Onion ORAM: A Constant Bandwidth Blowup Oblivious RAM

We present Onion ORAM, an Oblivious RAM (ORAM) with constant worst-case bandwidthblowup that leverages poly-logarithmic server computation to circumvent the logarithmic lowerbound on ORAM bandwidth blowup. Our construction does not require fully homomorphicencryption, but employs an additively homomorphic encryption scheme such as the Damg̊ard-Jurik cryptosystem, or alternatively a BGV-style somewhat homomorphic encryption schemewithout bootstrapping. At the core of our construction is an ORAM scheme that has “shallowcircuit depth” over the entire history of ORAM accesses. We also propose novel techniques toachieve security against a malicious server, without resorting to expensive and non-standardtechniques such as SNARKs. To the best of our knowledge, Onion ORAM is the first concreteinstantiation of a constant bandwidth blowup ORAM under standard assumptions (even for thesemi-honest setting).