Whitepaper

[jayavanth]

Hello, is there a whitepaper for the HE and PIR implementation? I was wondering why BFV was chosen. Also wondering in what circumstances to use aclsPir and mulPir specified here. How do those two protocols differ from simplePIR or hintlessPIR?

[bwesterb]

Would also love to learn the number of entries per shard.

[fboemer]

Hello, is there a whitepaper for the HE and PIR implementation?

Hi! There's no comprehensive whitepaper for Swift Homomorphic Encryption, but Section 6 in https://arxiv.org/pdf/2406.06761 has some optimizations implemented here. https://eprint.iacr.org/2019/1483.pdf also has some details on MulPir.

I was wondering why BFV was chosen.

BFV is well-studied and a good fit for PIR. Table 5 from https://eprint.iacr.org/2019/1483.pdf shows it's better suited for PIR than ElGamal, for instance. CKKS uses approximate arithmetic, so it's not a great fit for PIR. BGV is also a possibility.

Also wondering in what circumstances to use aclsPir and mulPir specified here.

AclsPir is actually unimplemented at the moment; #43 adds some checks to make this more clear. To answer the question though, AclsPir would be expected to have larger response size, but faster server runtime than MulPir. The introduction from https://eprint.iacr.org/2019/1483.pdf has some more details.

How do those two protocols differ from simplePIR or hintlessPIR?
From a practical perspective, SimplePir offers faster runtime, but requires the client to download and maintain a large offline hint. MulPir/AclsPir require only a very small client state, essentially just the database size.
HintlessPir removes the need for the hint, making it a similar scheme as MulPir/AclsPir in that sense.
The mechanics of the schemes differ, e.g. HintlessPir uses a fresh RLWE secret polynomial, and sends the evaluation key with each query, leading to larger query size than MulPir.

The ideal PIR scheme will depend on the problem setting, including tradeoffs between client/server, state/compute, online vs offline, bandwidth vs runtime, etc.

[fboemer]

Would also love to learn the number of entries per shard.

In Swift Homomorphic Encryption, the sharding can be set as desired, e.g. in PirShardDatabase.

[jayavanth]

thank you that's very helpful