A LOGARITHMIC LOWER BOUND FOR OBLIVIOUS RAM (FOR ALL PARAMETERS)

An oblivious RAM (ORAM), introduced by Goldreich and Ostrovsky [J. ACM, 43 (1996), pp. 431-473] is a (probabilistic) RAM that hides its access pattern; i.e., for every input the observed locations accessed are similarly distributed. In recent years there has been great progress both in terms of upper bounds and in terms of lower bounds, essentially pinning down the smallest overhead possible in various settings of parameters. We observe that there is a very natural setting of parameters in which no nontrivial lower bound is known-not even those in restricted models of computation (like the so-called balls and bins model). Let N and w_lgc be the number of cells and bit-size of cells, respectively, in the RAM that we wish to simulate obliviously. Denote by w_phy the cell bit-size of the ORAM. All previous ORAM lower bounds have a multiplicative w_lgc/w_phy factor which makes them trivial in many settings of parameters of interest. In this work, we prove a new ORAM lower bound that captures this setting (and in all other settings it is at least as good as previous ones, quantitatively). We show that any ORAM must make (amortized) Ω(log(^Nw_m^lgc )/log(^w_w^phy_lgc )) memory probes for every logical operation. Here, m denotes the bit-size of the local storage of the ORAM. Our lower bound implies that logarithmic overhead in accesses is necessary, even if w_phy ≫ w_lgc. Our lower bound is tight for all settings of parameters, up to the log(w_phy/w_lgc) factor. Our bound also extends to the noncolluding multiserver setting. As an application, we derive the first (unconditional) separation between the overhead needed for ORAMs in the online versus offline models. Specifically, we show that when w_lgc = log N and w_phy, m ∊ poly(log N), there exists an offline ORAM that makes (on average) o(1) memory probes per logical operation, while every online one must make Ω(log N/log log N) memory probes per logical operation. No such previous separation was known for any setting of parameters-not even in the balls and bins model.