode the file of interest from any k queries and corresponding answers even if up to b answers are incorrect. We note that the set of incorrect answers is not known to the user a priori.

Remark 1. By setting $[eqn]$ , this definition is reduced to a t-private k-server PIR scheme.

The capacity of a single-round k-server t-private b-Byzantine-resistant PIR scheme under the zero probability of incorrect retrieval and omniscient adversary for the case of $[eqn]$ is shown in [7] to be equal to

$$[eqn]$$

Given the large number of files in real-life systems, we are interested in asymptotic capacity values. Therefore, we let $[eqn]$ , and for the case of $[eqn]$ , we have the following capacity value of a Byzantine PIR scheme:

$$[eqn]$$

2.3. A Communication-Efficient PIR Scheme

Let us adopt a communication-efficient secret sharing scheme from [20] to obtain a k-server t-private PIR scheme with an optimal download rate and sub-packetization $[eqn]$ . Within the example of Section 2.1, to obtain the file $[eqn]$ , we deploy a ramp secret sharing scheme with threshold t for the vectors $[eqn]$ and $[eqn]$ as secrets from [24]. The latter is a four-dimensional curve that passes through these two vectors and t other random vectors. Each server, as a query, receives the value of this curve at a designated point. As an answer, the server computes the value of the database polynomial at its curve value. These answers are values of a polynomial of degree $[eqn]$ , and to obtain the file of interest, we need to recover its values at the points corresponding to the secrets. The latter can be performed either by Lagrange interpolation or through the trace-repair framework. For the convenience of the reader, before providing the details of the whole scheme and proving its correctness, let us illustrate the process using $[eqn]$ servers and the trace-repair framework.

At the beginning, for all components $[eqn]$ of the file, we compute the values of $[eqn]$ . Here, $[eqn]$ is a basis of $[eqn]$ over $[eqn]$ , $[eqn]$ is its trace-orthogonal basis, $[eqn]$ is the minimal polynomial of $[eqn]$ over $[eqn]$ , and $[eqn]$ and $[eqn]$ are multipliers of the generalized Reed–Solomon code. Without loss of generality, assume that we download the following traces from servers $[eqn]$ : $[eqn]$ . Each trace is an element of $[eqn]$ . After this, we find $[eqn]$ and obtain the file $[eqn]$ .

Scheme $[eqn]$ : k-server t-private PIR     Let t, r, $[eqn]$ , and k be positive integers satisfying $[eqn]$ , $[eqn]$ , $[eqn]$ where $[eqn]$ and $[eqn]$ . Denote by $[eqn]$ . Let $[eqn]$ , $[eqn]$ , and $[eqn]$ be publicly known non-intersecting sets such that all elements of $[eqn]$ are roots of distinct monic irreducible polynomials of degree e over $[eqn]$ .

• Query Generation Algorithm: To retrieve the file $[eqn]$ , the user randomly generates t random vectors $[eqn]$ and draws a random degree- $[eqn]$ curve

$$[eqn]$$

that resides in $[eqn]$ and passes through points $[eqn]$ . The query to server $[eqn]$ is $[eqn]$ . We note that $[eqn]$ depends on the retrieved index $[eqn]$ , but we omit the subscript $[eqn]$ for readability. As introduced earlier, $[eqn]$ is an indicator vector of length $[eqn]$ with all zeros except for a single one at position $[eqn]$ .

• Answer Generation Algorithm: Upon receiving the query $[eqn]$ , the server $[eqn]$ computes $[eqn]$ , where $[eqn]$ is the database polynomial over $[eqn]$ determined in (1). We can observe that $[eqn]$ , which is a polynomial in $[eqn]$ of degree $[eqn]$ , such that $[eqn]$ for $[eqn]$ .

• -Each involved server $[eqn]$ , $[eqn]$ responds with

$$[eqn]$$

where $[eqn]$ and

$$[eqn]$$

Clearly, when $[eqn]$ , we have $[eqn]$ and, as a result, $[eqn]$ .

• File retrieval algorithm
• -For retrieval from answers from $[eqn]$ servers, the user applies the Lagrange interpolation formula to recover the polynomial $[eqn]$ and, as a result, obtains $[eqn]$ .
• -For retrieval from answers from servers within the set $[eqn]$ , $[eqn]$ , $[eqn]$ , the user prepares a basis $[eqn]$ for $[eqn]$ over $[eqn]$ and its trace-orthogonal basis $[eqn]$ . Then, for all $[eqn]$ and $[eqn]$ , the user chooses polynomials $[eqn]$ of degree less than d so that

$$[eqn]$$

where $[eqn]$ is the minimal polynomial of $[eqn]$ over $[eqn]$ , and

$$[eqn]$$

The user retrieves the file of interest by

$$[eqn]$$

for all $[eqn]$ .

Theorem 1. Scheme $[eqn]$ is a k-server t-private PIR over $[eqn]$ with retrieval threshold $[eqn]$ and file size $[eqn]$ bits that allows retrieval from any $[eqn]$ servers and achieves the asymptotic capacity (3) for $[eqn]$ and any given s and r so that $[eqn]$ , $[eqn]$ , and $[eqn]$ for $[eqn]$ , $[eqn]$ , and $[eqn]$ .

Proof. Let us prove privacy and correctness properties according to Definition 1 in case of $[eqn]$ and show that responses from r servers are enough for file retrieval. The proof is similar to the proof from [20], but for the convenience of the reader, we present it here in full detail.To prove the privacy, we need to show that $[eqn]$ , for any subset $[eqn]$ of t servers and any file index $[eqn]$ . As each element of the vector $[eqn]$ is encoded separately from other elements, and corresponding random symbols are independent, each component of $[eqn]$ depends only on corresponding components of indicator vectors and is conditionally independent of everything else. Hence, our scheme is equivalent to the transmission over $[eqn]$ independent channels [23] and, as a result, we have

$$[eqn]$$

It can be easily seen that for each i, $[eqn]$ are t evaluations of a random polynomial $[eqn]$ of degree $[eqn]$ over $[eqn]$ at $[eqn]$ different points $[eqn]$ . Hence, for any given values of $[eqn]$ , using the Lagrange interpolation formula we can obtain a unique polynomial $[eqn]$ over $[eqn]$ such that $[eqn]$ and $[eqn]$ . As a result, $[eqn]$ , and according to (4), the privacy property holds.The property that responses from $[eqn]$ servers are enough for file retrieval trivially follows from the Lagrange interpolation formula and the fact that responses from servers are values of the polynomial $[eqn]$ over $[eqn]$ of degree $[eqn]$ , so that $[eqn]$ for $[eqn]$ . Let us prove the correctness of scheme $[eqn]$ for any $[eqn]$ , $[eqn]$ servers $[eqn]$ . It is clear that values $[eqn]$ can be seen as a codeword of Reed–Solomon code of length $[eqn]$ and dimension r:

$$[eqn]$$

where $[eqn]$ .The dual of $[eqn]$ is a generalized Reed–Solomon code $[eqn]$ ([25]), defined as follows:

$$[eqn]$$

where $[eqn]$ for $[eqn]$ and $[eqn]$ for $[eqn]$ .Recall that $[eqn]$ are roots of distinct monic irreducible polynomials of degree e over $[eqn]$ . Since $[eqn]$ is a subfield of $[eqn]$ , each element of $[eqn]$ can be represented as value of polynomial of degree less than $[eqn]$ over $[eqn]$ in point $[eqn]$ for all $[eqn]$ . For each minimal polynomial $[eqn]$ of $[eqn]$ of degree d over $[eqn]$ (see [26] for more details), we have

$$[eqn]$$

Let $[eqn]$ be the basis of $[eqn]$ over $[eqn]$ , and $[eqn]$ is its trace-orthogonal basis. For each $[eqn]$ and $[eqn]$ , we can represent the element $[eqn]$ as the value of function $[eqn]$ of degree less than d at point $[eqn]$ . It is clear that $[eqn]$ ; hence, such functions belong to the dual generalized Reed–Solomon code (5). Also, we have

$$[eqn]$$

and

$$[eqn]$$

Consequently,

$$[eqn]$$

Utilizing (6) and (7), we have

$$[eqn]$$

and

$$[eqn]$$

Applying the trace-mapping function from $[eqn]$ to $[eqn]$ to both sides of Equation (8), and utilizing the facts that $[eqn]$ , $[eqn]$ , and $[eqn]$ for all $[eqn]$ , $[eqn]$ , $[eqn]$ , together with the linearity of the trace-mapping function, we obtain

$$[eqn]$$

From the fact that $[eqn]$ and $[eqn]$ are trace-orthogonal bases of $[eqn]$ over $[eqn]$ , it is clear (see, for example, [22] [Ch. 2]) that

$$[eqn]$$

and, hence, all $[eqn]$ can be retrieved by accessing $[eqn]$ from all involved servers $[eqn]$ . The observations that each file consists of s elements of $[eqn]$ for $[eqn]$ and the download rate is equal to $[eqn]$ finish the proof. □

The proposed PIR scheme has a restricted number of servers $[eqn]$ participating in the retrieval process, namely, $[eqn]$ . By letting $[eqn]$ in Scheme $[eqn]$ , we eliminate the restriction above and obtain the following corollary:

Corollary 1. In case of $[eqn]$ , Scheme $[eqn]$ is a k-server t-private PIR over $[eqn]$ with $[eqn]$ , file size $[eqn]$ bits, and a retrieval threshold r that allows the retrieval from any $[eqn]$ servers and achieves the asymptotic capacity (3) for $[eqn]$ for any r, so that $[eqn]$ .

3. Byzantine-Resistant PIR Scheme

Let us construct a k-server PIR scheme with t-colluding and b-Byzantine servers by modifying the construction from Section 2.3. To deal with Byzantine servers, inspired by [21], we modify the protocol by multiplying the responses by specifically selected polynomials so that the server responses form a generalized Reed–Solomon code. Importantly, to ensure the possibility of error correction, we increase the number of required responses so that the codeword formed by them possesses the desired code-distance properties. For the convenience of the reader, before giving the details of the whole scheme and providing a proof of its correctness, let us illustrate the repair process using the trace-repair framework from $[eqn]$ servers in the presence of up to b incorrect answers from servers.

The pre-computation and download steps remain the same as for the scheme with correct answers from servers. To find the file of interest, before trace reconstruction, we form the following vector from the received traces $[eqn]$ and decode it as a codeword of a generalized Reed–Solomon code using any decoding algorithm (see, for example, [25]). As a result, we obtain the correct values of the elements of the vector above and can recover the correct values $[eqn]$ . Further steps remain the same.

Scheme  $[eqn]$ : k-server* t*-private b-Byzantine-resistant PIR    Let t, r, $[eqn]$ , and k be positive integers satisfying $[eqn]$ , $[eqn]$ , $[eqn]$ where $[eqn]$ and $[eqn]$ . Denote by $[eqn]$ . Let $[eqn]$ , $[eqn]$ , and $[eqn]$ be publicly known non-intersecting sets such that all elements of $[eqn]$ are roots of distinct monic irreducible polynomials of degree e over $[eqn]$ .

• Query Generation Algorithm: To retrieve the file $[eqn]$ , the user generates t random vectors $[eqn]$ and draws a random degree- $[eqn]$ curve

$$[eqn]$$

that resides in $[eqn]$ and passes through points $[eqn]$ . The query to server $[eqn]$ is $[eqn]$ . We note that $[eqn]$ depends on the retrieved index $[eqn]$ , but we omit the subscript $[eqn]$ for readability. As introduced earlier, $[eqn]$ is an indicator vector of length $[eqn]$ with all zeros except for a single one at position $[eqn]$ .

• Answer Generation Algorithm: Upon receiving the query $[eqn]$ , server $[eqn]$ computes $[eqn]$ , where $[eqn]$ is the database polynomial over $[eqn]$ determined in (1). We can observe that $[eqn]$ , which is a polynomial in $[eqn]$ of degree $[eqn]$ such that $[eqn]$ for $[eqn]$ .

• -Each involved server $[eqn]$ , $[eqn]$ responds with

$$[eqn]$$

where $[eqn]$ and

$$[eqn]$$

Clearly, when $[eqn]$ , we have $[eqn]$ and, as a result, $[eqn]$ .

• File Retrieval Algorithm
• -For retrieval using answers from $[eqn]$ servers, the user applies a Reed–Solomon decoding algorithm to recover the polynomial $[eqn]$ and, as a result, obtains $[eqn]$ (see, for example, [25]).
• -For retrieval using answers from the set $[eqn]$ , $[eqn]$ , $[eqn]$ , the user decodes the vector

$$[eqn]$$

where $[eqn]$ is the minimal polynomial of $[eqn]$ over $[eqn]$ , as a codeword of generalized Reed–Solomon code over $[eqn]$ , using any decoding algorithm (see, for example, [25]), and extracts the correct values of $[eqn]$ for $[eqn]$ .Next, the user prepares a basis $[eqn]$ for $[eqn]$ over $[eqn]$ and its trace-orthogonal basis $[eqn]$ . After that, for all $[eqn]$ and $[eqn]$ , the user chooses polynomials $[eqn]$ of degree less than d so that

$$[eqn]$$

where $[eqn]$ is the minimal polynomial of $[eqn]$ over $[eqn]$ and

$$[eqn]$$

The user retrieves the file of interest by

$$[eqn]$$

for all $[eqn]$ .

Theorem 2. Scheme $[eqn]$ is a k-server t-private b-Byzantine-resistant PIR over $[eqn]$ with retrieval threshold $[eqn]$ and file size $[eqn]$ that allows the retrieval from any $[eqn]$ servers and achieves the asymptotic capacity (3) for any given s and r so that $[eqn]$ , $[eqn]$ and $[eqn]$ for $[eqn]$ , $[eqn]$ and $[eqn]$ .

Proof. Let us prove the privacy and correctness properties according to Definition 1. The proof of privacy is identical to that of Theorem 1 and is therefore omitted here. We will now demonstrate the correctness property, beginning with the case where $[eqn]$ . The property that responses from $[eqn]$ servers are enough for file retrieval follows from the fact that values $[eqn]$ can be seen as a codeword of Reed–Solomon code of length $[eqn]$ and dimension $[eqn]$ :

$$[eqn]$$

As a result, with values of the polynomial $[eqn]$ in any $[eqn]$ points, we can correctly interpolate it in the presence of b incorrect values utilizing a Reed–Solomon decoding algorithm (see, for example, [25]).Let us prove the correctness of scheme $[eqn]$ for the case of $[eqn]$ , $[eqn]$ servers $[eqn]$ . It is clear that values $[eqn]$ can be seen as a codeword of Reed–Solomon code of length $[eqn]$ and dimension $[eqn]$ :

$$[eqn]$$

where $[eqn]$ .The dual of $[eqn]$ is a generalized Reed–Solomon code $[eqn]$ , defined as follows:

$$[eqn]$$

where $[eqn]$ for $[eqn]$ and $[eqn]$ for $[eqn]$ .Recall that $[eqn]$ are roots of distinct monic irreducible polynomials of degree e over $[eqn]$ . Since $[eqn]$ is a subfield of $[eqn]$ , each element of $[eqn]$ can be represented as a polynomial value of degree less than $[eqn]$ over $[eqn]$ in point $[eqn]$ for all $[eqn]$ . For each minimal polynomial $[eqn]$ of $[eqn]$ of degree d over $[eqn]$ (see [26] for more details), we have

$$[eqn]$$

Let $[eqn]$ be the basis of $[eqn]$ over $[eqn]$ , and let $[eqn]$ be its trace-orthogonal basis. For each $[eqn]$ and $[eqn]$ , we can represent the element $[eqn]$ as the value of function $[eqn]$ of degree less than d at point $[eqn]$ . It is clear that $[eqn]$ ; hence, such functions belong to the dual generalized Reed–Solomon code (9). Also, we have

$$[eqn]$$

and

$$[eqn]$$

Consequently,

$$[eqn]$$

Employing (10) and (11), we have

$$[eqn]$$

and

$$[eqn]$$

Applying the trace-mapping function from $[eqn]$ to $[eqn]$ to both sides of Equation (12), and utilizing the facts that $[eqn]$ , $[eqn]$ , and $[eqn]$ for all $[eqn]$ , $[eqn]$ , $[eqn]$ , together with the linearity of the trace-mapping function, we obtain

$$[eqn]$$

From the fact that $[eqn]$ and $[eqn]$ are trace-orthogonal bases of $[eqn]$ over $[eqn]$ , it is clear (see, for example, [22] [Ch. 2]) that

$$[eqn]$$

and, hence, all $[eqn]$ can be recovered by accessing $[eqn]$ from all involved servers $[eqn]$ .Let us show that we can correctly recover $[eqn]$ in case of at most b incorrect values of $[eqn]$ . The main idea here is to formally show that the elements $[eqn]$ form a codeword of a generalized Reed–Solomon code over $[eqn]$ of length $[eqn]$ and dimension $[eqn]$ . To do so, let us define the functions $[eqn]$ .It is clear that $[eqn]$ for all $[eqn]$ and $[eqn]$ . Hence, for all $[eqn]$ , we know that $[eqn]$ and, as a result, these functions belong to the generalized Reed–Solomon code (9), which is dual to the original Reed–Solomon code. We can write down the duality condition

$$[eqn]$$

As $[eqn]$ and $[eqn]$ , applying the trace-mapping function from $[eqn]$ to $[eqn]$ to both sides of Equation (13) and utilizing its linearity, we have

$$[eqn]$$

where $[eqn]$ , and all multipliers in each term belong to $[eqn]$ for all $[eqn]$ . Applying [21] [Proposition 1], we find that the elements $[eqn]$ form a codeword of generalized Reed–Solomon code over $[eqn]$ that can correct up to b errors, and users can retrieve the correct values of $[eqn]$ from server responses for all $[eqn]$ by employing any generalized Reed–Solomon decoder (see, for example [25]). The observations that each file consists of s elements of $[eqn]$ for $[eqn]$ and that the download rate is equal to $[eqn]$ finish the proof. □

The proposed PIR scheme has a restricted number of servers participating in the retrieval process, namely, $[eqn]$ . By letting $[eqn]$ in Scheme $[eqn]$ , we eliminate the restriction above and obtain the following corollary:

Corollary 2. In case of $[eqn]$ , Scheme $[eqn]$ is a k-server t-private b-Byzantine-resistant PIR over $[eqn]$ with $[eqn]$ , file size $[eqn]$ bits, and a retrieval threshold r that allows the retrieval from any $[eqn]$ servers and achieves the asymptotic capacity (3) for any r so that $[eqn]$ .

4. Lower Bound on the File Size

In this section, following the derivations in [20] [Section V], we describe the class of Byzantine-resistant PIR schemes and demonstrate that our schemes belong to this class and achieve optimal file size. In what follows, we consider a k-server b-Byzantine-resistant PIR scheme with a retrieval threshold r, deployed over the extended field $[eqn]$ with base field size $[eqn]$ and sub-packetization s. We omit these details within this section for clarity purposes.

Definition 2(Balanced Byzantine-resistant PIR). The Byzantine-resistant PIR scheme is balanced if, for any permitted set of involved servers $[eqn]$ with $[eqn]$ , the user downloads a single element of the same subfield $[eqn]$ from each involved server.

Definition 3(Rate-optimal Byzantine-resistant PIR). The Byzantine-resistant PIR scheme is rate-optimal if, for any file $[eqn]$ , we have $[eqn]$ .

After introducing the necessary definitions, we can formulate the main theorem of this section:

Theorem 3. For a balanced rate-optimal Byzantine-resistant PIR scheme that achieves the asymptotic capacity (3) and admits the retrieval from any $[eqn]$ servers with the retrieval threshold $[eqn]$ , the following hold:

$$[eqn]$$ $$[eqn]$$

Proof. As the considered scheme is rate-optimal, $[eqn]$ . Since the considered scheme is balanced, we assume that the user downloads a single element of $[eqn]$ from each involved server $[eqn]$ , $[eqn]$ . At the same time, the scheme achieves the asymptotic capacity (3), and the download cost is optimal. By writing this down along with the total amount of data downloaded from the servers, we can state the following equality:

$$[eqn]$$

This leads to $[eqn]$ . Since e is a positive integer and $[eqn]$ is a subfield of $[eqn]$ , then $[eqn]$ divides e and, hence,

$$[eqn]$$

Since Equation (14) holds for all $[eqn]$ and $[eqn]$ , then $[eqn]$ and, as a result,

$$[eqn]$$

□

Corollary 3. The scheme $[eqn]$ is a balanced capacity-achieving rate-optimal Byzantine-resistant PIR with optimal file size for an asymptotically large number of files.

5. Comparison

In this section, we compare PIR schemes $[eqn]$ and $[eqn]$ in the case where $[eqn]$ with Staircase-PIR from [27]. Staircase-PIR allows retrieval without restrictions on the number of participating servers and achieves the asymptotic capacity given in (3). It also does not have a sub-packetization level exponential in the number of files n, as in the previous capacity-achieving scheme [7], making it the best scheme for comparison. We denote the latter as scheme $[eqn]$ and present its parameters in the following theorem:

Theorem 4. Scheme $[eqn]$ is k-server t-private PIR over $[eqn]$ with file size $[eqn]$ bits and retrieval threshold $[eqn]$ that allows retrieval from any $[eqn]$ servers and achieves the asymptotic capacity (3) for $[eqn]$ and any given r so that $[eqn]$ .

Scheme $[eqn]$ assumes that the servers are honest-but-curious and provide correct answers. To add the b-Byzantine resistance, we can utilize error-correction capabilities of underlining staircase codes in the same way as shown in [28]. We present the parameters of the resulting scheme $[eqn]$ in the following theorem:

Theorem 5. Scheme $[eqn]$ is k-server t-private b-Byzantine-resistant PIR over $[eqn]$ with file size $[eqn]$ bits and retrieval threshold $[eqn]$ , which achieves the asymptotic capacity (3) for any given r so that $[eqn]$ .

Let us start with numerical comparison. Let us consider a PIR scheme with 27 servers deployed over $[eqn]$ with $[eqn]$ and $[eqn]$ , allowing recovery from $[eqn]$ servers. Each file consists of $[eqn]$ components. As a result, each file in scheme $[eqn]$ is eight elements of $[eqn]$ or 240 bits, while each file in scheme $[eqn]$ is eight vectors of 48 elements of $[eqn]$ or 1920 bits. Let us move to the retrieval process in the case of 27 involved servers. In the case of $[eqn]$ , we need to download 27 traces of $[eqn]$ that are elements of $[eqn]$ or 270 bits and decode one codeword of generalized Reed–Solomon code over $[eqn]$ . In the case of $[eqn]$ , we need to download eight vectors of length 54 over $[eqn]$ or 2160 bits and decode eight codewords of generalized Reed–Solomon code over $[eqn]$ . The same holds for other parameter values. For the convenience of the reader, we provide the values of the field size, file size, and download cost for the case of $[eqn]$ participating servers in each scheme in Table 2. We denote $[eqn]$ , $[eqn]$ , and measure all parameters in bits.

Although our schemes ( $[eqn]$ and $[eqn]$ ) are deployed over extended fields, we operate on single field elements and perform operations over the extended field. These operations can therefore be optimized [13]. In contrast, competing schemes ( $[eqn]$ and $[eqn]$ ) are deployed over base-field operands with vectors whose lengths are larger than the extension degrees in our case. This makes them slower and limits potential optimization approaches. Another advantage of our scheme is that, in Byzantine recovery, we decode only one generalized Reed–Solomon code in an intermediate field, which does not significantly increase complexity over the base field. In comparison, $[eqn]$ must decode several generalized Reed–Solomon codes, making it more computationally heavy than our approach.

6. Conclusions

We considered the problem of designing a Private Information Retrieval scheme resistant to the adversarial behavior of servers. Our focus was on minimizing download costs, and we proposed a capacity-achieving scheme with a small file size for an asymptotically large number of files of fixed size. To address the possible presence of slow or unresponsive servers, whose number is not known or may change over time, we proposed schemes in which the number of servers participating in retrieval may vary, extending the non-universal results presented in the conference. Additionally, we formally proved the optimality of the file size in the proposed schemes that significantly affect implementation complexity. Extending the proposed framework to a finite number of files, as well as considering other Byzantine PIR models, including those with a limited-knowledge adversary or vanishing probability of error, remains an interesting open problem.